PC hängt, Internet funktioniert nicht mehr....Astromenda?

JannikL · 01.10.2014, 20:18

Hallo,
habe hier im Forum aktuell noch einen Thread laufen. Dort ging es darum dass ich mein Open office nicht installieren bzw aktualisieren kann da kurz vor Ende der installation die meldung kommt : aktueller schlüssel ist im angegebenen status nicht gültig.
Habe daraufhin versucht eine ältere version zu laden...was auch nicht funktionierte.
In google wurde empfohlen ein Programm zu laden dass java7 fehler behebt was ein grund für das open office problem sein könnte. (allerdings soll das fehlerhafte microsoft update auch schuld daran sein...was ich auf meinem rechner nicht mehr finde...weiss da jemand was?)
Habe dabei dieses astromenda-gedöns bekommen.
Habe alles gelöscht und wie bei google beschrieben war (auch hier vom board) auch in den browsern selbst astromenda deaktiviert.
Wollte dann die anleitung von euch befolgen mit dem malewarebytes anti maleware programm. allerdings fingen dann probleme an.
Malewarebytes wollte sich aktualisieren...hängt sich dann aber auf. Habe kaspersky testversion geladen und heute durchlaufen lassen....nach 7 stunden hing sich kaspersky bei 99 prozent und 1 minute verbleibend auf (hatte soviel ich gesehen habe bis dahin nichts gefunden)
Das Internet funktioniert nicht mehr obwohl ich mit meinem w lan verbunden bin.
Habe jetzt im abgesicherten modus nur mit netzwerktreibern starten lassen und kann somit von dem ganzen kram berichten......
was kann ich tun ? vielen dank

schrauber · 01.10.2014, 20:28

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

JannikL · 02.10.2014, 11:26

So hoffe es klappt
Das Programm lief übrigens nur im abgesichterten Modus. Im normalen Modus gab es beim starten keine Rückmeldung

schrauber · 03.10.2014, 10:43

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

JannikL · 03.10.2014, 10:50

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-10-2014 01
Ran by Reinhold (administrator) on REINHOLD-PC on 02-10-2014 12:17:46
Running from C:\Users\Reinhold\Downloads
Loaded Profile: Reinhold (Available profiles: Reinhold & Jannik)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [nmctxth] => C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [647216 2009-07-07] (Cisco Systems, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-06] (AVAST Software)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\S-1-5-21-3813445578-1839699046-1982152698-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-3813445578-1839699046-1982152698-1000\...\Run: [Overwolf] => C:\Program Files\Overwolf\Overwolf.exe -silent
HKU\S-1-5-18\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
BootExecute: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: http=127.0.0.1:49215;https=127.0.0.1:49215
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
BHO: No Name -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} ->  No File
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default
FF NewTab: chrome://lightning/content/newtab.html
FF SearchEngineOrder.1: Google
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @kaspersky.com/content_blocker -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin: @kaspersky.com/virtual_keyboard -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2013-05-24]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2013-05-24]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-06-01]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-08]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Thunderbird\Extensions: [{380AE6CB-09B9-4373-B360-D01C2462A6E7}] - C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin
FF HKCU\...\Thunderbird\Extensions: [{0E810812-F4BB-4309-942A-755587587A5E}] - C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (MicrosoftÂ® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll (Macromedia, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR CustomProfile: C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-08]
CHR Extension: (Google Drive) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (Kaspersky Protection) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-09-30]
CHR Extension: (avast! Online Security) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-06]
CHR HKLM\...\Chrome\Extension: [nlafpokblfobdnjhhggocaanijghemnd] - C:\Users\Reinhold\AppData\Local\Temp\tbch.crx [2014-08-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-06] (AVAST Software)
S2 AVP15.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S2 nmservice; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [647216 2009-07-07] (Cisco Systems, Inc.)
S4 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S4 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
S4 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-06] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-06] (AVAST Software)
R1 AswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-08-06] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-06] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-06] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-06] (AVAST Software)
S1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-08-06] (AVAST Software)
S0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-06] ()
S3 Cam5607; C:\Windows\System32\Drivers\BisonC07.sys [1461032 2008-12-04] (Bison Electronics. Inc. )
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41584 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-04-29] (GFI Software)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135264 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [111200 2014-04-18] (Kaspersky Lab ZAO)
S1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [34400 2014-04-10] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [643168 2014-04-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2014-02-25] (Kaspersky Lab ZAO)
S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [24672 2014-03-28] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-08-08] (Kaspersky Lab ZAO)
S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2014-03-25] (Kaspersky Lab ZAO)
S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145888 2014-03-26] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-02] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 PhilCap; C:\Windows\System32\DRIVERS\PhilCap.sys [908896 2007-07-31] (NXP Semiconductors Germany GmbH)
S2 pnarp; C:\Windows\System32\DRIVERS\pnarp.sys [26672 2009-07-07] (Cisco Systems, Inc.)
S2 purendis; C:\Windows\System32\DRIVERS\purendis.sys [27696 2009-07-07] (Cisco Systems, Inc.)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579840 2009-09-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [551424 2009-09-02] (eMPIA Technology, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-02 11:51 - 2014-10-02 11:52 - 00007920 _____ () C:\Users\Reinhold\Downloads\Addition.txt
2014-10-02 11:49 - 2014-10-02 12:19 - 00019331 _____ () C:\Users\Reinhold\Downloads\FRST.txt
2014-10-02 11:48 - 2014-10-02 12:17 - 00000000 ____D () C:\FRST
2014-10-02 11:48 - 2014-10-02 11:48 - 01100288 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST.exe
2014-10-01 20:59 - 2014-10-02 11:59 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-01 20:58 - 2014-10-01 20:58 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-01 20:58 - 2014-10-01 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-10-01 20:58 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-01 20:57 - 2014-10-01 20:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (4).exe
2014-09-30 22:09 - 2014-09-30 22:09 - 00000988 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-09-30 22:09 - 2014-09-30 22:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-09-30 22:06 - 2014-09-30 22:06 - 00000000 ____D () C:\Program Files\Kaspersky Lab
2014-09-30 22:01 - 2014-04-18 16:35 - 00643168 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-09-30 22:01 - 2014-04-18 16:35 - 00111200 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-09-30 22:01 - 2014-04-10 17:25 - 00034400 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-09-30 21:40 - 2014-09-30 21:44 - 175400560 _____ () C:\Users\Reinhold\Downloads\kav15.0.0.463de-de.exe
2014-09-30 21:22 - 2014-09-30 21:32 - 173308623 _____ () C:\Users\Reinhold\Downloads\Nicht bestätigt 241105.crdownload
2014-09-30 21:19 - 2014-09-30 21:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (3).exe
2014-09-30 16:13 - 2014-09-30 16:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-09-30 16:07 - 2014-09-30 16:07 - 01612937 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT.exe
2014-09-30 16:00 - 2014-09-30 16:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-09-30 15:56 - 2014-09-30 15:56 - 327716405 _____ () C:\Windows\MEMORY.DMP
2014-09-30 15:56 - 2014-09-30 15:56 - 00143616 _____ () C:\Windows\Minidump\Mini093014-01.dmp
2014-09-30 15:52 - 2014-09-30 15:53 - 00259584 _____ (OldTimer Tools) C:\Users\Reinhold\Downloads\OTH.scr
2014-09-30 15:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-09-30 15:28 - 2014-09-30 15:28 - 01373475 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.310.exe
2014-09-30 15:10 - 2014-09-30 15:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-30 14:20 - 2014-09-30 14:20 - 00000000 ____D () C:\ProgramData\Panda Security
2014-09-30 14:17 - 2014-09-30 14:16 - 03690256 _____ (Piriform Ltd) C:\Users\Reinhold\Downloads\CCleaner [1].exe
2014-09-30 14:15 - 2014-09-30 14:16 - 00786224 _____ ( ) C:\Users\Reinhold\Downloads\CCleaner.exe
2014-09-29 19:07 - 2014-09-29 19:11 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de (1).exe
2014-09-29 18:47 - 2014-09-29 18:52 - 140910890 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.0_Win_x86_install_en-US.exe
2014-09-29 18:43 - 2014-09-29 18:44 - 00000000 ____D () C:\Program Files\Search Extensions
2014-09-29 18:41 - 2014-09-29 18:46 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2014-09-29 18:15 - 2014-09-29 19:31 - 00000000 ____D () C:\Program Files\CHIP Updater
2014-09-29 18:15 - 2014-09-29 18:16 - 00000000 ____D () C:\Users\Reinhold\AppData\Local\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-29 18:13 - 2014-09-29 18:14 - 01101648 _____ () C:\Users\Reinhold\Downloads\OpenOffice - CHIP-Installer.exe
2014-09-29 17:07 - 2014-09-29 17:08 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Reinhold\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-09-29 16:36 - 2014-09-29 16:36 - 00020261 _____ () C:\Users\Reinhold\Desktop\Spickaaaa.odt
2014-09-29 10:56 - 2014-09-29 10:59 - 164858324 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2014-09-24 14:02 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-22 13:24 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Desktop\Physiologie.zip
2014-09-22 13:08 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Downloads\Physiologie.zip
2014-09-17 14:43 - 2014-09-17 14:43 - 01148755 _____ () C:\Users\Reinhold\Downloads\elma.exe
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Program Files\ElastoMania111
2014-09-12 12:21 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 12:21 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 12:21 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 12:21 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 12:21 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 12:20 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 12:20 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 12:20 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 12:20 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 19:59 - 2014-09-10 19:59 - 00000000 ____D () C:\ProgramData\Oracle

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-02 12:13 - 2013-04-29 16:37 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-02 12:13 - 2009-03-08 14:08 - 01768247 _____ () C:\Windows\WindowsUpdate.log
2014-10-02 12:10 - 2008-12-16 07:12 - 00000438 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
2014-10-02 12:09 - 2013-06-08 11:55 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-02 11:57 - 2013-06-08 11:55 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-02 11:57 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-02 11:57 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-02 11:56 - 2008-12-15 06:47 - 00184336 _____ () C:\ProgramData\nvModes.001
2014-10-02 11:56 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-02 11:47 - 2009-11-14 00:51 - 00008268 _____ () C:\Users\Reinhold\AppData\Local\d3d9caps.dat
2014-10-01 20:48 - 2013-06-08 14:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-01 20:48 - 2008-12-15 06:37 - 00184336 _____ () C:\ProgramData\nvModes.dat
2014-10-01 19:57 - 2006-11-02 15:01 - 00032532 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-30 22:08 - 2009-03-08 14:13 - 00000000 ____D () C:\Users\Reinhold
2014-09-30 21:48 - 2013-05-24 16:27 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-30 16:09 - 2014-01-20 22:13 - 00000000 ____D () C:\Program Files\PDFCreator
2014-09-30 16:09 - 2013-06-08 11:57 - 00001923 _____ () C:\Users\Reinhold\Desktop\Google Chrome.lnk
2014-09-30 15:56 - 2011-03-06 14:25 - 00000000 ____D () C:\Windows\Minidump
2014-09-30 15:34 - 2013-05-23 18:54 - 00258040 _____ () C:\Windows\PFRO.log
2014-09-30 15:31 - 2014-02-18 21:56 - 00000000 ____D () C:\AdwCleaner
2014-09-30 15:13 - 2014-02-18 22:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-30 15:13 - 2013-01-29 15:01 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Malwarebytes
2014-09-30 14:31 - 2006-11-02 14:47 - 00401584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-30 14:30 - 2013-05-24 14:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-30 14:30 - 2012-05-07 19:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-29 18:44 - 2009-03-08 14:13 - 00113040 _____ () C:\Users\Reinhold\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-29 16:46 - 2014-01-22 14:20 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-09-29 16:36 - 2014-04-14 19:46 - 00000000 ____D () C:\Users\Reinhold\Desktop\Studium
2014-09-25 10:50 - 2011-05-16 15:01 - 00005454 _____ () C:\Users\Reinhold\AppData\Roaming\wklnhst.dat
2014-09-24 21:41 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-09-24 14:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-24 13:56 - 2013-06-08 14:31 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 13:56 - 2013-06-08 14:31 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 08:41 - 2009-10-21 19:46 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-21 20:26 - 2013-05-23 18:37 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-12 12:59 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-12 12:19 - 2013-07-12 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 12:07 - 2011-12-30 22:07 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-09-12 12:07 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-12 12:01 - 2006-11-02 12:33 - 01543880 _____ () C:\Windows\system32\PerfStringBackup.INI

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.2080.dll


Some content of TEMP:
====================
C:\Users\Reinhold\AppData\Local\temp\CloudBackup2380.exe
C:\Users\Reinhold\AppData\Local\temp\drm_dialogs.dll
C:\Users\Reinhold\AppData\Local\temp\drm_dyndata_7290009.dll
C:\Users\Reinhold\AppData\Local\temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Reinhold\AppData\Local\temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Reinhold\AppData\Local\temp\Quarantine.exe
C:\Users\Reinhold\AppData\Local\temp\Setup_DE.exe
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite.dll
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite14909.dll
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite18475.dll
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite48650.dll
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite81104.dll
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite82685.dll
C:\Users\Reinhold\AppData\Local\temp\System.Data.SQLite86461.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-02 12:04

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-10-2014 01
Ran by Reinhold at 2014-10-02 12:20:03
Running from C:\Users\Reinhold\Downloads
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Anti-Virus (Enabled - Out of date) {179979E8-273D-D14E-0543-2861940E4886}
AV: avast! Antivirus (Disabled - Out of date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Out of date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
Kaspersky Anti-Virus (HKLM\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Anti-Virus (Version: 15.0.0.463 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (HKLM\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft AutoRoute 2005 (HKLM\...\{67E4EE98-59F4-4220-89A6-A20AF5BEC689}) (Version: 12.00.07.1200 - Microsoft Corporation)
Microsoft Digital Image Library 9 - Blocker (Version: 9.00.0000 - Microsoft Corporation) Hidden
Microsoft Encarta Enzyklopädie 2005 (HKLM\...\{05440044-64A6-4248-A026-9745C1E9E159}) (Version: 2005 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Picture It! Foto Premium 10 (HKLM\...\PictureItPrem_v10) (Version: 10.0.0715 - Microsoft Corporation)
Microsoft Picture It! Foto Premium 10 (Version: 10.0.0715 - Microsoft Corporation) Hidden
Microsoft Picture It!-Bibliothek 10 (Version: 10.0.0715 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Word 2002 (HKLM\...\{911B0407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft Works (HKLM\...\{B26E3B0D-C2FA-4370-B068-7C476766F029}) (Version: 08.04.0702 - Microsoft Corporation)
Microsoft Works Suite-Add-Ins für Microsoft Word (HKLM\...\{C6A12D9B-D86A-4ee6-B980-95E4B26A2E13}) (Version: 8.0.0.0000 - Microsoft Corporation)
Setup-Start von Microsoft Works 2005 (HKLM\...\Works2005Setup) (Version:  - )
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3813445578-1839699046-1982152698-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3813445578-1839699046-1982152698-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3813445578-1839699046-1982152698-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3813445578-1839699046-1982152698-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3813445578-1839699046-1982152698-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

05-09-2014 08:38:31 Geplanter Prüfpunkt
08-09-2014 13:30:35 Windows Update
10-09-2014 17:56:10 Installed Java 7 Update 67
12-09-2014 10:00:16 Windows Update
13-09-2014 10:04:56 Geplanter Prüfpunkt
15-09-2014 08:30:25 Geplanter Prüfpunkt
16-09-2014 10:50:49 Windows Update
19-09-2014 16:52:03 Windows Update
23-09-2014 08:21:55 Windows Update
24-09-2014 12:01:12 Windows Update
28-09-2014 12:02:57 Windows Update
29-09-2014 14:39:58 OpenOffice 4.1.1 wird installiert
29-09-2014 14:42:00 OpenOffice 4.1.1 wird installiert
29-09-2014 14:59:41 OpenOffice 4.1.1 wird installiert
29-09-2014 15:06:38 OpenOffice 4.1.1 wird installiert
29-09-2014 16:34:06 OpenOffice 4.1.1 wird installiert
29-09-2014 16:52:55 Installed OpenOffice 4.1.0
29-09-2014 17:03:46 Windows Update
29-09-2014 17:15:49 OpenOffice.org 3.4.1 wird installiert
30-09-2014 15:08:24 Geplanter Prüfpunkt
30-09-2014 20:02:17 First Restore Point
30-09-2014 20:08:06 Gerätetreiber-Paketinstallation: Kaspersky Lab Netzwerkdienst

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2013-05-21 01:13 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1FF4E9A3-D7C5-4B38-931A-99EC7FC02C29} - System32\Tasks\{2528B6B9-7CB1-4D0A-AD74-C16A78933547} => C:\Program Files\Skype\Phone\Skype.exe
Task: {2739DB53-F1D2-4B3B-8416-5182311EA784} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {329294B4-503A-4FEB-AD83-EC13BD3DF07C} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-08-06] (AVAST Software)
Task: {339A6057-911E-456A-8C2E-6252BA6836FB} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {41A70E32-04E0-400F-BA95-DEA88D03C425} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-08] (Google Inc.)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {71E14CE4-3AD2-4E6C-BAC4-99133F27BAAE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: {87232563-0D62-4994-A9A2-F2E51BEC185D} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~1\AD-AWA~1\AdAwareLauncher.exe
Task: {89413899-FF88-464C-86E7-F5F9EF3C5318} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {B8A96297-DFDA-4B0C-B567-495F77D80217} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-08] (Google Inc.)
Task: {DC744586-832F-433D-BA38-D4792C3D8FB6} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files\CHIP Updater\CHIPUpdater.exe
Task: {E457EAF7-3B99-46E0-9EC3-601B48838790} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {E58EA63F-BA60-4769-9683-240B5488368A} - System32\Tasks\{0B2F984C-1DCD-498A-9D56-AE79F4721FD7} => Iexplore.exe hxxp://ui.skype.com/ui/0/4.1.0.179/de/abandoninstall?page=tsMain&amp;installinfo=google-toolbar:notoffered;toolbarpresent,google-chrome:notoffered;systemlevelpresent

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:430C6D84
AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: EMDMgmt => 2
MSCONFIG\Services: GoogleDesktopManager-051210-111108 => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: ICQ Service => 2
MSCONFIG\Services: McComponentHostService => 3
MSCONFIG\Services: Nero BackItUp Scheduler 3 => 2
MSCONFIG\Services: NMIndexingService => 3
MSCONFIG\Services: PLFlash DeviceIoControl Service => 2
MSCONFIG\Services: ProtexisLicensing => 2
MSCONFIG\Services: resetWinService => 2
MSCONFIG\Services: RichVideo => 2
MSCONFIG\Services: SessionEnv => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: SSDPSRV => 3
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: SysMain => 2
MSCONFIG\Services: WMPNetworkSvc => 3
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\Services: x10nets => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BsMnt => C:\Program Files\BisonCam\BsMnt.exe
MSCONFIG\startupreg: Google Desktop Search => "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
MSCONFIG\startupreg: Google EULA Launcher => C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe GE
MSCONFIG\startupreg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
MSCONFIG\startupreg: MDS_Menu => "C:\Program Files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe" "C:\Program Files\HomeCinema\MediaShow4" UpdateWithCreateOnce "Software\CyberLink\MediaShow\4.1"
MSCONFIG\startupreg: MSC => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: PDVD8LanguageShortcut => "C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe"
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: Skytel => C:\Program Files\Realtek\Audio\HDA\Skytel.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: UCam_Menu => "C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\HomeCinema\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
MSCONFIG\startupreg: UpdatePDRShortCut => "C:\Program Files\HomeCinema\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\HomeCinema\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-3813445578-1839699046-1982152698-500 - Administrator - Disabled)
Gast (S-1-5-21-3813445578-1839699046-1982152698-501 - Limited - Enabled)
Jannik (S-1-5-21-3813445578-1839699046-1982152698-1002 - Limited - Enabled) => C:\Users\Jannik
Reinhold (S-1-5-21-3813445578-1839699046-1982152698-1000 - Administrator - Enabled) => C:\Users\Reinhold

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/02/2014 00:16:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2014 00:15:52 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (10/02/2014 11:57:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2014 11:45:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2014 11:44:32 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (10/01/2014 08:59:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung mbam.exe, Version 1.0.0.532, Zeitstempel 0x53518532, fehlerhaftes Modul MSVCR100.dll, Version 10.0.40219.325, Zeitstempel 0x4df2be1e, Ausnahmecode 0x40000015, Fehleroffset 0x0008d6fd,
Prozess-ID 0x138, Anwendungsstartzeit mbam.exe0.

Error: (10/01/2014 08:55:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2014 08:54:57 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (10/01/2014 08:47:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 819115

Error: (10/01/2014 08:47:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 819115


System errors:
=============
Error: (10/02/2014 00:16:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: aswRvrt
aswSnx
aswSP
aswTdi
aswVmm
klhk
KLIF
klpd
kneps
spldr
Wanarpv6

Error: (10/02/2014 00:16:40 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: ComputerbrowserServer%%1068

Error: (10/02/2014 00:15:54 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}

Error: (10/02/2014 00:15:52 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084EventSystem{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/02/2014 00:15:43 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084ShellHWDetection{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (10/02/2014 00:15:16 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 02.10.2014 um 12:13:50 unerwartet heruntergefahren.

Error: (10/02/2014 00:12:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Google Update-Dienst (gupdate)%%1053

Error: (10/02/2014 00:12:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Google Update-Dienst (gupdate)

Error: (10/02/2014 00:12:13 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053gupdate/comsvc{4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (10/02/2014 00:01:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Google Update-Dienst (gupdate)%%1053


Microsoft Office Sessions:
=========================
Error: (10/02/2014 00:16:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2014 00:15:52 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (10/02/2014 11:57:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2014 11:45:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2014 11:44:32 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (10/01/2014 08:59:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd13801cfdda9bf966be5

Error: (10/01/2014 08:55:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2014 08:54:57 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (10/01/2014 08:47:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 819115

Error: (10/01/2014 08:47:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 819115


CodeIntegrity Errors:
===================================
  Date: 2014-10-02 12:19:49.431
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:48.776
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:48.121
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:47.465
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:46.592
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:45.937
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:45.281
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:44.626
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:43.893
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-02 12:19:43.238
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
Percentage of memory in use: 19%
Total physical RAM: 3065.95 MB
Available physical RAM: 2476.41 MB
Total Pagefile: 6334.13 MB
Available Pagefile: 5965.97 MB
Total Virtual: 2047.88 MB
Available Virtual: 1923.38 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:278.07 GB) (Free:145.01 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:20 GB) (Free:5.4 GB) FAT32
Drive e: (DISK1) (CDROM) (Total:3.36 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 10E38D74)
Partition 1: (Active) - (Size=278.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=20 GB) - (Type=0C)

==================== End Of Log ============================

schrauber · 03.10.2014, 16:25

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

JannikL · 04.10.2014, 09:58

Code:

ATTFilter

Combofix Logfile:

	Code: 

 ATTFilter

  
	ComboFix 14-10-02.01 - Reinhold 04.10.2014  10:38:46.3.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3066.2349 [GMT 2:00]
ausgeführt von:: c:\users\Reinhold\Downloads\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Kaspersky Anti-Virus *Enabled/Outdated* {179979E8-273D-D14E-0543-2861940E4886}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Kaspersky Anti-Virus *Enabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\AlexaNSISPlugin.2080.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-09-04 bis 2014-10-04  ))))))))))))))))))))))))))))))
.
.
2014-10-04 08:46 . 2014-10-04 08:46	--------	d-----w-	c:\users\Public\AppData\Local\temp
2014-10-04 08:46 . 2014-10-04 08:46	--------	d-----w-	c:\users\Jannik\AppData\Local\temp
2014-10-04 08:46 . 2014-10-04 08:46	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-10-02 09:48 . 2014-10-02 10:21	--------	d-----w-	C:\FRST
2014-10-01 18:59 . 2014-10-03 13:45	110296	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-10-01 18:58 . 2014-05-12 05:26	51928	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-10-01 18:58 . 2014-05-12 05:25	74456	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-10-01 18:58 . 2014-05-12 05:25	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-10-01 18:58 . 2014-10-01 18:58	--------	d-----w-	c:\program files\ Malwarebytes Anti-Malware 
2014-09-30 20:06 . 2014-09-30 20:06	--------	d-----w-	c:\program files\Kaspersky Lab
2014-09-30 20:01 . 2014-04-18 14:35	111200	----a-w-	c:\windows\system32\drivers\klflt.sys
2014-09-30 20:01 . 2014-04-10 15:25	34400	----a-w-	c:\windows\system32\drivers\klhk.sys
2014-09-30 13:30 . 2010-08-30 06:34	536576	----a-w-	c:\windows\system32\sqlite3.dll
2014-09-29 16:43 . 2014-09-29 16:44	--------	d-----w-	c:\program files\Search Extensions
2014-09-29 16:15 . 2014-09-29 16:15	--------	d-----w-	c:\users\Reinhold\AppData\Roaming\Abelssoft
2014-09-29 16:15 . 2014-09-29 16:16	--------	d-----w-	c:\users\Reinhold\AppData\Local\Abelssoft
2014-09-29 16:15 . 2014-09-29 17:31	--------	d-----w-	c:\program files\CHIP Updater
2014-09-24 20:56 . 2014-06-06 04:38	822384	----a-w-	c:\program files\Mozilla Firefox\icuuc52.dll
2014-09-24 20:56 . 2014-06-06 04:38	1022576	----a-w-	c:\program files\Mozilla Firefox\icuin52.dll
2014-09-24 20:56 . 2014-06-06 04:38	10594416	----a-w-	c:\program files\Mozilla Firefox\icudt52.dll
2014-09-24 12:02 . 2014-09-09 06:24	2048	----a-w-	c:\windows\system32\tzres.dll
2014-09-17 12:43 . 2014-09-17 12:43	--------	d-----w-	c:\program files\ElastoMania111
2014-09-12 10:20 . 2014-08-15 14:36	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2014-09-04 12:50 . 2014-09-04 12:50	188304	----a-w-	c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2014-09-04 12:50 . 2014-09-04 12:50	188304	----a-w-	c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-24 11:56 . 2013-06-08 12:31	701104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-09-24 11:56 . 2013-06-08 12:31	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 06:41 . 2009-10-21 17:46	231568	------w-	c:\windows\system32\MpSigStub.exe
2014-08-23 01:03 . 2014-08-29 14:38	297984	----a-w-	c:\windows\system32\gdi32.dll
2014-08-22 23:26 . 2014-08-29 14:38	2054656	----a-w-	c:\windows\system32\win32k.sys
2014-08-06 18:35 . 2013-06-08 09:55	414520	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-08-06 18:35 . 2013-06-08 09:55	57800	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2014-08-06 18:35 . 2013-06-08 09:55	192352	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-08-06 18:35 . 2013-06-08 09:55	779536	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-08-06 18:35 . 2013-06-08 09:55	49944	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-08-06 18:35 . 2013-06-08 09:55	67824	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-08-06 18:35 . 2014-08-06 18:35	24184	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-08-06 18:35 . 2013-06-08 09:55	55112	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2014-08-06 18:35 . 2014-08-06 18:35	43152	----a-w-	c:\windows\avastSS.scr
2014-08-06 18:35 . 2013-06-08 09:55	276432	----a-w-	c:\windows\system32\aswBoot.exe
2014-07-25 00:35 . 2014-07-25 00:35	875688	----a-w-	c:\windows\system32\msvcr120_clr0400.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-08-06 18:34	578240	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-10-31 6609440]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-08-06 4085896]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-08-01 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe [2014-4-9 279456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	\0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2014-08-21 16:30	959176	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BsMnt]
2008-11-03 13:14	217088	----a-w-	c:\program files\BisonCam\BsMnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]
2008-10-14 09:57	20480	----a-w-	c:\program files\Google\Google EULA\GoogleEULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-11-21 21:07	13601312	----a-w-	c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-11-21 21:07	92704	----a-w-	c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28	1233920	----a-w-	c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2008-10-31 12:06	1833504	----a-w-	c:\program files\Realtek\Audio\HDA\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-07-02 08:16	254336	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-05-08 19:37	1111336	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23	1008184	----a-w-	c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25	202240	----a-w-	c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-25 08:50	1096520	----a-w-	c:\program files\Google\Chrome\Application\37.0.2062.124\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-08 11:56]
.
2014-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-08 09:55]
.
2014-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-08 09:55]
.
2014-10-03 c:\windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
- c:\windows\system32\msfeedssync.exe [2014-09-12 14:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <-loopback>
uInternet Settings,ProxyServer = http=127.0.0.1:49215;https=127.0.0.1:49215
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - ExtSQL: 2014-09-19 18:42; firefox-hotfix@mozilla.org; c:\users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\extensions\firefox-hotfix@mozilla.org.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Overwolf - c:\program files\Overwolf\Overwolf.exe
HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
MSConfigStartUp-MDS_Menu - c:\program files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe
MSConfigStartUp-MSC - c:\program files\Microsoft Security Client\msseces.exe
MSConfigStartUp-PDVD8LanguageShortcut - c:\program files\HomeCinema\PowerDVD8\Language\Language.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-UCam_Menu - c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe
MSConfigStartUp-UpdatePDRShortCut - c:\program files\HomeCinema\PowerDirector\MUITransfer\MUIStartMenu.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-10-04 10:46
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3813445578-1839699046-1982152698-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c7,58,71,a5,c6,75,46,f9,ec,1e,15,80,7a,00,3d,69,7b,fe,55,4b,38,6e,d6,
   72,be,7b,4a,7d,3a,35,c8,4f,77,86,39,40,cb,a7,aa,a6,d5,f8,e9,6a,ca,c8,09,8e,\
"??"=hex:b5,5e,67,b3,49,08,72,ad,41,a9,3a,9c,e3,bb,58,83
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Zeit der Fertigstellung: 2014-10-04  10:48:41
ComboFix-quarantined-files.txt  2014-10-04 08:48
.
Vor Suchlauf: 14 Verzeichnis(se), 156.568.035.328 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 158.700.216.320 Bytes frei
.
- - End Of File - - CAD720E30AED9B73E11991F1F65F036B
         
 --- --- ---
5C616939100B85E558DA92B899A0FC36

schrauber · 04.10.2014, 21:36

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

JannikL · 06.10.2014, 13:21

sobald ich malewarebytes starte sehe ich noch vielleicht 2 sekunden wie er nach einer aktuellen software sucht und dann kommt auch schon die meldung : das programm reagiert nicht es wird eine lösung für das problem gesucht .....

bin gerade im abgesicherten modus....werde es jetzt mal im normalen modus versuchen

EDIT
so habe es im normalen modus geschafft ( hat ewig gedauert da mein laptop nach jedem bestätigungsklick eine gedenkminute eingelegt hat)

allerdings ist die ausgeführte suche und die ergebnisse nur mit der alten version ausgeführt da bei dem versuch einer aktualisierung das programm nicht mehr reagiert

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 06.10.2014
Suchlauf-Zeit: 10:44:28
Logdatei: Maleware.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Reinhold

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 261585
Verstrichene Zeit: 1 Std, 12 Min, 4 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 2
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [2821a9566b0f53e38f87af9027db0df3], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [2821a9566b0f53e38f87af9027db0df3], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

hier ist das ergebniss vom adw cleaner

Code:

ATTFilter

# AdwCleaner v3.311 - Bericht erstellt am 06/10/2014 um 12:34:40
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Reinhold - REINHOLD-PC
# Gestartet von : C:\Users\Reinhold\Downloads\AdwCleaner_3.311.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Search Extensions

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16575


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\prefs.js ]


-\\ Google Chrome v37.0.2062.124

[ Datei : C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_clickconnect_14_40_ch&cd=2XzuyEtN2Y1L1QzutDtDtBtByEtAyCtDtA0A0EtD0EtCtCyCtN0D0Tzu0StCtDtDyEtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0EtA0F0FyB0DyDtGtBtAyByEtGzz0C0DyDtG0E0B0DyEtGyEtCyE0EtC0D0CtAtAyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDyCyC0CyDyDtAyDtGtDyB0CyEtGyEtBtCtCtGzy0EtBtCtG0CyByCyD0EtAzy0E0AyDzy0B2Q&cr=1695763696&ir=

*************************

AdwCleaner[R0].txt - [6399 octets] - [18/02/2014 21:57:04]
AdwCleaner[R1].txt - [4512 octets] - [30/09/2014 15:28:46]
AdwCleaner[R2].txt - [1322 octets] - [06/10/2014 12:33:08]
AdwCleaner[S0].txt - [5397 octets] - [18/02/2014 21:59:52]
AdwCleaner[S1].txt - [4538 octets] - [30/09/2014 15:31:03]
AdwCleaner[S2].txt - [1644 octets] - [06/10/2014 12:34:40]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1704 octets] ##########

schrauber · 07.10.2014, 10:10

Dann noch den Rest bitte

JannikL · 08.10.2014, 10:01

hier die noch fehlenden logs =)

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 01
Ran by Reinhold (administrator) on REINHOLD-PC on 08-10-2014 10:56:16
Running from C:\Users\Reinhold\Downloads
Loaded Profile: Reinhold (Available profiles: Reinhold & Jannik)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Reinhold\Downloads\FRST (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [nmctxth] => C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [647216 2009-07-07] (Cisco Systems, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-06] (AVAST Software)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\S-1-5-21-3813445578-1839699046-1982152698-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
BootExecute: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: http=127.0.0.1:49215;https=127.0.0.1:49215
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default
FF NewTab: chrome://lightning/content/newtab.html
FF SearchEngineOrder.1: Google
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @kaspersky.com/content_blocker -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin: @kaspersky.com/virtual_keyboard -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2013-05-24]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2013-05-24]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-06-01]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-08]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Thunderbird\Extensions: [{380AE6CB-09B9-4373-B360-D01C2462A6E7}] - C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin
FF HKCU\...\Thunderbird\Extensions: [{0E810812-F4BB-4309-942A-755587587A5E}] - C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (MicrosoftÂ® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll (Macromedia, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR CustomProfile: C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-08]
CHR Extension: (Google Drive) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (Kaspersky Protection) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-09-30]
CHR Extension: (avast! Online Security) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-06]
CHR HKLM\...\Chrome\Extension: [nlafpokblfobdnjhhggocaanijghemnd] - C:\Users\Reinhold\AppData\Local\Temp\tbch.crx [2014-08-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-06] (AVAST Software)
S2 AVP15.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S2 nmservice; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [647216 2009-07-07] (Cisco Systems, Inc.)
S4 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S4 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
S4 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-06] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-06] (AVAST Software)
R1 AswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-08-06] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-06] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-06] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-06] (AVAST Software)
S1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-08-06] (AVAST Software)
S0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-06] ()
S3 Cam5607; C:\Windows\System32\Drivers\BisonC07.sys [1461032 2008-12-04] (Bison Electronics. Inc. )
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41584 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-04-29] (GFI Software)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135264 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [111200 2014-04-18] (Kaspersky Lab ZAO)
S1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [34400 2014-04-10] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [643168 2014-04-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2014-02-25] (Kaspersky Lab ZAO)
S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [24672 2014-03-28] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-08-08] (Kaspersky Lab ZAO)
S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2014-03-25] (Kaspersky Lab ZAO)
S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145888 2014-03-26] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-06] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 PhilCap; C:\Windows\System32\DRIVERS\PhilCap.sys [908896 2007-07-31] (NXP Semiconductors Germany GmbH)
S2 pnarp; C:\Windows\System32\DRIVERS\pnarp.sys [26672 2009-07-07] (Cisco Systems, Inc.)
S2 purendis; C:\Windows\System32\DRIVERS\purendis.sys [27696 2009-07-07] (Cisco Systems, Inc.)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579840 2009-09-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [551424 2009-09-02] (eMPIA Technology, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Reinhold\AppData\Local\Temp\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 10:55 - 2014-10-08 10:55 - 01101312 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST (1).exe
2014-10-08 10:54 - 2014-10-08 10:54 - 00001313 _____ () C:\Users\Reinhold\Desktop\JRT.txt
2014-10-08 10:54 - 2014-10-08 10:54 - 00001313 _____ () C:\Users\Reinhold\Desktop\JRT neu.txt
2014-10-08 10:51 - 2014-10-08 10:51 - 01705141 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT (1).exe
2014-10-08 10:51 - 2014-10-08 10:51 - 00000000 ____D () C:\Windows\ERUNT
2014-10-06 12:40 - 2014-10-06 12:40 - 00001784 _____ () C:\Users\Reinhold\Desktop\AdwCleaner[S2].txt
2014-10-06 12:32 - 2014-10-06 12:32 - 01375089 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.311.exe
2014-10-06 12:27 - 2014-10-06 12:30 - 00001538 _____ () C:\Users\Reinhold\Desktop\Maleware.txt
2014-10-06 10:22 - 2014-10-06 10:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (5).exe
2014-10-04 10:48 - 2014-10-04 10:48 - 00015946 _____ () C:\ComboFix.txt
2014-10-04 10:35 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-04 10:29 - 2014-10-04 10:48 - 00000000 ____D () C:\Qoobox
2014-10-04 10:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-04 10:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-04 10:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-04 10:28 - 2014-10-04 10:28 - 05582981 ____R (Swearware) C:\Users\Reinhold\Downloads\ComboFix.exe
2014-10-02 12:22 - 2014-10-02 12:22 - 00033559 _____ () C:\Users\Reinhold\Desktop\FRST.txt
2014-10-02 12:22 - 2014-10-02 12:22 - 00027227 _____ () C:\Users\Reinhold\Desktop\Addition.txt
2014-10-02 11:51 - 2014-10-02 12:21 - 00027227 _____ () C:\Users\Reinhold\Downloads\Addition.txt
2014-10-02 11:49 - 2014-10-08 10:56 - 00000000 _____ () C:\Users\Reinhold\Downloads\FRST.txt
2014-10-02 11:48 - 2014-10-08 10:56 - 00000000 ____D () C:\FRST
2014-10-02 11:48 - 2014-10-02 11:48 - 01100288 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST.exe
2014-10-01 20:59 - 2014-10-06 13:37 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-01 20:58 - 2014-10-06 10:23 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-01 20:58 - 2014-10-06 10:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-10-06 10:23 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-01 20:57 - 2014-10-01 20:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (4).exe
2014-09-30 22:09 - 2014-09-30 22:09 - 00000988 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-09-30 22:09 - 2014-09-30 22:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-09-30 22:06 - 2014-09-30 22:06 - 00000000 ____D () C:\Program Files\Kaspersky Lab
2014-09-30 22:01 - 2014-04-18 16:35 - 00643168 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-09-30 22:01 - 2014-04-18 16:35 - 00111200 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-09-30 22:01 - 2014-04-10 17:25 - 00034400 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-09-30 21:40 - 2014-09-30 21:44 - 175400560 _____ () C:\Users\Reinhold\Downloads\kav15.0.0.463de-de.exe
2014-09-30 21:22 - 2014-09-30 21:32 - 173308623 _____ () C:\Users\Reinhold\Downloads\Nicht bestätigt 241105.crdownload
2014-09-30 21:19 - 2014-09-30 21:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (3).exe
2014-09-30 16:13 - 2014-09-30 16:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-09-30 16:07 - 2014-09-30 16:07 - 01612937 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT.exe
2014-09-30 16:00 - 2014-09-30 16:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-09-30 15:56 - 2014-09-30 15:56 - 327716405 _____ () C:\Windows\MEMORY.DMP
2014-09-30 15:56 - 2014-09-30 15:56 - 00143616 _____ () C:\Windows\Minidump\Mini093014-01.dmp
2014-09-30 15:52 - 2014-09-30 15:53 - 00259584 _____ (OldTimer Tools) C:\Users\Reinhold\Downloads\OTH.scr
2014-09-30 15:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-09-30 15:28 - 2014-09-30 15:28 - 01373475 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.310.exe
2014-09-30 15:10 - 2014-09-30 15:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-30 14:20 - 2014-09-30 14:20 - 00000000 ____D () C:\ProgramData\Panda Security
2014-09-30 14:17 - 2014-09-30 14:16 - 03690256 _____ (Piriform Ltd) C:\Users\Reinhold\Downloads\CCleaner [1].exe
2014-09-30 14:15 - 2014-09-30 14:16 - 00786224 _____ ( ) C:\Users\Reinhold\Downloads\CCleaner.exe
2014-09-29 19:07 - 2014-09-29 19:11 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de (1).exe
2014-09-29 18:47 - 2014-09-29 18:52 - 140910890 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.0_Win_x86_install_en-US.exe
2014-09-29 18:41 - 2014-09-29 18:46 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2014-09-29 18:15 - 2014-09-29 19:31 - 00000000 ____D () C:\Program Files\CHIP Updater
2014-09-29 18:15 - 2014-09-29 18:16 - 00000000 ____D () C:\Users\Reinhold\AppData\Local\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-29 18:13 - 2014-09-29 18:14 - 01101648 _____ () C:\Users\Reinhold\Downloads\OpenOffice - CHIP-Installer.exe
2014-09-29 17:07 - 2014-09-29 17:08 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Reinhold\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-09-29 16:36 - 2014-09-29 16:36 - 00020261 _____ () C:\Users\Reinhold\Desktop\Spickaaaa.odt
2014-09-29 10:56 - 2014-09-29 10:59 - 164858324 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2014-09-24 14:02 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-22 13:24 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Desktop\Physiologie.zip
2014-09-22 13:08 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Downloads\Physiologie.zip
2014-09-17 14:43 - 2014-09-17 14:43 - 01148755 _____ () C:\Users\Reinhold\Downloads\elma.exe
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Program Files\ElastoMania111
2014-09-12 12:21 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 12:21 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 12:21 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 12:21 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 12:21 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 12:20 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 12:20 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 12:20 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 12:20 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 19:59 - 2014-09-10 19:59 - 00000000 ____D () C:\ProgramData\Oracle

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 10:46 - 2013-06-08 11:55 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-08 10:46 - 2013-04-29 16:37 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-08 10:46 - 2008-12-15 06:47 - 00184336 _____ () C:\ProgramData\nvModes.001
2014-10-08 10:46 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-08 10:46 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-08 10:45 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-06 14:12 - 2009-11-14 00:51 - 00008268 _____ () C:\Users\Reinhold\AppData\Local\d3d9caps.dat
2014-10-06 13:35 - 2008-12-16 07:12 - 00000438 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
2014-10-06 12:46 - 2009-03-08 14:08 - 01869761 _____ () C:\Windows\WindowsUpdate.log
2014-10-06 12:45 - 2006-11-02 15:01 - 00032532 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-06 12:43 - 2013-06-08 14:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-06 12:37 - 2013-05-23 18:54 - 00258906 _____ () C:\Windows\PFRO.log
2014-10-06 12:34 - 2014-02-18 21:56 - 00000000 ____D () C:\AdwCleaner
2014-10-06 12:10 - 2013-06-08 11:55 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-04 10:46 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-10-04 10:45 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-10-01 20:48 - 2008-12-15 06:37 - 00184336 _____ () C:\ProgramData\nvModes.dat
2014-09-30 22:08 - 2009-03-08 14:13 - 00000000 ____D () C:\Users\Reinhold
2014-09-30 21:48 - 2013-05-24 16:27 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-30 16:09 - 2014-01-20 22:13 - 00000000 ____D () C:\Program Files\PDFCreator
2014-09-30 16:09 - 2013-06-08 11:57 - 00001923 _____ () C:\Users\Reinhold\Desktop\Google Chrome.lnk
2014-09-30 15:56 - 2011-03-06 14:25 - 00000000 ____D () C:\Windows\Minidump
2014-09-30 15:13 - 2014-02-18 22:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-30 15:13 - 2013-01-29 15:01 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Malwarebytes
2014-09-30 14:31 - 2006-11-02 14:47 - 00401584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-30 14:30 - 2013-05-24 14:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-30 14:30 - 2012-05-07 19:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-29 18:44 - 2009-03-08 14:13 - 00113040 _____ () C:\Users\Reinhold\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-29 16:46 - 2014-01-22 14:20 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-09-29 16:36 - 2014-04-14 19:46 - 00000000 ____D () C:\Users\Reinhold\Desktop\Studium
2014-09-25 10:50 - 2011-05-16 15:01 - 00005454 _____ () C:\Users\Reinhold\AppData\Roaming\wklnhst.dat
2014-09-24 21:41 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-09-24 14:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-24 13:56 - 2013-06-08 14:31 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 13:56 - 2013-06-08 14:31 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 08:41 - 2009-10-21 19:46 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-21 20:26 - 2013-05-23 18:37 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-12 12:59 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-12 12:19 - 2013-07-12 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 12:07 - 2011-12-30 22:07 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-09-12 12:07 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-12 12:01 - 2006-11-02 12:33 - 01543880 _____ () C:\Windows\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Users\Reinhold\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-06 13:54

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.1 (10.06.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Reinhold on 08.10.2014 at 10:51:59,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\search extensions"



~~~ FireFox

Successfully deleted the following from C:\Users\Reinhold\AppData\Roaming\mozilla\firefox\profiles\msj3c3lo.default\prefs.js

user_pref("browser.search.useDBForOrder", true);
Emptied folder: C:\Users\Reinhold\AppData\Roaming\mozilla\firefox\profiles\msj3c3lo.default\minidumps [888 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.10.2014 at 10:54:15,56
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

schrauber · 08.10.2014, 16:52

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

JannikL · 08.10.2014, 19:20

alles klar scan läuft =)

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7b53a794afb1f0468947f793f2755f35
# engine=20502
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-08 06:03:42
# local_time=2014-10-08 08:03:42 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=771 16777214 83 67 2272977 5441332 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 43401501 250324150 0 0
# scanned=229681
# found=8
# cleaned=0
# scan_time=7040
sh=DA0495E198662B8A02D6F00DFC9F9E992B6D7F5A ft=1 fh=aca0caa08b102199 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"
sh=D77C674F4EE3E08F3D15B9F60D8CAD2C08C987ED ft=1 fh=4bb850a649203496 vn="Variante von Win32/InstallCore.PL evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\CCleaner.exe"
sh=68DFCE5CFD97664730BCE59B0E9C0BF44BFCC3A0 ft=1 fh=77b67014d8a47abf vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\digital-image-recovery-90.exe"
sh=AE8BF9AAF6148AAD40EE76346FEA3DF755CAC824 ft=1 fh=d750ec227fcc001d vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\FreeVideoDub.exe"
sh=848BB4BF9A9A2743DC086BFB0CB9F0A11F0FDA06 ft=1 fh=8d13beaf1272030d vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\FreeYouTubeToMp3Converter37.exe"
sh=1447092BA29779C726829611180994E17718C412 ft=1 fh=23f22b72eb3a5b90 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\PDFCreator-1_7_2_setup_offline.exe"
sh=E7A9F4E28344A4661A05EB21CD770F351A8283BA ft=1 fh=55d967760b8b4033 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\speedupmypc.exe"
sh=6A8D233CD989F944ADC3DEB2AF7F505523E27AC8 ft=1 fh=77b67014c21a5d01 vn="Variante von Win32/DownloadSponsor.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reinhold\Downloads\speedyfox.exe"

Code:

ATTFilter

Results of screen317's Security Check version 0.99.87  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
Kaspersky Anti-Virus   
avast! Antivirus       
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 	15.0.0.152  
 Google Chrome 37.0.2062.120  
 Google Chrome 37.0.2062.124  
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 01
Ran by Reinhold (administrator) on REINHOLD-PC on 08-10-2014 20:15:16
Running from C:\Users\Reinhold\Downloads
Loaded Profile: Reinhold (Available profiles: Reinhold & Jannik)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Reinhold\Downloads\FRST (2).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [nmctxth] => C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [647216 2009-07-07] (Cisco Systems, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-06] (AVAST Software)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\S-1-5-21-3813445578-1839699046-1982152698-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
BootExecute: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: http=127.0.0.1:49215;https=127.0.0.1:49215
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default
FF NewTab: chrome://lightning/content/newtab.html
FF SearchEngineOrder.1: Google
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @kaspersky.com/content_blocker -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin: @kaspersky.com/virtual_keyboard -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2013-05-24]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2013-05-24]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-06-01]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-08]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Thunderbird\Extensions: [{380AE6CB-09B9-4373-B360-D01C2462A6E7}] - C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin
FF HKCU\...\Thunderbird\Extensions: [{0E810812-F4BB-4309-942A-755587587A5E}] - C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (MicrosoftÂ® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll (Macromedia, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR CustomProfile: C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-08]
CHR Extension: (Google Drive) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (Kaspersky Protection) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-09-30]
CHR Extension: (avast! Online Security) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-06]
CHR HKLM\...\Chrome\Extension: [nlafpokblfobdnjhhggocaanijghemnd] - C:\Users\Reinhold\AppData\Local\Temp\tbch.crx [2014-08-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-06] (AVAST Software)
S2 AVP15.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S2 nmservice; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [647216 2009-07-07] (Cisco Systems, Inc.)
S4 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S4 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
S4 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-06] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-06] (AVAST Software)
R1 AswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-08-06] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-06] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-06] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-06] (AVAST Software)
S1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-08-06] (AVAST Software)
S0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-06] ()
S3 Cam5607; C:\Windows\System32\Drivers\BisonC07.sys [1461032 2008-12-04] (Bison Electronics. Inc. )
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41584 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-04-29] (GFI Software)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135264 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [111200 2014-04-18] (Kaspersky Lab ZAO)
S1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [34400 2014-04-10] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [643168 2014-04-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2014-02-25] (Kaspersky Lab ZAO)
S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [24672 2014-03-28] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-08-08] (Kaspersky Lab ZAO)
S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2014-03-25] (Kaspersky Lab ZAO)
S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145888 2014-03-26] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-06] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 PhilCap; C:\Windows\System32\DRIVERS\PhilCap.sys [908896 2007-07-31] (NXP Semiconductors Germany GmbH)
S2 pnarp; C:\Windows\System32\DRIVERS\pnarp.sys [26672 2009-07-07] (Cisco Systems, Inc.)
S2 purendis; C:\Windows\System32\DRIVERS\purendis.sys [27696 2009-07-07] (Cisco Systems, Inc.)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579840 2009-09-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [551424 2009-09-02] (eMPIA Technology, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Reinhold\AppData\Local\Temp\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 20:15 - 2014-10-08 20:15 - 01101312 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST (2).exe
2014-10-08 20:13 - 2014-10-08 20:13 - 00000823 _____ () C:\Users\Reinhold\Desktop\checkup.txt
2014-10-08 20:09 - 2014-10-08 20:08 - 00854417 _____ () C:\Users\Reinhold\Desktop\SecurityCheck.exe
2014-10-08 20:08 - 2014-10-08 20:08 - 00854417 _____ () C:\Users\Reinhold\Downloads\SecurityCheck.exe
2014-10-08 18:00 - 2014-10-08 18:00 - 02347384 _____ (ESET) C:\Users\Reinhold\Downloads\esetsmartinstaller_deu.exe
2014-10-08 10:59 - 2014-10-08 10:59 - 00034800 _____ () C:\Users\Reinhold\Desktop\FRST neu.txt
2014-10-08 10:55 - 2014-10-08 10:55 - 01101312 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST (1).exe
2014-10-08 10:54 - 2014-10-08 10:54 - 00001313 _____ () C:\Users\Reinhold\Desktop\JRT.txt
2014-10-08 10:54 - 2014-10-08 10:54 - 00001313 _____ () C:\Users\Reinhold\Desktop\JRT neu.txt
2014-10-08 10:51 - 2014-10-08 10:51 - 01705141 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT (1).exe
2014-10-08 10:51 - 2014-10-08 10:51 - 00000000 ____D () C:\Windows\ERUNT
2014-10-06 12:40 - 2014-10-06 12:40 - 00001784 _____ () C:\Users\Reinhold\Desktop\AdwCleaner[S2].txt
2014-10-06 12:32 - 2014-10-06 12:32 - 01375089 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.311.exe
2014-10-06 12:27 - 2014-10-06 12:30 - 00001538 _____ () C:\Users\Reinhold\Desktop\Maleware.txt
2014-10-06 10:22 - 2014-10-06 10:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (5).exe
2014-10-04 10:48 - 2014-10-04 10:48 - 00015946 _____ () C:\ComboFix.txt
2014-10-04 10:35 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-04 10:29 - 2014-10-04 10:48 - 00000000 ____D () C:\Qoobox
2014-10-04 10:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-04 10:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-04 10:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-04 10:28 - 2014-10-04 10:28 - 05582981 ____R (Swearware) C:\Users\Reinhold\Downloads\ComboFix.exe
2014-10-02 12:22 - 2014-10-02 12:22 - 00033559 _____ () C:\Users\Reinhold\Desktop\FRST.txt
2014-10-02 12:22 - 2014-10-02 12:22 - 00027227 _____ () C:\Users\Reinhold\Desktop\Addition.txt
2014-10-02 11:51 - 2014-10-02 12:21 - 00027227 _____ () C:\Users\Reinhold\Downloads\Addition.txt
2014-10-02 11:49 - 2014-10-08 20:15 - 00000000 _____ () C:\Users\Reinhold\Downloads\FRST.txt
2014-10-02 11:48 - 2014-10-08 20:15 - 00000000 ____D () C:\FRST
2014-10-02 11:48 - 2014-10-02 11:48 - 01100288 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST.exe
2014-10-01 20:59 - 2014-10-06 13:37 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-01 20:58 - 2014-10-06 10:23 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-01 20:58 - 2014-10-06 10:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-10-06 10:23 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-01 20:57 - 2014-10-01 20:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (4).exe
2014-09-30 22:09 - 2014-09-30 22:09 - 00000988 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-09-30 22:09 - 2014-09-30 22:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-09-30 22:06 - 2014-09-30 22:06 - 00000000 ____D () C:\Program Files\Kaspersky Lab
2014-09-30 22:01 - 2014-04-18 16:35 - 00643168 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-09-30 22:01 - 2014-04-18 16:35 - 00111200 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-09-30 22:01 - 2014-04-10 17:25 - 00034400 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-09-30 21:40 - 2014-09-30 21:44 - 175400560 _____ () C:\Users\Reinhold\Downloads\kav15.0.0.463de-de.exe
2014-09-30 21:22 - 2014-09-30 21:32 - 173308623 _____ () C:\Users\Reinhold\Downloads\Nicht bestätigt 241105.crdownload
2014-09-30 21:19 - 2014-09-30 21:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (3).exe
2014-09-30 16:13 - 2014-09-30 16:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-09-30 16:07 - 2014-09-30 16:07 - 01612937 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT.exe
2014-09-30 16:00 - 2014-09-30 16:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-09-30 15:56 - 2014-09-30 15:56 - 327716405 _____ () C:\Windows\MEMORY.DMP
2014-09-30 15:56 - 2014-09-30 15:56 - 00143616 _____ () C:\Windows\Minidump\Mini093014-01.dmp
2014-09-30 15:52 - 2014-09-30 15:53 - 00259584 _____ (OldTimer Tools) C:\Users\Reinhold\Downloads\OTH.scr
2014-09-30 15:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-09-30 15:28 - 2014-09-30 15:28 - 01373475 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.310.exe
2014-09-30 15:10 - 2014-09-30 15:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-30 14:20 - 2014-09-30 14:20 - 00000000 ____D () C:\ProgramData\Panda Security
2014-09-30 14:17 - 2014-09-30 14:16 - 03690256 _____ (Piriform Ltd) C:\Users\Reinhold\Downloads\CCleaner [1].exe
2014-09-30 14:15 - 2014-09-30 14:16 - 00786224 _____ ( ) C:\Users\Reinhold\Downloads\CCleaner.exe
2014-09-29 19:07 - 2014-09-29 19:11 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de (1).exe
2014-09-29 18:47 - 2014-09-29 18:52 - 140910890 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.0_Win_x86_install_en-US.exe
2014-09-29 18:41 - 2014-09-29 18:46 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2014-09-29 18:15 - 2014-09-29 19:31 - 00000000 ____D () C:\Program Files\CHIP Updater
2014-09-29 18:15 - 2014-09-29 18:16 - 00000000 ____D () C:\Users\Reinhold\AppData\Local\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-29 18:13 - 2014-09-29 18:14 - 01101648 _____ () C:\Users\Reinhold\Downloads\OpenOffice - CHIP-Installer.exe
2014-09-29 17:07 - 2014-09-29 17:08 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Reinhold\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-09-29 16:36 - 2014-09-29 16:36 - 00020261 _____ () C:\Users\Reinhold\Desktop\Spickaaaa.odt
2014-09-29 10:56 - 2014-09-29 10:59 - 164858324 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2014-09-24 14:02 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-22 13:24 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Desktop\Physiologie.zip
2014-09-22 13:08 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Downloads\Physiologie.zip
2014-09-17 14:43 - 2014-09-17 14:43 - 01148755 _____ () C:\Users\Reinhold\Downloads\elma.exe
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Program Files\ElastoMania111
2014-09-12 12:21 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 12:21 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 12:21 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 12:21 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 12:21 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 12:20 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 12:20 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 12:20 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 12:20 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 19:59 - 2014-09-10 19:59 - 00000000 ____D () C:\ProgramData\Oracle

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 19:12 - 2014-02-15 17:02 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\TS3Client
2014-10-08 18:04 - 2009-11-14 00:51 - 00008268 _____ () C:\Users\Reinhold\AppData\Local\d3d9caps.dat
2014-10-08 10:46 - 2013-06-08 11:55 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-08 10:46 - 2013-04-29 16:37 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-08 10:46 - 2008-12-15 06:47 - 00184336 _____ () C:\ProgramData\nvModes.001
2014-10-08 10:46 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-08 10:46 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-08 10:45 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-06 13:35 - 2008-12-16 07:12 - 00000438 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
2014-10-06 13:34 - 2009-03-08 14:08 - 01869761 _____ () C:\Windows\WindowsUpdate.log
2014-10-06 12:45 - 2006-11-02 15:01 - 00032532 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-06 12:43 - 2013-06-08 14:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-06 12:37 - 2013-05-23 18:54 - 00258906 _____ () C:\Windows\PFRO.log
2014-10-06 12:34 - 2014-02-18 21:56 - 00000000 ____D () C:\AdwCleaner
2014-10-06 12:10 - 2013-06-08 11:55 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-04 10:46 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-10-04 10:45 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-10-01 20:48 - 2008-12-15 06:37 - 00184336 _____ () C:\ProgramData\nvModes.dat
2014-09-30 22:08 - 2009-03-08 14:13 - 00000000 ____D () C:\Users\Reinhold
2014-09-30 21:48 - 2013-05-24 16:27 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-30 16:09 - 2014-01-20 22:13 - 00000000 ____D () C:\Program Files\PDFCreator
2014-09-30 16:09 - 2013-06-08 11:57 - 00001923 _____ () C:\Users\Reinhold\Desktop\Google Chrome.lnk
2014-09-30 15:56 - 2011-03-06 14:25 - 00000000 ____D () C:\Windows\Minidump
2014-09-30 15:13 - 2014-02-18 22:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-30 15:13 - 2013-01-29 15:01 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Malwarebytes
2014-09-30 14:31 - 2006-11-02 14:47 - 00401584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-30 14:30 - 2013-05-24 14:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-30 14:30 - 2012-05-07 19:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-29 18:44 - 2009-03-08 14:13 - 00113040 _____ () C:\Users\Reinhold\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-29 16:46 - 2014-01-22 14:20 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-09-29 16:36 - 2014-04-14 19:46 - 00000000 ____D () C:\Users\Reinhold\Desktop\Studium
2014-09-25 10:50 - 2011-05-16 15:01 - 00005454 _____ () C:\Users\Reinhold\AppData\Roaming\wklnhst.dat
2014-09-24 21:41 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-09-24 14:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-24 13:56 - 2013-06-08 14:31 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 13:56 - 2013-06-08 14:31 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 08:41 - 2009-10-21 19:46 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-21 20:26 - 2013-05-23 18:37 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-12 12:59 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-12 12:19 - 2013-07-12 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 12:07 - 2011-12-30 22:07 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-09-12 12:07 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-12 12:01 - 2006-11-02 12:33 - 01543880 _____ () C:\Windows\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Users\Reinhold\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-08 18:15

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

jetzt müsste wieder alles ok sein ? es gab 8 bedrohungen aber welches programm hat diese denn nun entfernt ?

schrauber · 09.10.2014, 11:01

FRST bitte aus dem normalen Modus laufen lassen und scannen. Download Ordner leeren.

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

JannikL · 09.10.2014, 16:21

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 01
Ran by Reinhold (administrator) on REINHOLD-PC on 09-10-2014 17:15:21
Running from C:\Users\Reinhold\Downloads
Loaded Profile: Reinhold (Available profiles: Reinhold & Jannik)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
(Cisco Systems, Inc.) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\wercon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Microsoft Corporation) C:\Windows\ehome\mcupdate.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\Reinhold\Downloads\FRST (2).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [nmctxth] => C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [647216 2009-07-07] (Cisco Systems, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-06] (AVAST Software)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\S-1-5-21-3813445578-1839699046-1982152698-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Reinhold\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
BootExecute: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: http=127.0.0.1:49215;https=127.0.0.1:49215
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default
FF NewTab: chrome://lightning/content/newtab.html
FF SearchEngineOrder.1: Google
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @kaspersky.com/content_blocker -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin: @kaspersky.com/virtual_keyboard -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Reinhold\AppData\Roaming\Mozilla\Firefox\Profiles\msj3c3lo.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2013-05-24]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2013-05-24]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-06-01]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-08]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-30]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Thunderbird\Extensions: [{380AE6CB-09B9-4373-B360-D01C2462A6E7}] - C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin
FF HKCU\...\Thunderbird\Extensions: [{0E810812-F4BB-4309-942A-755587587A5E}] - C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\37.0.2062.124\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (MicrosoftÂ® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll (Macromedia, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR CustomProfile: C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-08]
CHR Extension: (Google Drive) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (Kaspersky Protection) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-09-30]
CHR Extension: (avast! Online Security) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-06]
CHR Extension: (Google Wallet) - C:\Users\Reinhold\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-06]
CHR HKLM\...\Chrome\Extension: [nlafpokblfobdnjhhggocaanijghemnd] - C:\Users\Reinhold\AppData\Local\Temp\tbch.crx [2014-08-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-06] (AVAST Software)
S2 AVP15.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 nmservice; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [647216 2009-07-07] (Cisco Systems, Inc.)
S4 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S4 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
S4 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-06] (AVAST Software)
R1 AswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-08-06] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-06] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-08-06] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-06] ()
R3 Cam5607; C:\Windows\System32\Drivers\BisonC07.sys [1461032 2008-12-04] (Bison Electronics. Inc. )
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41584 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-04-29] (GFI Software)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135264 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [111200 2014-04-18] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [34400 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [643168 2014-04-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [24672 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145888 2014-03-26] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 PhilCap; C:\Windows\System32\DRIVERS\PhilCap.sys [908896 2007-07-31] (NXP Semiconductors Germany GmbH)
R2 pnarp; C:\Windows\System32\DRIVERS\pnarp.sys [26672 2009-07-07] (Cisco Systems, Inc.)
R2 purendis; C:\Windows\System32\DRIVERS\purendis.sys [27696 2009-07-07] (Cisco Systems, Inc.)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579840 2009-09-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [551424 2009-09-02] (eMPIA Technology, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Reinhold\AppData\Local\Temp\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 21:02 - 2014-10-08 21:02 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (6).exe
2014-10-08 20:18 - 2014-10-08 20:18 - 00035647 _____ () C:\Users\Reinhold\Downloads\FRST last.txt
2014-10-08 20:15 - 2014-10-08 20:15 - 01101312 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST (2).exe
2014-10-08 20:13 - 2014-10-08 20:13 - 00000823 _____ () C:\Users\Reinhold\Desktop\checkup.txt
2014-10-08 20:09 - 2014-10-08 20:08 - 00854417 _____ () C:\Users\Reinhold\Desktop\SecurityCheck.exe
2014-10-08 20:08 - 2014-10-08 20:08 - 00854417 _____ () C:\Users\Reinhold\Downloads\SecurityCheck.exe
2014-10-08 18:00 - 2014-10-08 18:00 - 02347384 _____ (ESET) C:\Users\Reinhold\Downloads\esetsmartinstaller_deu.exe
2014-10-08 10:59 - 2014-10-08 10:59 - 00034800 _____ () C:\Users\Reinhold\Desktop\FRST neu.txt
2014-10-08 10:55 - 2014-10-08 10:55 - 01101312 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST (1).exe
2014-10-08 10:54 - 2014-10-08 10:54 - 00001313 _____ () C:\Users\Reinhold\Desktop\JRT.txt
2014-10-08 10:54 - 2014-10-08 10:54 - 00001313 _____ () C:\Users\Reinhold\Desktop\JRT neu.txt
2014-10-08 10:51 - 2014-10-08 10:51 - 01705141 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT (1).exe
2014-10-08 10:51 - 2014-10-08 10:51 - 00000000 ____D () C:\Windows\ERUNT
2014-10-06 12:40 - 2014-10-06 12:40 - 00001784 _____ () C:\Users\Reinhold\Desktop\AdwCleaner[S2].txt
2014-10-06 12:32 - 2014-10-06 12:32 - 01375089 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.311.exe
2014-10-06 12:27 - 2014-10-06 12:30 - 00001538 _____ () C:\Users\Reinhold\Desktop\Maleware.txt
2014-10-06 10:22 - 2014-10-06 10:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (5).exe
2014-10-04 10:48 - 2014-10-04 10:48 - 00015946 _____ () C:\ComboFix.txt
2014-10-04 10:35 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-04 10:29 - 2014-10-04 10:48 - 00000000 ____D () C:\Qoobox
2014-10-04 10:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-04 10:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-04 10:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-04 10:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-04 10:28 - 2014-10-04 10:28 - 05582981 ____R (Swearware) C:\Users\Reinhold\Downloads\ComboFix.exe
2014-10-02 12:22 - 2014-10-02 12:22 - 00033559 _____ () C:\Users\Reinhold\Desktop\FRST.txt
2014-10-02 12:22 - 2014-10-02 12:22 - 00027227 _____ () C:\Users\Reinhold\Desktop\Addition.txt
2014-10-02 11:51 - 2014-10-02 12:21 - 00027227 _____ () C:\Users\Reinhold\Downloads\Addition.txt
2014-10-02 11:49 - 2014-10-09 17:15 - 00020979 _____ () C:\Users\Reinhold\Downloads\FRST.txt
2014-10-02 11:48 - 2014-10-09 17:15 - 00000000 ____D () C:\FRST
2014-10-02 11:48 - 2014-10-02 11:48 - 01100288 _____ (Farbar) C:\Users\Reinhold\Downloads\FRST.exe
2014-10-01 20:59 - 2014-10-09 15:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-01 20:58 - 2014-10-08 21:03 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-01 20:58 - 2014-10-08 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-10-08 21:03 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-10-01 20:58 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-01 20:58 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-01 20:57 - 2014-10-01 20:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (4).exe
2014-09-30 22:09 - 2014-09-30 22:09 - 00000988 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-09-30 22:09 - 2014-09-30 22:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-09-30 22:06 - 2014-09-30 22:06 - 00000000 ____D () C:\Program Files\Kaspersky Lab
2014-09-30 22:01 - 2014-04-18 16:35 - 00643168 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-09-30 22:01 - 2014-04-18 16:35 - 00111200 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-09-30 22:01 - 2014-04-10 17:25 - 00034400 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-09-30 21:40 - 2014-09-30 21:44 - 175400560 _____ () C:\Users\Reinhold\Downloads\kav15.0.0.463de-de.exe
2014-09-30 21:22 - 2014-09-30 21:32 - 173308623 _____ () C:\Users\Reinhold\Downloads\Nicht bestätigt 241105.crdownload
2014-09-30 21:19 - 2014-09-30 21:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (3).exe
2014-09-30 16:13 - 2014-09-30 16:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-09-30 16:07 - 2014-09-30 16:07 - 01612937 _____ (Thisisu) C:\Users\Reinhold\Downloads\JRT.exe
2014-09-30 16:00 - 2014-09-30 16:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-09-30 15:56 - 2014-09-30 15:56 - 327716405 _____ () C:\Windows\MEMORY.DMP
2014-09-30 15:56 - 2014-09-30 15:56 - 00143616 _____ () C:\Windows\Minidump\Mini093014-01.dmp
2014-09-30 15:52 - 2014-09-30 15:53 - 00259584 _____ (OldTimer Tools) C:\Users\Reinhold\Downloads\OTH.scr
2014-09-30 15:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-09-30 15:28 - 2014-09-30 15:28 - 01373475 _____ () C:\Users\Reinhold\Downloads\AdwCleaner_3.310.exe
2014-09-30 15:10 - 2014-09-30 15:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reinhold\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-30 14:20 - 2014-09-30 14:20 - 00000000 ____D () C:\ProgramData\Panda Security
2014-09-30 14:17 - 2014-09-30 14:16 - 03690256 _____ (Piriform Ltd) C:\Users\Reinhold\Downloads\CCleaner [1].exe
2014-09-30 14:15 - 2014-09-30 14:16 - 00786224 _____ ( ) C:\Users\Reinhold\Downloads\CCleaner.exe
2014-09-29 19:07 - 2014-09-29 19:11 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de (1).exe
2014-09-29 18:47 - 2014-09-29 18:52 - 140910890 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.0_Win_x86_install_en-US.exe
2014-09-29 18:41 - 2014-09-29 18:46 - 152249762 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2014-09-29 18:15 - 2014-09-29 19:31 - 00000000 ____D () C:\Program Files\CHIP Updater
2014-09-29 18:15 - 2014-09-29 18:16 - 00000000 ____D () C:\Users\Reinhold\AppData\Local\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Abelssoft
2014-09-29 18:15 - 2014-09-29 18:15 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-29 18:13 - 2014-09-29 18:14 - 01101648 _____ () C:\Users\Reinhold\Downloads\OpenOffice - CHIP-Installer.exe
2014-09-29 17:07 - 2014-09-29 17:08 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Reinhold\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-09-29 16:36 - 2014-09-29 16:36 - 00020261 _____ () C:\Users\Reinhold\Desktop\Spickaaaa.odt
2014-09-29 10:56 - 2014-09-29 10:59 - 164858324 _____ () C:\Users\Reinhold\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2014-09-24 14:02 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-22 13:24 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Desktop\Physiologie.zip
2014-09-22 13:08 - 2014-09-22 13:13 - 279191722 _____ () C:\Users\Reinhold\Downloads\Physiologie.zip
2014-09-17 14:43 - 2014-09-17 14:43 - 01148755 _____ () C:\Users\Reinhold\Downloads\elma.exe
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElastoMania111
2014-09-17 14:43 - 2014-09-17 14:43 - 00000000 ____D () C:\Program Files\ElastoMania111
2014-09-12 12:21 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 12:21 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 12:21 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 12:21 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 12:21 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 12:21 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 12:21 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 12:20 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 12:20 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 12:20 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 12:20 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 19:59 - 2014-09-10 19:59 - 00000000 ____D () C:\ProgramData\Oracle

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-09 17:15 - 2013-06-08 11:55 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-09 17:15 - 2008-12-16 07:12 - 00000438 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
2014-10-09 17:14 - 2013-06-08 14:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-09 17:13 - 2008-12-15 06:47 - 00184336 _____ () C:\ProgramData\nvModes.001
2014-10-09 15:31 - 2009-11-14 00:51 - 00008268 _____ () C:\Users\Reinhold\AppData\Local\d3d9caps.dat
2014-10-09 15:31 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-09 15:31 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-08 21:13 - 2009-03-08 14:08 - 01913653 _____ () C:\Windows\WindowsUpdate.log
2014-10-08 21:08 - 2014-02-15 17:02 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\TS3Client
2014-10-08 21:03 - 2011-09-03 20:32 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-10-08 20:52 - 2013-04-29 16:37 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-08 20:51 - 2013-06-08 11:55 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-08 20:50 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-08 20:46 - 2006-11-02 15:01 - 00032532 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-08 20:32 - 2008-12-15 06:37 - 00184336 _____ () C:\ProgramData\nvModes.dat
2014-10-08 20:22 - 2013-05-23 18:54 - 00259704 _____ () C:\Windows\PFRO.log
2014-10-06 12:34 - 2014-02-18 21:56 - 00000000 ____D () C:\AdwCleaner
2014-10-04 10:46 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-10-04 10:45 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-09-30 22:08 - 2009-03-08 14:13 - 00000000 ____D () C:\Users\Reinhold
2014-09-30 21:48 - 2013-05-24 16:27 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-30 16:09 - 2014-01-20 22:13 - 00000000 ____D () C:\Program Files\PDFCreator
2014-09-30 16:09 - 2013-06-08 11:57 - 00001923 _____ () C:\Users\Reinhold\Desktop\Google Chrome.lnk
2014-09-30 15:56 - 2011-03-06 14:25 - 00000000 ____D () C:\Windows\Minidump
2014-09-30 15:13 - 2014-02-18 22:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-30 15:13 - 2013-01-29 15:01 - 00000000 ____D () C:\Users\Reinhold\AppData\Roaming\Malwarebytes
2014-09-30 14:31 - 2006-11-02 14:47 - 00401584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-30 14:30 - 2013-05-24 14:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-30 14:30 - 2012-05-07 19:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-29 18:44 - 2009-03-08 14:13 - 00113040 _____ () C:\Users\Reinhold\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-29 16:46 - 2014-01-22 14:20 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-09-29 16:36 - 2014-04-14 19:46 - 00000000 ____D () C:\Users\Reinhold\Desktop\Studium
2014-09-25 10:50 - 2011-05-16 15:01 - 00005454 _____ () C:\Users\Reinhold\AppData\Roaming\wklnhst.dat
2014-09-24 21:41 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-09-24 14:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-24 13:56 - 2013-06-08 14:31 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 13:56 - 2013-06-08 14:31 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-21 20:26 - 2013-05-23 18:37 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-15 09:06 - 2009-10-21 19:46 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-12 12:59 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-12 12:19 - 2013-07-12 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 12:07 - 2011-12-30 22:07 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-09-12 12:07 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-12 12:01 - 2006-11-02 12:33 - 01543880 _____ () C:\Windows\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Users\Reinhold\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-08 20:58

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Farbar Service Scanner Version: 21-07-2014
Ran by Reinhold (administrator) on 09-10-2014 at 17:20:47
Running from "C:\Users\Reinhold\Downloads"
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcsvc.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\system32\ipnathlp.dll => File is digitally signed
C:\Windows\system32\iphlpsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed


**** End of log ****

07.10.2014, 10:10	#10
schrauber /// the machine /// TB-Ausbilder	PC hängt, Internet funktioniert nicht mehr....Astromenda? Dann noch den Rest bitte __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

PC hängt, Internet funktioniert nicht mehr....Astromenda?

Plagegeister aller Art und deren Bekämpfung: PC hängt, Internet funktioniert nicht mehr....Astromenda?