Wind 7 Ultim. Malwarebeytes hat einen Trojaner Agent gefunden.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 28.09.2014
Suchlauf-Zeit: 04:16:41
Logdatei: Walwarebytes.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.28.02
Rootkit Datenbank: v2014.09.19.01
Lizenz: Premium
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Kewin

Malwarebytes-->

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 299092
Verstrichene Zeit: 20 Min, 36 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 2
PUP.Optional.OpenCandy, C:\Users\Kewin\Downloads\DTLite4491-0356.exe, In Quarantäne, [61a19a5999e264d2bffd23124fb69769], 
Trojan.Agent, C:\Windows\Resources\Themes\explorer.exe, In Quarantäne, [748efff40a7163d301b149fc31d33dc3], 

Physische Sektoren: 0
(No malicious items detected)


(end)
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-09-2014
Ran by Kewin at 2014-09-30 09:24:11
Running from C:\Users\Kewin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe After Effects CC 2014 (HKLM-x32\...\{2B22C750-5C3B-4738-B621-BA786AC7A494}) (Version: 13.0.2 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.7.1.418 - Adobe Systems Incorporated)
Adobe Dreamweaver CC 2014 (HKLM-x32\...\{766255CE-D156-11E3-8DBC-A136EB52ACCF}) (Version: 14.0.0 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Professional CC 2014 (HKLM-x32\...\{AA704223-E11C-11E3-8A38-C09A633B72AF}) (Version: 14.0.1 - Adobe Systems Incorporated)
Adobe Illustrator CC 2014 (HKLM-x32\...\{2B4B4082-8043-4646-8334-B0A29E641211}) (Version: 18.0 - Adobe Systems Incorporated)
Adobe InDesign CC 2014 (HKLM-x32\...\{CCDCB9C4-72BA-1014-A3F8-D123F2F18BC2}) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.4.3 - Adobe Systems, Incorporated)
Adobe® Content Viewer (x32 Version: 3.4.3 - Adobe Systems, Incorporated) Hidden
Avira (HKLM-x32\...\{149bb302-ebda-47ae-b3e6-297cf4c356dc}) (Version: 1.1.21.40000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.40000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Intel(R) Chipset Device Software (Version: 10.0.14 - Intel Corporation) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Network Connections 19.3.141.0 (HKLM\...\PROSetDX) (Version: 19.3.141.0 - Intel)
Intel(R) Network Connections 19.3.141.0 (Version: 19.3.141.0 - Intel) Hidden
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2725 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.14 - Intel(R) Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.00 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.00 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 311.00 (Version: 311.00 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.77.1126.2013 - Realtek)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VPN Manager 1.6.69.0 (HKLM-x32\...\VPN Manager) (Version: 1.6.69.0 - Perfect-Privacy)
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-09-2014 14:57:30 Geplanter Prüfpunkt
27-09-2014 00:36:48 TrueCrypt installation
27-09-2014 00:37:34 Gerätetreiber-Paketinstallation: TAP-Win32 Provider Netzwerkadapter
28-09-2014 00:20:22 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
28-09-2014 00:29:39 Gerätetreiber-Paketinstallation: TAP-Windows Provider V9 Netzwerkadapter

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-22 09:24 - 00001254 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1                   activate.adobe.com
127.0.0.1                   practivate.adobe.com
127.0.0.1                   na1r.services.adobe.com
127.0.0.1                   hlrcv.stage.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com 
127.0.0.1 lm.licenses.adobe.com 
127.0.0.1 na1r.services.adobe.com 
127.0.0.1 hlrcv.stage.adobe.com 
127.0.0.1 practivate.adobe.com 
127.0.0.1 activate.adobe.com 


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {173066D6-DDC3-4880-BAEA-5A6225A7E43D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-21] (Google Inc.)
Task: {292C2148-9043-4E0E-B9B9-E2C4D6BA85D1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-21] (Google Inc.)
Task: {7C0ED110-C7F5-4C71-A5BE-30F06E766203} - System32\Tasks\DriverNavigator Scheduled Scan => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: {97492F3D-8025-42A7-9538-2CB8A99B27D9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-25] (Adobe Systems Incorporated)
Task: {AA2A9D86-7DA3-46D8-B889-7ADFA687E8BF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {F3688D14-7EEA-4A27-B1AA-8859F8C7CA9A} - System32\Tasks\AdobeAAMUpdater-1.0-Kewin-PC-Kewin => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DriverNavigator Scheduled Scan.job => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-08-15 19:33 - 2013-01-10 23:36 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-07-16 11:06 - 2014-07-16 11:06 - 00672416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2014-08-15 19:32 - 2012-04-09 08:54 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-30 09:20 - 2014-09-30 09:20 - 00050477 _____ () C:\Users\Kewin\Downloads\Defogger.exe
2014-09-17 13:31 - 2014-09-17 13:31 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-09-28 04:19 - 2014-09-17 13:31 - 00052472 ____N () C:\Users\Kewin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-09-17 13:30 - 2014-09-17 13:30 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-09-28 23:29 - 2012-12-10 07:28 - 00057432 _____ () Z:\cleanranda_v2\bin\zlib.dll
2014-09-28 23:29 - 2012-12-10 07:27 - 00036961 _____ () Z:\cleanranda_v2\bin\Plugins\dbx_mmap.dll
2014-09-28 23:29 - 2012-12-12 14:43 - 00322048 _____ () Z:\cleanranda_v2\bin\Plugins\facebook.dll
2014-09-28 23:29 - 2012-12-10 07:27 - 00339550 _____ () Z:\cleanranda_v2\bin\Plugins\icq.dll
2014-09-28 23:29 - 2012-12-10 07:26 - 00379993 _____ () Z:\cleanranda_v2\bin\Plugins\irc.dll
2014-09-28 23:29 - 2012-01-12 09:46 - 00082021 _____ () Z:\cleanranda_v2\bin\Plugins\keepstatus.dll
2014-09-28 23:29 - 2012-01-12 09:46 - 00671232 _____ () Z:\cleanranda_v2\bin\Plugins\mirotr.dll
2014-09-28 23:29 - 2012-01-12 09:46 - 00099328 _____ () Z:\cleanranda_v2\bin\Plugins\updater.dll
2014-09-25 15:06 - 2014-09-23 06:06 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libglesv2.dll
2014-09-25 15:06 - 2014-09-23 06:06 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libegl.dll
2014-09-25 15:06 - 2014-09-23 06:07 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll
2014-09-25 15:06 - 2014-09-23 06:07 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll
2014-09-25 15:06 - 2014-09-23 06:06 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ffmpegsumo.dll
2014-09-25 15:06 - 2014-09-23 06:07 - 14891848 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-368666148-3114612420-1351031977-500 - Administrator - Disabled)
Gast (S-1-5-21-368666148-3114612420-1351031977-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-368666148-3114612420-1351031977-1002 - Limited - Enabled)
Kewin (S-1-5-21-368666148-3114612420-1351031977-1000 - Administrator - Enabled) => C:\Users\Kewin

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Intel(R) 7 Series/C216 Chipset Family USB 3.0 eXtensible Host Controller Installation Disk - 1E31
Description: Intel(R) 7 Series/C216 Chipset Family USB 3.0 eXtensible Host Controller Installation Disk - 1E31
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Netzwerkcontroller
Description: Netzwerkcontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI-Kommunikationscontroller (einfach)
Description: PCI-Kommunikationscontroller (einfach)
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/30/2014 09:16:08 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={5BE50A87-6701-434E-B3B8-D1F87FF620E7}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:16:02 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={23CB2C49-8838-453B-881D-3162BA76B1DD}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:15:55 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={54268845-3045-4E06-8283-5361CB2FC450}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:15:36 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={D27616F9-F1DB-4BEA-9CF3-DA23BA86FFF1}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:15:30 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={2412FAD8-18CE-47C4-B369-AB99E4D73FD2}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:15:23 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={28C02678-733E-4184-A81E-7C6CBC379041}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:15:04 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={197D72C0-D817-4F80-9D39-D465488182D8}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:14:46 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={2AFA1F61-E641-474A-84C9-1D2F1BC04030}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.

Error: (09/30/2014 09:14:39 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={583B786D-C5B7-4CFC-B80C-EFBB9784403A}: Der Benutzer "Kewin-PC\Kewin" hat eine Verbindung mit dem Namen "Perfect Privacy VPN" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 13843.


System errors:
=============
Error: (09/30/2014 09:17:35 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{09392B9A-FEBB-45C2-8AEC-BBA1BC12FCC9} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.


Microsoft Office Sessions:
=========================
Error: (09/30/2014 09:16:08 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {5BE50A87-6701-434E-B3B8-D1F87FF620E7}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:16:02 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {23CB2C49-8838-453B-881D-3162BA76B1DD}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:15:55 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {54268845-3045-4E06-8283-5361CB2FC450}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:15:36 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {D27616F9-F1DB-4BEA-9CF3-DA23BA86FFF1}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:15:30 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {2412FAD8-18CE-47C4-B369-AB99E4D73FD2}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:15:23 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {28C02678-733E-4184-A81E-7C6CBC379041}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:15:04 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {197D72C0-D817-4F80-9D39-D465488182D8}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:14:46 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {2AFA1F61-E641-474A-84C9-1D2F1BC04030}Kewin-PC\KewinPerfect Privacy VPN13843

Error: (09/30/2014 09:14:39 AM) (Source: RasClient) (EventID: 20227) (User: )
Description: {583B786D-C5B7-4CFC-B80C-EFBB9784403A}Kewin-PC\KewinPerfect Privacy VPN13843


CodeIntegrity Errors:
===================================
  Date: 2014-09-28 22:44:55.843
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-28 22:44:55.750
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-28 16:47:32.923
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-28 16:47:32.895
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-28 03:30:51.928
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-28 03:30:51.881
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-27 02:38:02.268
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-27 02:38:02.227
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 24%
Total physical RAM: 7888.75 MB
Available physical RAM: 5944.45 MB
Total Pagefile: 15775.68 MB
Available Pagefile: 13628.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Nur Windows) (Fixed) (Total:97.66 GB) (Free:44.88 GB) NTFS
Drive d: (Spiele) (Fixed) (Total:97.66 GB) (Free:67.87 GB) NTFS
Drive e: (Musik,Filme etc.) (Fixed) (Total:102.68 GB) (Free:101.27 GB) NTFS
Drive z: () (Fixed) (Total:4.99 GB) (Free:4.87 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 88BBF202)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=102.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-09-2014
Ran by Kewin (administrator) on KEWIN-PC on 30-09-2014 09:23:30
Running from C:\Users\Kewin\Downloads
Loaded Profile: Kewin (Available profiles: Kewin)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-

recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(TrueCrypt Foundation) C:\Program Files\TrueCrypt\TrueCrypt.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Perfect Privacy) C:\Program Files (x86)\Perfect Privacy VPN Manager\VPNManagerService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Perfect Privacy) C:\Program Files (x86)\Perfect Privacy VPN Manager\VPNManager.exe
( ) Z:\cleanranda_v2\bin\cleanranda.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Users\Kewin\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be 

moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] 

(NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe 

[558496 2014-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe 

[2694040 2014-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2012-08-21] (AVM Berlin)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe 

Systems Incorporated)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-09-17] (Avira 

Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-15] (Avira Operations 

GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-368666148-3114612420-1351031977-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-368666148-3114612420-1351031977-1000\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [6265624 

2014-07-23] (Piriform Ltd)
HKU\S-1-5-21-368666148-3114612420-1351031977-1000\...\Run: [TrueCrypt] => C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 

2014-09-27] (TrueCrypt Foundation)
HKU\S-1-5-21-368666148-3114612420-1351031977-1000\...\MountPoints2: {4e67196c-256d-11e4-b938-3c970ec4efb7} - G:\pushinst.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-01-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-01-11] (NVIDIA Corporation)
ShellIconOverlayIdentifiers:  AccExtIco1 -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe 

Creative Cloud\CoreSync\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers:  AccExtIco2 -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe 

Creative Cloud\CoreSync\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers:  AccExtIco3 -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe 

Creative Cloud\CoreSync\CoreSync_x64.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=ssl
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x07427EABA8B8CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - DefaultScope {4903A22A-FB2C-4F5D-8CF6-BE2574B29C1B} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {4903A22A-FB2C-4F5D-8CF6-BE2574B29C1B} URL = https://www.google.com/search?q={searchTerms}
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar

\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar

\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar

\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar

\GoogleToolbar_32.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{09392B9A-FEBB-45C2-8AEC-BBA1BC12FCC9}: [NameServer] 5.79.71.195 213.239.217.228
Tcpip\..\Interfaces\{3765D261-06BC-4961-9E63-77F288F5BB10}: [NameServer] 190.120.228.30,185.19.87.36
Tcpip\..\Interfaces\{45A343D0-F11F-4486-A3DA-7F67C8E1F683}: [NameServer] 8.8.8.8,204.152.184.76

FireFox:
========
FF ProfilePath: C:\Users\Kewin\AppData\Roaming\Mozilla\Firefox\Profiles\QCEfmcMu.default
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities

\npAdobeAAMDetect64.dll No File
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll 

(Adobe Systems)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update

\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update

\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll 

(Adobe Systems)
FF Extension: Avira Browser Safety - C:\Users\Kewin\AppData\Roaming\Mozilla\Firefox\Profiles\QCEfmcMu.default\Extensions

\abs@avira.com [2014-09-28]

Chrome: 
=======
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\WidevineCDM

\1.4.5.671\_platform_specific\win_x86\widevinecdmadapter.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\PepperFlash

\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (AdobeAAMDetect) - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe 

Systems)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CHR Profile: C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\aohghmighlieiainnegkcijnfilokake [2014-08-23]
CHR Extension: (Google Drive) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\apdfllckaahabafndbhieahigkjlhalf [2014-08-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default

\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-23]
CHR Extension: (Google Search) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-23]
CHR Extension: (Google Wallet) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-23]
CHR Extension: (Gmail) - C:\Users\Kewin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless 

listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations 

GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. 

KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [161016 2014-09-17] (Avira 

Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes 

Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes 

Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA 

Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2014-09-19] (Microsoft Corporation) [File not signed]
R2 VPNManager; C:\Program Files (x86)\Perfect Privacy VPN Manager\VPNManagerService.exe [17408 2014-08-16] (Perfect Privacy) 

[File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless 

listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-04-25] (AVM Berlin)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-21] (AVM GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-30] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-01-11] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project) [File not signed]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately 

to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-30 09:23 - 2014-09-30 09:23 - 00014073 _____ () C:\Users\Kewin\Downloads\FRST.txt
2014-09-30 09:23 - 2014-09-30 09:23 - 00000000 ____D () C:\FRST
2014-09-30 09:22 - 2014-09-30 09:22 - 02108928 _____ (Farbar) C:\Users\Kewin\Downloads\FRST64.exe
2014-09-30 09:21 - 2014-09-30 09:21 - 00000472 _____ () C:\Users\Kewin\Downloads\defogger_disable.log
2014-09-30 09:21 - 2014-09-30 09:21 - 00000000 _____ () C:\Users\Kewin\defogger_reenable
2014-09-30 09:20 - 2014-09-30 09:20 - 00715160 _____ ( ) C:\Users\Kewin\Downloads\FileOpenerSetup.exe
2014-09-30 09:20 - 2014-09-30 09:20 - 00050477 _____ () C:\Users\Kewin\Downloads\Defogger.exe
2014-09-30 09:14 - 2014-09-30 09:14 - 00065736 _____ () C:\Users\Kewin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-30 09:05 - 2014-09-30 09:07 - 04959696 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-28 23:29 - 2014-09-28 23:29 - 00000000 ____D () C:\Users\Kewin\Downloads\cleanranda_v2
2014-09-28 23:28 - 2014-09-28 23:29 - 06669969 _____ () C:\Users\Kewin\Downloads\cleanranda_v2.zip
2014-09-28 22:47 - 2014-09-30 09:17 - 00015023 _____ () C:\Windows\WindowsUpdate.log
2014-09-28 16:26 - 2014-09-28 16:26 - 00000000 ____D () C:\Users\Kewin\AppData\Local\Perfect_Privacy
2014-09-28 16:25 - 2014-09-28 16:26 - 00000000 ____D () C:\Program Files (x86)\Perfect Privacy VPN Manager
2014-09-28 16:25 - 2014-09-28 16:25 - 00001171 _____ () C:\Users\Public\Desktop\VPN Manager.lnk
2014-09-28 16:25 - 2014-09-28 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Perfect Privacy 

VPN
2014-09-28 04:22 - 2014-09-28 04:22 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\Avira
2014-09-28 04:21 - 2014-09-28 04:19 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers

\avnetflt.sys
2014-09-28 04:17 - 2014-08-15 10:30 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-09-28 04:17 - 2014-08-15 10:30 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers

\avgntflt.sys
2014-09-28 04:17 - 2014-08-15 10:30 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-09-28 04:15 - 2014-09-28 23:06 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\Mozilla
2014-09-28 04:15 - 2014-09-28 04:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-28 04:15 - 2014-09-28 04:17 - 00000000 ____D () C:\ProgramData\Avira
2014-09-28 04:15 - 2014-09-28 04:17 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-28 04:15 - 2014-09-28 04:15 - 00001158 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-28 04:08 - 2014-09-30 08:58 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers

\MBAMSwissArmy.sys
2014-09-28 04:08 - 2014-09-28 04:08 - 00001123 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-28 04:08 - 2014-09-28 04:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 

Anti-Malware
2014-09-28 04:08 - 2014-09-28 04:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-28 04:08 - 2014-09-28 04:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-28 04:08 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers

\mbamchameleon.sys
2014-09-28 04:08 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-28 04:08 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-28 03:25 - 2014-09-28 03:25 - 01835008 _____ () C:\Users\Kewin\Documents\TrueCrypt Rescue Disk.iso
2014-09-28 03:25 - 2014-09-28 03:25 - 00000000 ____D () C:\ProgramData\TrueCrypt
2014-09-28 02:20 - 2014-09-28 14:58 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\DAEMON Tools Lite
2014-09-28 02:19 - 2014-09-28 03:26 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-09-28 02:00 - 2014-09-28 02:01 - 1073741824 _____ () C:\Users\Kewin\Documents\Music Maker 2014
2014-09-28 01:54 - 2014-09-28 02:02 - 00006928 _____ () C:\Users\Kewin\Desktop\Dreamweaver Codes.txt
2014-09-28 01:49 - 2014-09-28 05:11 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\TrueCrypt
2014-09-27 02:37 - 2014-09-28 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN
2014-09-27 02:37 - 2014-09-28 23:41 - 00000000 ____D () C:\Program Files (x86)\OpenVPN
2014-09-27 02:36 - 2014-09-28 01:50 - 00000000 ____D () C:\Program Files\TrueCrypt
2014-09-27 02:36 - 2014-09-27 02:36 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2014-09-27 02:36 - 2014-09-27 02:36 - 00000890 _____ () C:\Users\Public\Desktop\TrueCrypt.lnk
2014-09-27 02:36 - 2014-09-27 02:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
2014-09-26 00:34 - 2014-09-26 00:34 - 00001195 _____ () C:\Users\Kewin\Desktop\TeamViewer 9.lnk
2014-09-26 00:34 - 2014-09-26 00:34 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-09-24 19:08 - 2014-09-24 19:08 - 00000000 ____D () C:\Users\Kewin\voip
2014-09-24 19:00 - 2014-09-26 01:00 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\ICQ
2014-09-19 14:31 - 2013-10-01 10:57 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll.backup
2014-09-19 14:31 - 2009-07-14 03:41 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll.backup
2014-09-19 14:31 - 2009-07-14 03:41 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\themeservice.dll.backup
2014-09-19 12:50 - 2014-09-27 02:40 - 00000000 ___RD () C:\Users\Kewin\Desktop\Akademie für Kommunikation
2014-09-18 14:33 - 2009-12-20 00:00 - 00000000 ____D () C:\xampp
2014-09-16 14:28 - 2014-09-16 14:28 - 00000000 ____D () C:\Users\Kewin\.android
2014-09-15 18:31 - 2014-09-15 18:31 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-09-07 13:31 - 2014-09-07 13:31 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\OpenOffice
2014-09-07 13:30 - 2014-09-07 13:30 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 

4.1.0
2014-09-07 13:30 - 2014-09-07 13:30 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-30 09:21 - 2014-08-15 18:34 - 00000000 ____D () C:\Users\Kewin
2014-09-30 09:14 - 2009-07-14 06:45 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-

1.C7483456-A289-439d-8115-601632D005A0
2014-09-30 09:14 - 2009-07-14 06:45 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-

0.C7483456-A289-439d-8115-601632D005A0
2014-09-30 09:07 - 2014-08-15 19:47 - 00000000 ____D () C:\Users\Kewin\AppData\Local\Adobe
2014-09-30 09:05 - 2014-08-21 19:47 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-30 09:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-30 08:44 - 2014-08-21 19:47 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-30 08:44 - 2014-08-16 20:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-28 23:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-28 23:04 - 2014-08-15 18:35 - 00000000 ____D () C:\Users\Kewin\AppData\Local\VirtualStore
2014-09-28 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-09-28 04:15 - 2014-08-15 19:01 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-28 03:38 - 2009-07-14 19:58 - 00698374 _____ () C:\Windows\system32\perfh007.dat
2014-09-28 03:38 - 2009-07-14 19:58 - 00149038 _____ () C:\Windows\system32\perfc007.dat
2014-09-28 03:38 - 2009-07-14 07:13 - 01616954 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-28 02:34 - 2014-08-15 19:08 - 01591234 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-26 18:40 - 2014-08-15 20:01 - 00000034 _____ () C:\Users\Kewin\AppData\Roaming\AdobeWLCMCache.dat
2014-09-26 11:14 - 2009-07-14 20:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-09-26 10:57 - 2014-08-15 19:47 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\Adobe
2014-09-25 19:04 - 2014-08-16 20:26 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-25 19:04 - 2014-08-16 20:26 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-25 19:04 - 2014-08-16 20:26 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-23 11:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-09-21 21:19 - 2014-08-16 19:57 - 00000000 ____D () C:\Users\Kewin\AppData\Roaming\vlc
2014-09-21 16:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-19 14:37 - 2014-08-21 19:46 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 

XI.lnk
2014-09-19 14:31 - 2013-10-01 10:57 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-09-19 14:31 - 2009-07-14 01:55 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-09-19 14:31 - 2009-07-14 01:54 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\themeservice.dll
2014-09-18 14:22 - 2014-08-16 15:24 - 00000000 ____D () C:\Users\Kewin\AppData\Local\Microsoft Games

Some content of TEMP:
====================
C:\Users\Kewin\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-28 06:08

==================== End Of Log ============================