Hallo.

Ich habe folgendes Problem:

Auf meinem Laptop ist die Datei "c:\windows\temp\winupdater.exe" durch den Trojaner "TR/Dropper.Gen" befallen.

Ich wäre sehr dankbar, wenn mir jemand erklären könnte wie ich diesen Trojaner entfernen kann.

Danke

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
• Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
• Speichere alle unsere Tools auf dem Desktop ab.
• Poste die Logfiles direkt in Deinen Thread in Code-Tags.
• Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.

Los geht's:

Schritt 1


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

FRST.txt:
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-06-2014 02
Ran by Sebastian (administrator) on BASTI-SCHLEPPI on 30-06-2014 21:11:09
Running from C:\Users\Sebastian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTimeUpdater.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
() C:\Program Files (x86)\Show-Password-soft\Show-Passwordd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\Show-Password-soft\Show-Passwordnm161.exe
() C:\Program Files (x86)\Tor\tor.exe
() C:\Program Files (x86)\WinUpd\WinUpd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11046504 2010-07-14] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2149160 2010-05-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-28] (DivX, LLC)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2013-06-22] (RealNetworks, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160 2014-02-13] (APN)
HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [1666560 2012-02-20] (AimerSoft)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\.DEFAULT\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3514176 2011-11-10] (DT Soft Ltd)
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\Run: [ccleaner] => C:\Program Files\CCleaner\CCleaner64.exe [5435744 2012-10-24] (Piriform Ltd)
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\Run: [] => [X]
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\Run: [se] => C:\Users\user\AppData\Roaming\SkypEmoticons\SE.exe  /minimized 
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\MountPoints2: {2053f697-db98-11e0-8251-001bb16640c8} - F:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...\MountPoints2: {ed22ed00-a265-11e0-8aa8-001bb16640c8} - H:\Startme.exe
HKU\S-1-5-21-76830181-1066914796-2057996457-1000\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Sebastian\AppData\Local\{3137ec37-8634-c619-3470-34d1b8cd37bc}\n. ATTENTION! ====> ZeroAccess/Alureon?
AppInit_DLLs-x32: C:\Users\SEBAST~1\AppData\Local\DProtect\eBP.dll => "C:\Users\SEBAST~1\AppData\Local\DProtect\eBP.dll" File Not Found
AppInit_DLLs-x32: ,C:\Users\SEBAST~1\AppData\Local\DProtect\eBPSD.dll => "C:\Users\SEBAST~1\AppData\Local\DProtect\eBPSD.dll" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SRS Premium Sound.lnk
ShortcutTarget: SRS Premium Sound.lnk -> C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut11_C03C290FA6F54A2B8A2DFE2786A1E275.exe (Acresso Software Inc.)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:14352
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.fastsearchings.info/?pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.fastsearchings.info/?pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {485E148E-19D8-760F-2840-63E276A4338B} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=SAMSUNGXHM641JI_S26XJ9GZA00603&ts=1377264984
SearchScopes: HKLM-x32 - DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastsearchings.info/?l=1&q={searchTerms}&pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastsearchings.info/?l=1&q={searchTerms}&pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
SearchScopes: HKCU - DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastsearchings.info/?l=1&q={searchTerms}&pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
SearchScopes: HKCU - {64989C4F-2B66-48BA-8D6F-F452CBD33249} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {88B97021-EFF3-4E8D-B8A2-0225C631E569} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastsearchings.info/?l=1&q={searchTerms}&pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: QuickTime - {D4704207-C86B-4811-951E-6F322F9CEDE7} - C:\Users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTime.dll (Apple Inc.)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{9B334387-B32E-40AA-A8DA-FFAAFCCB3AE5}: [NameServer]192.168.198.10

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Users\Sebastian\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @meadco.com/neptune plugin,version=2.0.0.29 - C:\OSA Kit Pro Player v4.0\npmeadax.dll (MeadCo Corp.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper - C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Sebastian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: @www.flatcast.com/FlatViewer 5.2 - C:\Users\SEBAST~1\AppData\Roaming\Mozilla\plugins\NpFv530.dll (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NpFv530.dll (1 mal 1 Software GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npmeadax.dll (MeadCo Corp.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPPDLicenseHelper.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Sebastian\AppData\Roaming\mozilla\plugins\NpFv530.dll (1 mal 1 Software GmbH)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-06-22]
FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta44.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta44\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha682.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha682\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha1582.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1582\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha30.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha30\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha2213.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha2213\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaWatchV1home669.net] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home669\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaBuzzV1mode2726.net] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode2726\ff
FF Extension: Media Buzz - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode2726\ff [2014-04-25]
FF HKLM-x32\...\Firefox\Extensions: [ext@RichMediaViewV1release1602.net] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release1602\ff
FF HKCU\...\Firefox\Extensions: [{B89E5135-AE18-31EF-AF34-85C4C7FF027A}] - C:\Program Files (x86)\Show-Password-soft\161.xpi
FF Extension: Show-Password - C:\Program Files (x86)\Show-Password-soft\161.xpi [2014-04-27]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-27] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
R2 QuickTimeUpdater; C:\Users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTimeUpdater.exe [18432 2011-07-12] () [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 Show-Password; C:\Program Files (x86)\Show-Password-soft\Show-Passwordnm161.exe [143872 2014-04-27] () [File not signed]
R2 tor; C:\Program Files (x86)\Tor\tor.exe [3233806 2013-08-31] () [File not signed]
R2 WinUpd; C:\Program Files (x86)\WinUpd\WinUpd.exe [59904 2014-05-14] () [File not signed]

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-11-27] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2012-06-12] (DT Soft Ltd)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-11-27] ()
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2010-11-04] (Windows (R) 2003 DDK 3790 provider)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-12-09] () [File not signed]
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
R1 {552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64; C:\Windows\System32\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64.sys [61112 2014-05-22] (StdLib)
R1 {552199fb-9890-4055-9aaf-b2f6d51d46e9}w64; C:\Windows\System32\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}w64.sys [61112 2014-04-24] (StdLib)
U3 aflw01lo; C:\Windows\System32\Drivers\aflw01lo.sys [0 ] (Advanced Micro Devices)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-30 21:11 - 2014-06-30 21:13 - 00022918 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2014-06-30 21:10 - 2014-06-30 21:11 - 00000000 ____D () C:\FRST
2014-06-30 21:08 - 2014-06-30 21:08 - 02083328 _____ (Farbar) C:\Users\Sebastian\Desktop\FRST64.exe
2014-06-30 19:57 - 2014-06-30 21:02 - 00000143 _____ () C:\Users\Sebastian\Desktop\Trojaner-Board.txt
2014-06-29 16:29 - 2014-06-29 16:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\SkypEmoticons
2014-06-29 16:29 - 2014-06-29 16:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SkypEmoticons
2014-06-29 16:27 - 2014-06-29 16:27 - 00000000 ____D () C:\Program Files\Level Quality Watcher
2014-06-29 14:35 - 2014-06-29 14:35 - 00000000 _____ () C:\autoexec.bat
2014-06-29 14:34 - 2014-06-29 14:34 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-06-29 14:33 - 2014-06-29 16:35 - 00000000 ____D () C:\windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-06-29 14:14 - 2014-06-29 14:14 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\TestApp
2014-06-29 14:14 - 2014-06-29 14:14 - 00000000 ____D () C:\ProgramData\PC Tools
2014-06-28 16:58 - 2014-06-29 07:24 - 00000452 _____ () C:\Users\Sebastian\Desktop\Zed.txt
2014-06-27 23:28 - 2014-06-27 23:29 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-27 23:28 - 2014-06-27 23:28 - 00000000 ____D () C:\Users\Sebastian\ Malwarebytes Anti-Malware 
2014-06-27 23:28 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-27 23:28 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-27 23:28 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-27 23:25 - 2014-06-27 23:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sebastian\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-27 15:54 - 2014-06-27 15:55 - 636661760 _____ () C:\Users\Sebastian\Desktop\Avira_Notfall_CD.iso
2014-06-27 15:29 - 2014-06-27 15:46 - 638438160 _____ (Avira GmbH) C:\Users\Sebastian\Downloads\rescue-system.exe
2014-06-25 16:33 - 2014-06-27 15:34 - 00000694 _____ () C:\Users\Sebastian\Desktop\Avira_Rescue_System.txt
2014-06-22 11:33 - 2014-06-30 19:22 - 00002016 _____ () C:\windows\setupact.log
2014-06-22 11:33 - 2014-06-29 19:17 - 00001960 _____ () C:\windows\PFRO.log
2014-06-22 11:33 - 2014-06-22 11:33 - 00000000 _____ () C:\windows\setuperr.log
2014-06-22 09:20 - 2014-06-30 19:29 - 00264451 _____ () C:\windows\WindowsUpdate.log
2014-06-20 15:36 - 2014-06-20 15:36 - 00001062 _____ () C:\Users\Public\Desktop\DivX Player.lnk
2014-06-15 11:24 - 2014-06-24 15:32 - 00001654 _____ () C:\Users\Sebastian\Desktop\Avira_Answers_Frage.txt
2014-06-15 11:08 - 2014-06-15 11:25 - 00000151 _____ () C:\Users\Sebastian\Desktop\Avira_Answers.txt
2014-06-14 22:52 - 2014-06-28 11:14 - 00000728 _____ () C:\Users\Sebastian\Desktop\Avira.txt
2014-06-14 07:46 - 2014-06-14 07:50 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\DownBooster
2014-06-14 07:46 - 2014-06-14 07:50 - 00000000 ____D () C:\Program Files (x86)\WinUpd
2014-06-13 21:03 - 2014-06-13 21:03 - 00000000 ____D () C:\Users\Sebastian\Documents\StreamTransport
2014-06-13 15:41 - 2014-06-13 15:41 - 00002428 _____ () C:\windows\SysWOW64\qtplugin.log
2014-06-13 15:41 - 2014-06-13 15:41 - 00001049 _____ () C:\Users\Sebastian\Desktop\QuickTime Player.lnk
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\windows\SysWOW64\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\ProgramData\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 _____ () C:\windows\SysWOW64\QuickTime.qtp
2014-06-13 15:41 - 1999-11-10 11:05 - 00086016 _____ (MindVision) C:\windows\unvise32qt.exe
2014-06-12 15:42 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 15:42 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 15:42 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 15:42 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 15:42 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 15:42 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 15:42 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 15:42 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 15:42 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 15:42 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 15:42 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 15:42 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 15:42 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 15:42 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-06-12 15:42 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 15:42 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 15:42 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 15:42 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-06-12 15:42 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 15:42 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 15:42 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 15:42 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-06-12 15:42 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 15:42 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-06-12 15:42 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-06-12 15:42 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-06-12 15:42 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 15:42 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-06-12 15:42 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-06-12 15:42 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-06-12 15:42 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 15:42 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-06-12 15:42 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-06-12 15:42 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 15:42 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 15:42 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-06-12 15:42 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-12 15:42 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-06-12 15:42 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-06-12 15:42 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-06-12 15:42 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-06-12 15:42 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 15:42 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-06-12 15:42 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-06-12 15:42 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-06-12 15:42 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 15:42 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-06-12 15:42 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 15:42 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-06-12 15:42 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-06-12 15:42 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 15:42 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-06-12 15:42 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 15:42 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll
2014-06-12 15:42 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 15:42 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 15:42 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 15:42 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 15:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 15:42 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-12 15:42 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll
2014-06-12 15:42 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-06-12 15:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll
2014-06-12 15:42 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
2014-06-10 20:36 - 2014-06-10 20:36 - 00000000 __SHD () C:\Users\Sebastian\AppData\Local\EmieUserList
2014-06-10 20:36 - 2014-06-10 20:36 - 00000000 __SHD () C:\Users\Sebastian\AppData\Local\EmieSiteList
2014-06-08 16:43 - 2014-06-08 16:43 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\PDF24
2014-06-08 16:41 - 2014-06-08 16:41 - 16311224 _____ (Geek Software GmbH ) C:\Users\Sebastian\Downloads\pdf24-creator-6.5.0.exe
2014-06-08 14:58 - 2014-06-08 15:22 - 00001578 _____ () C:\Users\Sebastian\Desktop\Karl_May.txt
2014-06-07 10:02 - 2014-06-07 10:02 - 00003190 _____ () C:\windows\System32\Tasks\{54A693F1-314E-4B96-8A6C-220FDD8C8C29}
2014-06-06 15:50 - 2014-06-06 15:50 - 00780704 _____ () C:\Users\Sebastian\Downloads\Player.exe
2014-06-04 22:18 - 2014-06-04 22:18 - 00668568 _____ () C:\Users\Sebastian\Downloads\Java.exe
2014-06-03 17:42 - 2014-06-03 17:42 - 00003860 _____ () C:\windows\System32\Tasks\Opera scheduled Autoupdate 1377950922

==================== One Month Modified Files and Folders =======

2014-06-30 21:13 - 2014-06-30 21:11 - 00022918 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2014-06-30 21:11 - 2014-06-30 21:10 - 00000000 ____D () C:\FRST
2014-06-30 21:09 - 2009-07-14 06:45 - 00013936 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-30 21:09 - 2009-07-14 06:45 - 00013936 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-30 21:08 - 2014-06-30 21:08 - 02083328 _____ (Farbar) C:\Users\Sebastian\Desktop\FRST64.exe
2014-06-30 21:02 - 2014-06-30 19:57 - 00000143 _____ () C:\Users\Sebastian\Desktop\Trojaner-Board.txt
2014-06-30 20:49 - 2013-09-18 15:23 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-30 20:44 - 2011-01-17 17:15 - 00001116 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-30 20:04 - 2013-09-14 13:58 - 00000000 ____D () C:\ProgramData\Origin
2014-06-30 20:04 - 2013-09-14 13:58 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-06-30 19:38 - 2011-01-24 16:42 - 00000000 ____D () C:\Users\Sebastian\Textdokumente
2014-06-30 19:29 - 2014-06-22 09:20 - 00264451 _____ () C:\windows\WindowsUpdate.log
2014-06-30 19:23 - 2011-01-15 15:18 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-30 19:22 - 2014-06-22 11:33 - 00002016 _____ () C:\windows\setupact.log
2014-06-30 19:22 - 2014-04-27 11:46 - 00000418 _____ () C:\windows\Tasks\Show-Password_wd.job
2014-06-30 19:22 - 2013-10-17 20:09 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore1cecb646eabf06.job
2014-06-30 19:22 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-30 15:26 - 2011-07-07 16:25 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\CrashDumps
2014-06-29 19:17 - 2014-06-22 11:33 - 00001960 _____ () C:\windows\PFRO.log
2014-06-29 16:35 - 2014-06-29 14:33 - 00000000 ____D () C:\windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-06-29 16:29 - 2014-06-29 16:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\SkypEmoticons
2014-06-29 16:29 - 2014-06-29 16:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SkypEmoticons
2014-06-29 16:29 - 2012-03-10 16:50 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-29 16:27 - 2014-06-29 16:27 - 00000000 ____D () C:\Program Files\Level Quality Watcher
2014-06-29 15:10 - 2011-01-15 17:44 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2014-06-29 14:35 - 2014-06-29 14:35 - 00000000 _____ () C:\autoexec.bat
2014-06-29 14:34 - 2014-06-29 14:34 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-06-29 14:14 - 2014-06-29 14:14 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\TestApp
2014-06-29 14:14 - 2014-06-29 14:14 - 00000000 ____D () C:\ProgramData\PC Tools
2014-06-29 11:21 - 2013-11-22 10:41 - 00000000 ____D () C:\AdwCleaner
2014-06-29 07:24 - 2014-06-28 16:58 - 00000452 _____ () C:\Users\Sebastian\Desktop\Zed.txt
2014-06-28 13:56 - 2013-09-14 15:19 - 00000000 ____D () C:\Users\Sebastian\Documents\FIFA 13
2014-06-28 11:14 - 2014-06-14 22:52 - 00000728 _____ () C:\Users\Sebastian\Desktop\Avira.txt
2014-06-27 23:29 - 2014-06-27 23:28 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-27 23:28 - 2014-06-27 23:28 - 00000000 ____D () C:\Users\Sebastian\ Malwarebytes Anti-Malware 
2014-06-27 23:28 - 2013-11-22 11:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-27 23:28 - 2011-01-15 15:18 - 00000000 ____D () C:\Users\Sebastian
2014-06-27 23:26 - 2014-06-27 23:25 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sebastian\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-27 22:01 - 2011-02-04 22:40 - 00000000 ____D () C:\Users\Sebastian\Bridge Building Game
2014-06-27 15:55 - 2014-06-27 15:54 - 636661760 _____ () C:\Users\Sebastian\Desktop\Avira_Notfall_CD.iso
2014-06-27 15:46 - 2014-06-27 15:29 - 638438160 _____ (Avira GmbH) C:\Users\Sebastian\Downloads\rescue-system.exe
2014-06-27 15:34 - 2014-06-25 16:33 - 00000694 _____ () C:\Users\Sebastian\Desktop\Avira_Rescue_System.txt
2014-06-24 17:15 - 2009-07-14 07:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-06-24 15:32 - 2014-06-15 11:24 - 00001654 _____ () C:\Users\Sebastian\Desktop\Avira_Answers_Frage.txt
2014-06-22 18:02 - 2011-02-13 19:28 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\SoftGrid Client
2014-06-22 11:33 - 2014-06-22 11:33 - 00000000 _____ () C:\windows\setuperr.log
2014-06-22 11:32 - 2011-01-15 15:38 - 00001003 _____ () C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-22 09:24 - 2011-01-15 17:33 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\DAEMON Tools Lite
2014-06-21 10:33 - 2011-03-24 21:58 - 00000000 ____D () C:\Users\Sebastian\D-Fend Reloaded
2014-06-21 10:18 - 2011-01-23 14:42 - 00000000 ____D () C:\Users\Sebastian\Spiele
2014-06-21 07:09 - 2011-01-16 01:28 - 00000000 ____D () C:\Users\Sebastian\Desktop\DivX
2014-06-20 16:11 - 2011-01-15 17:49 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\ICQ
2014-06-20 15:36 - 2014-06-20 15:36 - 00001062 _____ () C:\Users\Public\Desktop\DivX Player.lnk
2014-06-20 15:36 - 2013-09-09 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX
2014-06-20 15:36 - 2011-01-16 01:23 - 00000000 ____D () C:\Program Files\DivX
2014-06-20 15:36 - 2011-01-16 01:20 - 00000000 ____D () C:\ProgramData\DivX
2014-06-20 15:36 - 2011-01-16 01:20 - 00000000 ____D () C:\Program Files (x86)\DivX
2014-06-19 16:36 - 2010-08-17 21:34 - 00700134 _____ () C:\windows\system32\perfh007.dat
2014-06-19 16:36 - 2010-08-17 21:34 - 00149984 _____ () C:\windows\system32\perfc007.dat
2014-06-19 16:36 - 2009-07-14 07:13 - 01622236 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-18 22:37 - 2014-04-27 19:54 - 00000000 ____D () C:\Users\Sebastian\Desktop\Neuer Ordner
2014-06-15 11:25 - 2014-06-15 11:08 - 00000151 _____ () C:\Users\Sebastian\Desktop\Avira_Answers.txt
2014-06-14 07:50 - 2014-06-14 07:46 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\DownBooster
2014-06-14 07:50 - 2014-06-14 07:46 - 00000000 ____D () C:\Program Files (x86)\WinUpd
2014-06-13 21:03 - 2014-06-13 21:03 - 00000000 ____D () C:\Users\Sebastian\Documents\StreamTransport
2014-06-13 15:41 - 2014-06-13 15:41 - 00002428 _____ () C:\windows\SysWOW64\qtplugin.log
2014-06-13 15:41 - 2014-06-13 15:41 - 00001049 _____ () C:\Users\Sebastian\Desktop\QuickTime Player.lnk
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\windows\SysWOW64\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\ProgramData\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-06-13 15:41 - 2014-06-13 15:41 - 00000000 _____ () C:\windows\SysWOW64\QuickTime.qtp
2014-06-13 15:31 - 2013-08-15 15:33 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 15:22 - 2011-01-16 13:01 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 16:39 - 2010-08-17 04:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-11 16:39 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-11 15:32 - 2011-01-15 18:08 - 00000000 ____D () C:\Users\Sebastian\Desktop\Internet
2014-06-10 20:42 - 2010-08-17 05:00 - 00000000 ____D () C:\ProgramData\Temp
2014-06-10 20:36 - 2014-06-10 20:36 - 00000000 __SHD () C:\Users\Sebastian\AppData\Local\EmieUserList
2014-06-10 20:36 - 2014-06-10 20:36 - 00000000 __SHD () C:\Users\Sebastian\AppData\Local\EmieSiteList
2014-06-08 16:43 - 2014-06-08 16:43 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\PDF24
2014-06-08 16:41 - 2014-06-08 16:41 - 16311224 _____ (Geek Software GmbH ) C:\Users\Sebastian\Downloads\pdf24-creator-6.5.0.exe
2014-06-08 15:22 - 2014-06-08 14:58 - 00001578 _____ () C:\Users\Sebastian\Desktop\Karl_May.txt
2014-06-07 10:02 - 2014-06-07 10:02 - 00003190 _____ () C:\windows\System32\Tasks\{54A693F1-314E-4B96-8A6C-220FDD8C8C29}
2014-06-06 15:50 - 2014-06-06 15:50 - 00780704 _____ () C:\Users\Sebastian\Downloads\Player.exe
2014-06-04 22:18 - 2014-06-04 22:18 - 00668568 _____ () C:\Users\Sebastian\Downloads\Java.exe
2014-06-04 22:03 - 2012-12-22 17:57 - 00003360 _____ () C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-76830181-1066914796-2057996457-1000
2014-06-04 22:03 - 2012-12-22 17:57 - 00003234 _____ () C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-76830181-1066914796-2057996457-1000
2014-06-03 17:42 - 2014-06-03 17:42 - 00003860 _____ () C:\windows\System32\Tasks\Opera scheduled Autoupdate 1377950922
2014-06-03 17:42 - 2013-04-19 15:58 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-06-02 15:35 - 2014-05-28 15:14 - 00000130 _____ () C:\Users\Sebastian\Desktop\Atze_Schröder-Chemnitz.txt
2014-06-01 09:11 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-06-01 08:29 - 2011-01-22 14:19 - 00000000 ____D () C:\Users\Sebastian\Desktop\Spiele
2014-05-31 22:41 - 2013-06-07 19:16 - 00000125 ___SH () C:\ProgramData\.zreglib
2014-05-31 10:25 - 2014-01-21 17:21 - 00000000 ____D () C:\Users\Sebastian\Documents\gothic3

ZeroAccess:
C:\Windows\Installer\{3137ec37-8634-c619-3470-34d1b8cd37bc}
C:\Windows\Installer\{3137ec37-8634-c619-3470-34d1b8cd37bc}\@

ZeroAccess:
C:\Users\Sebastian\AppData\Local\{3137ec37-8634-c619-3470-34d1b8cd37bc}
C:\Users\Sebastian\AppData\Local\{3137ec37-8634-c619-3470-34d1b8cd37bc}\@

Files to move or delete:
====================
C:\Users\Sebastian\Opera_1215_int_Setup.exe
C:\Users\Sebastian\Setup_CM10_Rel_10_3.exe
C:\Users\Sebastian\streamwriter_setup.exe
C:\Users\Sebastian\Wolfenstein 3D (Full Version).exe


Some content of TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\avgnt.exe
C:\Users\Sebastian\AppData\Local\Temp\Quarantine.exe
C:\Users\Sebastian\AppData\Local\Temp\SHSetup.exe
C:\Users\Sebastian\AppData\Local\Temp\sSetup-se.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-01 09:00

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-06-2014 02
Ran by Sebastian at 2014-06-30 21:14:03
Running from C:\Users\Sebastian\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

"Nero SoundTrax Help (x32 Version: 4.4.32.0 - Nero AG) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.1.0.4880 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Anno 1701 (HKLM-x32\...\{A2433A63-5F5D-40E5-B529-9123C2B3E734}) (Version: 1.02 - Sunflowers)
Art Plus Download Assistant (HKLM-x32\...\Art Plus Download Assistant) (Version: 2.2.0.125 - Art Plus Marketing & Publishing)
Atheros Client Installation Program (HKLM-x32\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.5.0621 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{5635224E-675C-B94C-43EE-70BCD39BF30B}) (Version: 3.0.782.0 - ATI Technologies, Inc.)
Avidemux 2.5 (HKLM-x32\...\Avidemux 2.5) (Version: 2.5.4.6714 - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4489 - APN, LLC)
AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version:  - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version:  - Online Media Technologies Ltd.)
BatteryLifeExtender (HKLM-x32\...\{E308B555-8434-4AF8-B66F-729897C75F93}) (Version: 1.0.6 - Samsung)
Bonjour (HKLM-x32\...\{07287123-B8AC-41CE-8346-3D777245C35B}) (Version: 1.0.106 - Apple Inc.)
Bridge Building Game (HKLM-x32\...\Bridge Building Game) (Version:  - )
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.44 - Broadcom Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0706.2128.36662 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0706.2128.36662 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0706.2128.36662 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0706.2128.36662 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help English (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help French (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help German (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0706.2127.36662 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0706.2128.36662 - ATI) Hidden
ccc-utility64 (Version: 2010.0706.2128.36662 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.24 - Piriform)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink DVD Suite (x32 Version: 6.0.2806 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1916 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.0.3108a - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.)
CyberLink PowerDirector (x32 Version: 7.0.3213 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.)
CyberLink PowerDVD 8 (x32 Version: 8.0.2815b - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM-x32\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.)
CyberLink PowerProducer (x32 Version: 5.0.1.1812 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3911 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 2.0.3911 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.1.0236 - DT Soft Ltd)
Dart 'm Up (HKLM-x32\...\Dart 'm Up) (Version:  - )
D-Fend Reloaded 1.1.0 (deinstallieren) (HKLM-x32\...\D-Fend Reloaded) (Version: 1.1.0 - Alexander Herzog)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
DolbyFiles (x32 Version: 2.0 - Nero AG) Hidden
DVD Shrink 3.2 deutsch (HKLM-x32\...\DVD Shrink DE_is1) (Version:  - DVD Shrink)
Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0 - Samsung Electronics Co., LTD)
Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.2 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM-x32\...\{559D1FDB-6D5C-4EF3-8F63-5E1E93A0A244}) (Version: 4.4.1 - Samsung)
Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.0.15 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)
EasyFileShare (HKLM-x32\...\{C4582EED-A3FB-4358-8F3F-8C994460DF28}) (Version: 1.0.3 - Samsung)
EasyLife Gadget (HKLM\...\{ACE9FB2A-31A5-4285-9510-43F1636EAB21}) (Version: 1.0 - EasyLife Gadget)
Empire Earth Ultimate Edition (HKLM-x32\...\{912CE296-3D73-4A9D-B3FB-70A5CF7A8568}) (Version: 1.0 - The Games Company)
Feature Update Service (YFD) (HKCU\...\YourFileDownloaderUpdater) (Version: 2.14.21 - ) <==== ATTENTION
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.0.0.0 - Electronic Arts)
Flatcast Viewer Plugin 5.3.0.784 (HKLM-x32\...\Flatcast Viewer 5.3_is1) (Version:  - 1 mal 1 Software GmbH)
FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free YouTube Download version 3.2.20.1230 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.20.1230 - DVDVideoSoft Ltd.)
Frieven_s_Prox_1.8 (HKLM-x32\...\Frieven_s_Prox_1.8) (Version: 1.34.5.29 - shift)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
Gothic 3 (HKLM-x32\...\{13F59927-CFBE-44D1-8417-7203AD4F1795}) (Version: 1.0.0 - JoWooD)
ICQ7.7 (HKLM-x32\...\{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}) (Version: 7.7 - ICQ)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.3.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation)
Java Auto Updater (x32 Version: 2.0.6.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 15 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216015F0}) (Version: 6.0.150 - Sun Microsystems, Inc.)
Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020F0}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 27 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216027F0}) (Version: 6.0.270 - Oracle)
Java(TM) 6 Update 29 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416029FF}) (Version: 6.0.290 - Oracle)
Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.290 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Killer Sudoku 1.1.0 (HKLM-x32\...\Killer Sudoku_is1) (Version: 1.1.0 - Novel Games Limited)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
Media Buzz (HKLM-x32\...\MediaBuzzV1mode2726) (Version: 1.1 - Media Buzz) <==== ATTENTION
Media_Play_AIR+_1.1 (HKLM-x32\...\Media_Play_AIR+_1.1) (Version: 1.34.5.29 - enter) <==== ATTENTION
Meiern (HKLM-x32\...\ST6UNST #1) (Version:  - )
Menu Templates - Starter Kit (x32 Version: 9.4.6.0 - Nero AG) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Movie Templates - Starter Kit (x32 Version: 9.4.6.0 - Nero AG) Hidden
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 (HKLM-x32\...\{02993877-0006-40d9-b5c8-de73bfd4b37d}) (Version:  - Nero AG)
Nero Burning ROM Help (x32 Version: 9.4.17.100 - Nero AG) Hidden
Nero BurnRights (x32 Version: 3.4.11.100 - Nero AG) Hidden
Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero CoverDesigner (x32 Version: 4.4.9.100 - Nero AG) Hidden
Nero CoverDesigner Help (x32 Version: 4.4.9.100 - Nero AG) Hidden
Nero Disc Copy Gadget (x32 Version: 2.4.22.0 - Nero AG) Hidden
Nero Disc Copy Gadget Help (x32 Version: 2.4.22.0 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.12.100 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.11.100 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero Express Help (x32 Version: 9.4.17.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.11.100 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden
Nero Live (x32 Version: 1.4.48.0 - Nero AG) Hidden
Nero Live Help (x32 Version: 1.4.48.0 - Nero AG) Hidden
Nero PhotoSnap (x32 Version: 1.53.2.0 - Nero AG) Hidden
Nero PhotoSnap Help (x32 Version: 1.53.2.0 - Nero AG) Hidden
Nero Recode (x32 Version: 4.4.31.0 - Nero AG) Hidden
Nero Recode Help (x32 Version: 4.4.31.0 - Nero AG) Hidden
Nero Rescue Agent (x32 Version: 2.4.12.100 - Nero AG) Hidden
Nero RescueAgent Help (x32 Version: 2.4.4.100 - Nero AG) Hidden
Nero ShowTime (x32 Version: 5.4.0.100 - Nero AG) Hidden
Nero ShowTime (x32 Version: 5.4.14.100 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.12.100 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.12.100 - Nero AG) Hidden
Nero Vision (x32 Version: 6.4.10.205 - Nero AG) Hidden
Nero Vision Help (x32 Version: 6.4.8.100 - Nero AG) Hidden
Nero WaveEditor (x32 Version: 5.4.32.0 - Nero AG) Hidden
NeroBurningROM (x32 Version: 9.4.17.100 - Nero AG) Hidden
NeroExpress (x32 Version: 9.4.17.100 - Nero AG) Hidden
NeroLiveGadget (x32 Version: 1.2.16.100 - Nero AG) Hidden
NeroLiveGadget Help (x32 Version: 1.2.16.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.8.48.0 - Nokia)
Nokia Suite (x32 Version: 3.8.48.0 - Nokia) Hidden
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera Stable 22.0.1471.50 (HKLM-x32\...\Opera 22.0.1471.50) (Version: 22.0.1471.50 - Opera Software ASA)
Origin (HKLM-x32\...\Origin) (Version: 9.0.10.69 - Electronic Arts, Inc.)
OSA Kit Pro Player v4.0 1.0 (HKLM-x32\...\OSA Kit Pro Player) (Version: 1.0 - Maher F. Farag)
PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
pdfforge Toolbar v7.3 (HKLM-x32\...\{D0F1CFB6-090B-45B6-86B9-20C72CD9B261}) (Version: 7.3 - Spigot, Inc.) <==== ATTENTION
pgcchelper (HKCU\...\pgcchelper) (Version:  - )
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PlusSHD9.5v4 (HKLM-x32\...\PlusSHD9.5v4) (Version: 1.34.4.10 - HDSplus)
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.11 - ProtectDisc Software GmbH)
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
RealDownloader (x32 Version: 1.3.2 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.2 - RealNetworks)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6156 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
RTPatch Update (HKLM-x32\...\RTPatch_is1) (Version:  - PocketSoft)
Samsung Recovery Solution 4 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung Support Center (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.1.18 - Samsung)
Samsung Update Plus (HKLM-x32\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
Shockwave (HKLM-x32\...\Shockwave) (Version:  - )
Show-Password (HKLM-x32\...\5D1501F7-2DC8-BEE0-61A4-310079B9BA15) (Version:  - Show-Password-software) <==== ATTENTION
Sierra Utilities (HKLM-x32\...\Sierra Utilities) (Version:  - )
Sierra-Dienstprogramme (HKLM-x32\...\Sierra-Dienstprogramme) (Version:  - )
Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
SkypEmoticons (HKLM-x32\...\SkypEmoticons_is1) (Version:  - ) <==== ATTENTION
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SopCast 3.4.7 (HKLM-x32\...\SopCast) (Version: 3.4.7 - www.sopcast.com)
SoundTrax (x32 Version: 4.4.32.0 - Nero AG) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
SRS Premium Sound Control Panel (HKLM\...\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}) (Version: 1.8.7300 - SRS Labs, Inc.)
streamWriter (HKLM-x32\...\streamWriter_is1) (Version:  - )
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.22.0 - Synaptics Incorporated)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
VLC media player 2.0.7 (HKLM\...\VLC media player) (Version: 2.0.7 - VideoLAN)
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.5100 - Broadcom Corporation)
WinAce Archiver (HKLM-x32\...\WinAce Archiver) (Version: 2.69 - e-merge GmbH)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
Zip Motion Block Video codec (Remove Only) (HKLM-x32\...\ZMBV) (Version:  - DOSBox Team)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {000FBB24-423C-4258-9812-997BA41B4A6C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-76830181-1066914796-2057996457-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {008BFDDD-F653-449F-A295-DF9C5CEB2737} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-76830181-1066914796-2057996457-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {083989C6-BB97-44BF-B38F-D768AD8264CE} - System32\Tasks\{0C3494A2-2168-4C01-BE40-2E45C34F2F68} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {097AD253-753B-4F3F-8360-D7E58A032638} - \FTdownloader V4.0-updater No Task File <==== ATTENTION
Task: {0A265031-5DBB-4FBC-98D2-72F397E5C507} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-07-12] (Samsung Electronics. Co. Ltd.)
Task: {0CD42F13-E7D4-4583-B9D7-D19718A20BED} - System32\Tasks\{F05EA7C7-4B48-4B3E-A244-AB41A253EA50} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {16BC4C94-0DD9-4BA3-B791-60A42F6F8BB8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {22A490C3-90E9-4CF5-81AE-BE0D9AD41F4A} - System32\Tasks\Go for FilesUpdate => C:\Program Files (x86)\GoforFiles\GFFUpdater.exe <==== ATTENTION
Task: {23F71B8D-9561-4E78-AA13-9A79D61C9865} - \AmiUpdXp No Task File <==== ATTENTION
Task: {2B3F59A9-ED63-4165-ADBF-DED21D14A7EE} - System32\Tasks\Games\UpdateCheck_S-1-5-21-76830181-1066914796-2057996457-1000
Task: {361731F4-7081-4028-8825-4A7D0F923602} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {3B031D6F-3239-4953-9F11-3B2FA2ED10CE} - System32\Tasks\{657705BB-20E5-481B-BBD6-BE409E9019A9} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {3B76D6E2-5641-41C8-927B-AF5E0BB78EFC} - \DealPlyLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {3B8A85F1-0385-4D91-A2A6-E58D7F8B892D} - \Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2 No Task File <==== ATTENTION
Task: {3F4618EA-0462-4FF0-B3E4-A93693E8CFE7} - \144899d5-d17f-48f2-9759-c73aad165301-4 No Task File <==== ATTENTION
Task: {4186E796-589D-4723-9490-CEDF7C71AC00} - System32\Tasks\{868B76A8-1604-431B-ACB3-09B751F36517} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {41FE0453-421E-42FF-A01A-FB89E5FE28F4} - System32\Tasks\{985DE0F0-D498-4CB8-A1B2-E509911529C0} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {4AE47D1F-0AA4-41FC-A401-4C32DF25DE1F} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-08-05] (Samsung Electronics)
Task: {4DE1323B-B08D-4C41-AEAF-822C371C866E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {4F8B6533-566A-4424-BF7C-F06FDFD3A4E9} - System32\Tasks\Opera scheduled Autoupdate 1377950922 => C:\Program Files (x86)\Opera\launcher.exe [2014-05-27] (Opera Software)
Task: {55DB4EFA-F2AE-4829-8F5D-6386040DC015} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {5A4D13D3-705D-4042-81C8-6E0CBA21C730} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {5A6C79DD-8ACA-4274-BAA0-D62FA542975A} - System32\Tasks\Show-Password_wd => C:\Program Files (x86)\Show-Password-soft\Show-Passwordd.exe [2014-04-27] () <==== ATTENTION
Task: {5CC210B7-3A50-442C-809D-21A1290179A2} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {67F9468E-29DA-43F0-93B7-07C1886F8BFE} - System32\Tasks\{A7F52898-E540-4631-9BE8-E0A9F5B7DA8A} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {6A4D02F2-C63D-4F19-880C-289FE78BD508} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {6F55A953-3F22-44F1-AB5F-74CFEC963B9C} - System32\Tasks\{8432FC74-5CA1-4DF0-85D7-AA7921E57D19} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {70AD28FB-6A14-4312-A373-895F49C3E7F6} - \EPUpdater No Task File <==== ATTENTION
Task: {74109A32-0B08-4A0E-8C0B-6EA2F8E8B1C8} - System32\Tasks\{DA06645A-E904-45EE-B721-C75D59EA5DCC} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {7D7DF77F-76C9-4037-9E58-7EF28EFDF944} - System32\Tasks\{3F559BE1-83A6-43AF-BF69-3C1341D8BD3F} => E:\SETUP.NOW.EXE
Task: {7E6C67FB-2512-4CE7-BC4F-214908C9AA63} - System32\Tasks\{49A51809-1B26-4BB5-8B91-24F7C752DCF0} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {7EED7FB4-B7B6-4641-9A4C-BFB82D74301F} - System32\Tasks\{ACBC5723-4421-4502-A890-0383123C24C5} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {7FFD7BCF-9565-433F-91F8-4DE4B6FC20E1} - \BrowserDefendert No Task File <==== ATTENTION
Task: {81667E4A-99D5-4C70-9A11-9328E7463B0A} - \dab3e7f2-3183-49ea-9c57-b856ed7be1c1-4 No Task File <==== ATTENTION
Task: {81706C4A-3EEC-4BF9-8F0B-E4BB23FDA788} - \FTdownloader V4.0-codedownloader No Task File <==== ATTENTION
Task: {8F06D40B-14B6-4544-996E-C1E5F1D525BE} - System32\Tasks\{46363280-0C93-4162-BA84-C1800DE6E106} => C:\Users\Sebastian\D-Fend Reloaded\VirtualHD\KEEPER\DOS4GW.EXE [2011-03-25] ()
Task: {90D12D95-1F07-4A0C-B6A0-E1D6ABF18029} - \FF Watcher {CEEEE79E-5163-41C5-BB70-2ED25D849F40} No Task File <==== ATTENTION
Task: {94C9AE4E-6109-4A72-AE30-10D2DA46EC45} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {97010ECF-03B6-4179-B8D1-1723C4C66427} - \144899d5-d17f-48f2-9759-c73aad165301-5 No Task File <==== ATTENTION
Task: {9843C4FD-136A-4F01-8CA6-725655D6D434} - \dab3e7f2-3183-49ea-9c57-b856ed7be1c1-3 No Task File <==== ATTENTION
Task: {A466853E-3E7C-4072-9096-5AC7E6EF5AD3} - \144899d5-d17f-48f2-9759-c73aad165301-1 No Task File <==== ATTENTION
Task: {A5FD8137-7899-402C-AE57-F509D0C80F24} - System32\Tasks\{C41693B4-6238-4DF6-A5BF-477D5481953E} => E:\INSTALL.EXE [1996-07-24] ()
Task: {A9C51BDB-93F6-4DEA-9F42-54AEB32A3F1D} - \56069f09-0072-4e8d-acae-894052cbe8fd-5 No Task File <==== ATTENTION
Task: {A9D6893C-E422-4726-9AF9-213B028554D8} - System32\Tasks\{EB4AD1E4-C24F-459D-BE00-B37693AF8815} => C:\Users\Sebastian\D-Fend Reloaded\VirtualHD\KEEPER\DOS4GW.EXE [2011-03-25] ()
Task: {ACE0ED67-F396-42E5-9F0E-15CA294C307A} - \DealPlyLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {AD32453B-3F4E-41DF-A34D-BD1C0A70C56D} - System32\Tasks\{456230FE-9F87-4040-82B4-5E0405800C5A} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {B0B56F85-3012-47E7-AB0A-39A39337A70E} - \144899d5-d17f-48f2-9759-c73aad165301-3 No Task File <==== ATTENTION
Task: {B0D847BC-6886-4676-9D95-BC594A9E4736} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {B3059A2E-615E-4E21-B270-D01978483984} - System32\Tasks\advSRS4 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC)
Task: {B625C507-EDB9-4104-8CE9-F242D6DABD8A} - \FTdownloader V4.0-enabler No Task File <==== ATTENTION
Task: {B8C8E55D-3B26-47A8-A4D1-CBBF6FD47CC0} - System32\Tasks\{3504ED92-9C34-4043-A3C4-C595D87C4EAE} => E:\SETUP.EXE [1996-07-20] (Transpeed)
Task: {BDEB32E8-6C4A-475C-BAAE-F91B1476FB98} - \Show-Password Update No Task File <==== ATTENTION
Task: {BFF99860-4956-436A-83CB-C99FD9A1BDE4} - System32\Tasks\GoogleUpdateTaskMachineCore1cecb646eabf06 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {C496FFDE-63EE-418F-B346-0C1414B93704} - \144899d5-d17f-48f2-9759-c73aad165301-2 No Task File <==== ATTENTION
Task: {C89D5894-AA4B-4C8B-9369-9D5A48F570A7} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-76830181-1066914796-2057996457-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {C94BA303-5A76-45FE-A089-C762FF3BCA5E} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
Task: {D3FA1EB9-41FE-4666-9630-D22301870DDF} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2010-07-30] (SAMSUNG Electronics)
Task: {D45A97AD-D2B1-4489-B0A1-279321653444} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {E3F03C90-5DAB-4F45-99CC-CDB97F8B8576} - \6c0e75e6-f53f-4d19-b513-977d38468083-4 No Task File <==== ATTENTION
Task: {E629E160-85A9-42B3-8B03-FD7520B247D8} - System32\Tasks\AdobeFlashPlayerUpdate => C:\windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {E89E6DF4-976D-42F4-A52C-561D7131468B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {E95DE261-32A7-4966-BADB-0EABFF128AFF} - \4c67f1a3-05c6-4d3a-b075-815a13101fc2-5 No Task File <==== ATTENTION
Task: {EB2D0D37-3214-4721-B21C-DCF04D14968A} - System32\Tasks\{3AEA7388-306B-4BBC-8D4F-23DEA40980D5} => C:\Users\Sebastian\D-Fend Reloaded\VirtualHD\KEEPER\DOS4GW.EXE [2011-03-25] ()
Task: {ECD9C209-F434-421B-8449-B9984E498D22} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-22] (Adobe Systems Incorporated)
Task: {F6F84538-9AA1-4B79-B380-8E7C245A2D3C} - \Desk 365 RunAsStdUser No Task File <==== ATTENTION
Task: {FD1B3EBA-EFC8-4124-9EAD-5EEA92AA4577} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-76830181-1066914796-2057996457-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {FE2CEFC2-35E0-48D8-BAB4-EFA59A7DDEFA} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {FE9EA747-FF82-4B0B-85EB-A086087EF43A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore1cecb646eabf06.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-76830181-1066914796-2057996457-1000.job => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe
Task: C:\windows\Tasks\Show-Password_wd.job => C:\Program Files (x86)\Show-Password-soft\Show-Passwordd.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-07-12 18:15 - 2011-07-12 18:15 - 00018432 _____ () C:\Users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTimeUpdater.exe
2013-04-16 03:07 - 2013-04-16 03:07 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2010-08-17 05:05 - 2009-07-07 20:23 - 00247152 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2014-04-27 11:44 - 2014-04-27 11:44 - 00077312 _____ () C:\Program Files (x86)\Show-Password-soft\Show-Passwordd.exe
2011-01-21 17:58 - 2010-03-15 12:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2014-01-10 07:26 - 2014-01-10 07:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-04-27 11:44 - 2014-04-27 11:44 - 00143872 _____ () C:\Program Files (x86)\Show-Password-soft\Show-Passwordnm161.exe
2013-08-31 07:47 - 2013-08-31 07:47 - 03233806 _____ () C:\Program Files (x86)\Tor\tor.exe
2014-06-14 07:46 - 2014-05-14 14:38 - 00059904 _____ () C:\Program Files (x86)\WinUpd\WinUpd.exe
2009-02-12 07:32 - 2009-02-12 07:32 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-07-06 14:26 - 2010-07-06 14:26 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-01-10 07:28 - 2014-01-10 07:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-03-11 22:41 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-03-11 22:41 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2010-08-17 05:10 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2014-04-27 11:44 - 2014-04-27 11:44 - 00133120 _____ () C:\Program Files (x86)\Show-Password-soft\Show-Passwordnm161.dll
2014-03-11 22:41 - 2013-05-16 11:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2009-06-03 13:59 - 2009-06-03 13:59 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-06-03 13:59 - 2009-06-03 13:59 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-01-30 16:38 - 2014-06-28 11:24 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2014-06-03 17:41 - 2014-06-03 17:37 - 00877176 _____ () C:\Program Files (x86)\Opera\22.0.1471.50\libglesv2.dll
2014-06-03 17:41 - 2014-06-03 17:37 - 00135800 _____ () C:\Program Files (x86)\Opera\22.0.1471.50\libegl.dll
2014-06-03 17:41 - 2014-06-03 17:37 - 00957048 _____ () C:\Program Files (x86)\Opera\22.0.1471.50\ffmpegsumo.dll
2014-05-14 15:49 - 2014-05-14 15:49 - 16361136 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Sebastian:zylomtest
AlternateDataStreams: C:\Users\Sebastian:zylomtr{000HQ7FF-AD7A-3FG3-VK8A-25GG67KOIVUV}
AlternateDataStreams: C:\ProgramData\Temp:0F4A7B6A
AlternateDataStreams: C:\ProgramData\Temp:2430E4FC
AlternateDataStreams: C:\ProgramData\Temp:264B2CC4
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
AlternateDataStreams: C:\ProgramData\Temp:5C270C64
AlternateDataStreams: C:\ProgramData\Temp:6FB93194
AlternateDataStreams: C:\ProgramData\Temp:8530A643
AlternateDataStreams: C:\ProgramData\Temp:8AD1F2E0
AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
AlternateDataStreams: C:\ProgramData\Temp:EB42AC3C
AlternateDataStreams: C:\Users\Sebastian\Downloads:Shareaza.GUID

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\Services: wuauserv => 2
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============

Name: Microsoft-ISATAP-Adapter
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-ISATAP-Adapter #5
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/30/2014 03:26:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Name des fehlerhaften Moduls: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000000000001370e
ID des fehlerhaften Prozesses: 0x5c0
Startzeit der fehlerhaften Anwendung: 0xavshadow.exe0
Pfad der fehlerhaften Anwendung: avshadow.exe1
Pfad des fehlerhaften Moduls: avshadow.exe2
Berichtskennung: avshadow.exe3

Error: (06/29/2014 08:12:53 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm opera.exe, Version 22.0.1471.50 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1350

Startzeit: 01cf93c43e796fc8

Endzeit: 7

Anwendungspfad: C:\Program Files (x86)\Opera\22.0.1471.50\opera.exe

Berichts-ID: faaa5d5b-ffb8-11e3-b800-001bb16640c8

Error: (06/29/2014 07:25:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Name des fehlerhaften Moduls: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Ausnahmecode: 0xc000041d
Fehleroffset: 0x00642534
ID des fehlerhaften Prozesses: 0x1294
Startzeit der fehlerhaften Anwendung: 0xopera.exe0
Pfad der fehlerhaften Anwendung: opera.exe1
Pfad des fehlerhaften Moduls: opera.exe2
Berichtskennung: opera.exe3

Error: (06/29/2014 07:24:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Name des fehlerhaften Moduls: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00642534
ID des fehlerhaften Prozesses: 0x1294
Startzeit der fehlerhaften Anwendung: 0xopera.exe0
Pfad der fehlerhaften Anwendung: opera.exe1
Pfad des fehlerhaften Moduls: opera.exe2
Berichtskennung: opera.exe3

Error: (06/27/2014 06:35:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Name des fehlerhaften Moduls: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Ausnahmecode: 0xc000041d
Fehleroffset: 0x00642534
ID des fehlerhaften Prozesses: 0x10e0
Startzeit der fehlerhaften Anwendung: 0xopera.exe0
Pfad der fehlerhaften Anwendung: opera.exe1
Pfad des fehlerhaften Moduls: opera.exe2
Berichtskennung: opera.exe3

Error: (06/27/2014 06:34:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Name des fehlerhaften Moduls: opera.exe, Version: 22.0.1471.50, Zeitstempel: 0x53845c2c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00642534
ID des fehlerhaften Prozesses: 0x10e0
Startzeit der fehlerhaften Anwendung: 0xopera.exe0
Pfad der fehlerhaften Anwendung: opera.exe1
Pfad des fehlerhaften Moduls: opera.exe2
Berichtskennung: opera.exe3

Error: (06/24/2014 05:11:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Name des fehlerhaften Moduls: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000000000001370e
ID des fehlerhaften Prozesses: 0x58c
Startzeit der fehlerhaften Anwendung: 0xavshadow.exe0
Pfad der fehlerhaften Anwendung: avshadow.exe1
Pfad des fehlerhaften Moduls: avshadow.exe2
Berichtskennung: avshadow.exe3

Error: (06/24/2014 04:54:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Name des fehlerhaften Moduls: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000000000001370e
ID des fehlerhaften Prozesses: 0x4d4
Startzeit der fehlerhaften Anwendung: 0xavshadow.exe0
Pfad der fehlerhaften Anwendung: avshadow.exe1
Pfad des fehlerhaften Moduls: avshadow.exe2
Berichtskennung: avshadow.exe3

Error: (06/24/2014 04:28:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Name des fehlerhaften Moduls: avshadow.exe, Version: 14.0.4.642, Zeitstempel: 0x536c9660
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000000000001370e
ID des fehlerhaften Prozesses: 0x5b8
Startzeit der fehlerhaften Anwendung: 0xavshadow.exe0
Pfad der fehlerhaften Anwendung: avshadow.exe1
Pfad des fehlerhaften Moduls: avshadow.exe2
Berichtskennung: avshadow.exe3

Error: (06/22/2014 05:21:31 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm fifa13.exe, Version 1.1.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1204

Startzeit: 01cf8e2d5ae59534

Endzeit: 45

Anwendungspfad: C:\Program Files (x86)\Origin Games\FIFA 13\Game\fifa13.exe

Berichts-ID:


System errors:
=============
Error: (06/30/2014 07:26:07 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (06/30/2014 07:26:07 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (06/30/2014 07:25:30 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "WinUpd" wurde nicht richtig gestartet.

Error: (06/30/2014 07:23:11 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.

Error: (06/30/2014 07:23:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (06/30/2014 07:23:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (06/30/2014 07:22:41 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (06/30/2014 07:22:37 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (06/30/2014 07:22:36 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (06/30/2014 03:50:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891


Microsoft Office Sessions:
=========================
Error: (06/30/2014 03:26:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: avshadow.exe14.0.4.642536c9660avshadow.exe14.0.4.642536c9660c0000409000000000001370e5c001cf9466d81d6e2dC:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe1ecc8e76-005a-11e4-a314-827c6b745308

Error: (06/29/2014 08:12:53 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: opera.exe22.0.1471.50135001cf93c43e796fc87C:\Program Files (x86)\Opera\22.0.1471.50\opera.exefaaa5d5b-ffb8-11e3-b800-001bb16640c8

Error: (06/29/2014 07:25:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: opera.exe22.0.1471.5053845c2copera.exe22.0.1471.5053845c2cc000041d00642534129401cf93be87b9ec48C:\Program Files (x86)\Opera\22.0.1471.50\opera.exeC:\Program Files (x86)\Opera\22.0.1471.50\opera.exe4fd621f9-ffb2-11e3-b654-001bb16640c8

Error: (06/29/2014 07:24:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: opera.exe22.0.1471.5053845c2copera.exe22.0.1471.5053845c2cc000000500642534129401cf93be87b9ec48C:\Program Files (x86)\Opera\22.0.1471.50\opera.exeC:\Program Files (x86)\Opera\22.0.1471.50\opera.exe418ed554-ffb2-11e3-b654-001bb16640c8

Error: (06/27/2014 06:35:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: opera.exe22.0.1471.5053845c2copera.exe22.0.1471.5053845c2cc000041d0064253410e001cf92239d819702C:\Program Files (x86)\Opera\22.0.1471.50\opera.exeC:\Program Files (x86)\Opera\22.0.1471.50\opera.exefd597439-fe18-11e3-9412-001bb16640c8

Error: (06/27/2014 06:34:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: opera.exe22.0.1471.5053845c2copera.exe22.0.1471.5053845c2cc00000050064253410e001cf92239d819702C:\Program Files (x86)\Opera\22.0.1471.50\opera.exeC:\Program Files (x86)\Opera\22.0.1471.50\opera.exef79bf2d4-fe18-11e3-9412-001bb16640c8

Error: (06/24/2014 05:11:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: avshadow.exe14.0.4.642536c9660avshadow.exe14.0.4.642536c9660c0000409000000000001370e58c01cf8fbe7f0d0047C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exec5c344b1-fbb1-11e3-a0a9-afdadf43bb17

Error: (06/24/2014 04:54:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: avshadow.exe14.0.4.642536c9660avshadow.exe14.0.4.642536c9660c0000409000000000001370e4d401cf8fbc35156d43C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe7bc9504d-fbaf-11e3-9c0c-e86f8e581717

Error: (06/24/2014 04:28:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: avshadow.exe14.0.4.642536c9660avshadow.exe14.0.4.642536c9660c0000409000000000001370e5b801cf8fb88fc9a13cC:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exed692f0a8-fbab-11e3-a000-86e9f0273b17

Error: (06/22/2014 05:21:31 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: fifa13.exe1.1.0.0120401cf8e2d5ae5953445C:\Program Files (x86)\Origin Games\FIFA 13\Game\fifa13.exe


CodeIntegrity Errors:
===================================
  Date: 2013-04-28 00:49:58.738
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\SEBAST~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-28 00:49:58.582
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\SEBAST~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-28 00:49:58.395
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Sebastian\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-28 00:49:58.255
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\Sebastian\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 52%
Total physical RAM: 3946.16 MB
Available physical RAM: 1855.88 MB
Total Pagefile: 7890.51 MB
Available Pagefile: 4715.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:231 GB) (Free:73.95 GB) NTFS
Drive d: () (Fixed) (Total:345.07 GB) (Free:58.87 GB) NTFS
Drive e: (SPI_046_01) (CDROM) (Total:0.37 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596 GB) (Disk ID: 94F74182)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=345 GB) - (Type=OF Extended)

==================== End Of Log ============================
         

Hi,

ZeroAccess:
C:\Windows\Installer\{3137ec37-8634-c619-3470-34d1b8cd37bc}
C:\Windows\Installer\{3137ec37-8634-c619-3470-34d1b8cd37bc}\@

ZeroAccess:
C:\Users\Sebastian\AppData\Local\{3137ec37-8634-c619-3470-34d1b8cd37bc}
C:\Users\Sebastian\AppData\Local\{3137ec37-8634-c619-3470-34d1b8cd37bc}\@
         

Du hast ZeroAccess auf der Platte. Keine sensiblen Logins mehr von diesem PC bis zum >clean<. Wenn Du online-Banking, paypal etc. mit diesem PC gemacht hast, dann würde ich die Passwörter von einem anderen (sauberen) PC, Handy ändern.

Solltest Du Combofix oder die anderen Tools nicht runterladen können, dann bitte via USB-Stick von einem anderen PC auf den Desktop des infizierten PCs transferieren.

Schritt 1

Bitte deinstalliere folgende Programme:

Media Buzz
Media_Play_AIR+_1.1
pdfforge Toolbar v7.3
Show-Password
SkypEmoticons
Updater
Feature Update Service
Java(TM) 6 Update 15
Java(TM) 6 Update 20
Java(TM) 6 Update 22
Java(TM) 6 Update 27
Java(TM) 6 Update 29


Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop.

• Starte die Revouninstaller.exe
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
  Klicke jedesmal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Schritt 2
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Log:

Combofix Logfile:

ComboFix 14-06-30.01 - Sebastian 01.07.2014  17:07:35.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3946.2661 [GMT 2:00]
ausgeführt von:: c:\users\Sebastian\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\MediaBuzzV1
c:\users\Sebastian\Wolfenstein 3D (Full Version).exe
c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut11_C03C290FA6F54A2B8A2DFE2786A1E275.exe
c:\windows\IsUn0407.exe
c:\windows\SysWow64\Oleaut32.1
c:\windows\SysWow64\Oleaut32.2
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ACEDRV11
-------\Service_acedrv11
-------\Service_WinUpd
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-01 bis 2014-07-01  ))))))))))))))))))))))))))))))
.
.
2014-07-01 15:20 . 2014-07-01 15:20	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-30 19:10 . 2014-06-30 19:15	--------	d-----w-	C:\FRST
2014-06-29 14:29 . 2014-06-29 14:29	--------	d-----w-	c:\programdata\Wideblue installer
2014-06-29 14:27 . 2014-06-29 14:27	--------	d-----w-	c:\program files\Level Quality Watcher
2014-06-29 12:34 . 2014-06-29 12:34	--------	d-----w-	c:\program files\Enigma Software Group
2014-06-29 12:33 . 2014-06-29 14:35	--------	d-----w-	c:\windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-06-29 12:14 . 2014-06-29 12:14	--------	d-----w-	c:\users\Sebastian\AppData\Roaming\TestApp
2014-06-29 12:14 . 2014-06-29 12:14	--------	d-----w-	c:\programdata\PC Tools
2014-06-27 21:28 . 2014-06-27 21:29	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-27 21:28 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-06-27 21:28 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-06-27 21:28 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-06-27 21:28 . 2014-06-27 21:28	--------	d-----w-	c:\users\Sebastian\ Malwarebytes Anti-Malware 
2014-06-14 05:46 . 2014-06-14 05:50	--------	d-----w-	c:\users\Sebastian\AppData\Local\DownBooster
2014-06-14 05:46 . 2014-06-14 05:50	--------	d-----w-	c:\program files (x86)\WinUpd
2014-06-13 13:41 . 1999-11-10 09:05	86016	----a-w-	c:\windows\unvise32qt.exe
2014-06-13 13:41 . 2014-06-13 13:41	90112	----a-w-	c:\program files\Internet Explorer\plugins\npqtplugin5.dll
2014-06-13 13:41 . 2014-06-13 13:41	90112	----a-w-	c:\program files\Internet Explorer\plugins\npqtplugin4.dll
2014-06-13 13:41 . 2014-06-13 13:41	90112	----a-w-	c:\program files\Internet Explorer\plugins\npqtplugin3.dll
2014-06-13 13:41 . 2014-06-13 13:41	90112	----a-w-	c:\program files\Internet Explorer\plugins\npqtplugin2.dll
2014-06-13 13:41 . 2014-06-13 13:41	90112	----a-w-	c:\program files\Internet Explorer\plugins\npqtplugin.dll
2014-06-13 13:41 . 2014-06-13 13:41	--------	d-----w-	c:\programdata\QuickTime
2014-06-13 13:41 . 2014-06-13 13:41	--------	d-----w-	c:\windows\SysWow64\QuickTime
2014-06-13 13:41 . 2014-06-13 13:41	--------	d-----w-	c:\program files (x86)\QuickTime
2014-06-10 18:36 . 2014-06-10 18:36	--------	d-sh--w-	c:\users\Sebastian\AppData\Local\EmieUserList
2014-06-10 18:36 . 2014-06-10 18:36	--------	d-sh--w-	c:\users\Sebastian\AppData\Local\EmieSiteList
2014-06-08 14:43 . 2014-06-08 14:43	--------	d-----w-	c:\users\Sebastian\AppData\Local\PDF24
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-01 13:27 . 2013-04-03 13:35	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-06-13 13:22 . 2011-01-16 11:01	95414520	----a-w-	c:\windows\system32\MRT.exe
2014-05-27 13:42 . 2013-04-03 13:35	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-05-22 17:45 . 2012-04-02 16:48	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-22 17:45 . 2011-05-20 16:36	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-22 16:10 . 2014-05-26 18:38	61112	----a-w-	c:\windows\system32\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64.sys
2014-05-16 07:53 . 2014-05-16 07:53	341848	----a-w-	c:\windows\SysWow64\DivXControlPanelApplet.cpl
2014-05-09 06:14 . 2014-05-14 13:40	477184	----a-w-	c:\windows\system32\aepdu.dll
2014-05-09 06:11 . 2014-05-14 13:40	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-04-24 10:19 . 2014-04-25 13:45	61112	----a-w-	c:\windows\system32\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}w64.sys
2014-04-12 02:22 . 2014-05-14 13:39	95680	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:22 . 2014-05-14 13:39	155072	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:19 . 2014-05-14 13:39	29184	----a-w-	c:\windows\system32\sspisrv.dll
2014-04-12 02:19 . 2014-05-14 13:39	136192	----a-w-	c:\windows\system32\sspicli.dll
2014-04-12 02:19 . 2014-05-14 13:39	28160	----a-w-	c:\windows\system32\secur32.dll
2014-04-12 02:19 . 2014-05-14 13:39	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-04-12 02:19 . 2014-05-14 13:39	31232	----a-w-	c:\windows\system32\lsass.exe
2014-04-12 02:12 . 2014-05-14 13:39	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-04-12 02:10 . 2014-05-14 13:39	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2013-01-19 07:44 . 2013-01-19 07:44	2174976	----a-w-	c:\program files (x86)\Common Files\atimpenc.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22	12240	----a-w-	c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4704207-C86B-4811-951E-6F322F9CEDE7}]
2011-07-12 16:16	270336	----a-w-	c:\users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTime.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-02-13 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-11-15 14:21	220632	----a-w-	c:\users\Sebastian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-11-15 14:21	220632	----a-w-	c:\users\Sebastian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-11-15 14:21	220632	----a-w-	c:\users\Sebastian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-11-10 3514176]
"ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2012-10-24 5435744]
"Spybot-S&D Cleaning"="c:\program files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" [2013-09-20 3666224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-07-01 750160]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2014-05-28 455512]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2013-06-22 295512]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-02-13 1758160]
"Aimersoft Helper Compact.exe"="c:\program files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe" [2012-02-20 1666560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2014-01-10 1861968]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-4-29 1127712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 tor;Tor Win32 Service;c:\program files (x86)\Tor\tor.exe;c:\program files (x86)\Tor\tor.exe [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 {552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64;{552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64;c:\windows\system32\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64.sys;c:\windows\SYSNATIVE\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}Gw64.sys [x]
S1 {552199fb-9890-4055-9aaf-b2f6d51d46e9}w64;{552199fb-9890-4055-9aaf-b2f6d51d46e9}w64;c:\windows\system32\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}w64.sys;c:\windows\SYSNATIVE\drivers\{552199fb-9890-4055-9aaf-b2f6d51d46e9}w64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 QuickTimeUpdater;QuickTime Updater;c:\users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTimeUpdater.exe;c:\users\Sebastian\AppData\LocalLow\QuickTime\IE\QuickTimeUpdater.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-18 17:45]
.
2012-05-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-76830181-1066914796-2057996457-1000.job
- c:\program files (x86)\Real\RealUpgrade\realupgrade.exe [2013-04-16 10:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22	13776	----a-w-	c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll" [2014-02-13 13776]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-11-15 14:21	244696	----a-w-	c:\users\Sebastian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-11-15 14:21	244696	----a-w-	c:\users\Sebastian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-11-15 14:21	244696	----a-w-	c:\users\Sebastian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-14 11046504]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://websearch.fastsearchings.info/?pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
uDefault_Search_URL = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://websearch.fastsearchings.info/?pid=1249&r=2014/06/29&hid=6740810968012150956&lg=EN&cc=DE&unqvl=56
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
mSearchAssistant = 
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: ????3?? - c:\users\Sebastian\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Sebastian\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} -
TCP: Interfaces\{9B334387-B32E-40AA-A8DA-FFAAFCCB3AE5}: NameServer = 192.168.198.10
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-Run-SearchProtect - \SearchProtect\bin\cltmng.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut11_C03C290FA6F54A2B8A2DFE2786A1E275.exe /f=srs_premium_sound_noext_nogame.zip /h
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Frieven_s_Prox_1.8 - c:\program files (x86)\Frieven_s_Prox_1.8\Uninstall.exe
AddRemove-Shockwave - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-{AE54C622-BDD1-CEE6-A996-E000A3273001} - c:\progra~3\INSTAL~1\{460C5~1\Setup.exe
AddRemove-{BD2E61BC-A249-28F3-FD0A-11E8E35E50B6} - c:\progra~3\INSTAL~1\{AC4AE~1\Setup.exe
AddRemove-pgcchelper - c:\users\Sebastian\AppData\Local\pgcchelper\pgcchelper_uninstaller.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-76830181-1066914796-2057996457-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f�3*N}�]
@="c:\\Users\\Sebastian\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-76830181-1066914796-2057996457-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f�3*N}�hQè�þ”¥c]
@="c:\\Users\\Sebastian\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_USERS\S-1-5-21-76830181-1066914796-2057996457-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-76830181-1066914796-2057996457-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
c:\program files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
c:\program files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
c:\program files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
c:\windows\SysWOW64\DllHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-07-01  17:37:43 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-07-01 15:37
.
Vor Suchlauf: 17 Verzeichnis(se), 79.671.812.096 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 79.450.775.552 Bytes frei
.
- - End Of File - - F93C9857AF774888A04E7220E9DB4E0A
         

--- --- ---






Nach dem Neustart startete Avira nicht automatisch, aber es ains alle Probleme behoben.

DANKE

Wir sind noch nicht fertig...

Schritt 1
Scan mit Malwarebytes Antimalware
Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
Poste mir den Inhalt der Logdatei. Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 2
Downloade Dir HitmanProauf Deinen Desktop:

HitmanPro - 32 Bit
HitmanPro - 64 Bit

• Starte die HitmanPro.exe
• Klicke auf
  
• Entferne den Haken bei
  
• Klicke auf
  und
• Akzeptiere die Lizenzbedingungen und klicke auf
• Klicke auf
  
  und auf
• Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
  und speichere die Logdatei auf Deinem Desktop.
• Schließe HitmanPro und poste mir das Log.

Schritt 3



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.