Welche "win32" Dateien?

Ich kann Dir nicht helfen, wenn Du mir nicht ausreichend Informationen gibst.

ich habe mal ein paar Bilder eingefügt.
Vlt hilft das, ich kann es schlecht erklären

Ja, dann ist halt E: infiziert. Einfach mal formatieren.

kann ich die einfach formatieren obwohl es eine Recovery Portition ist

Du kannst auch die beiden Dateien löschen, mir ist es egal, was Du machst.

meine Frage war! Kann ich es formatieren? Nicht dass danach das ganze System zusammenstürzt. Nicht jeder ist ein Fachmann wie du.......

Bevor der Virus drauf war, war diese Festplatte E: voll mit Orndern, die auch ganz normal aufgingen...jetzt sind nur noch 2 komische Dateien und der Rest ist verschwunden, obwohl die Festplatte fast voll angezeigt wird.
Das komische ist ja auch das ich eine Sd Karte reinschiebe und das gleiche auch da auftritt, sprich ich kann den Ordnder mit Fotos/Video was auch immer nicht öffnen, da ich sofort eine Fehlermeldung bekomme. Erkläre mir doch einfach was die Formatierung bringt? Ist der Wurm dann weg usw????

Ist der Wurm dann weg usw????

Das Problem bezogen auf E:, ja.

Was passiert jetzt genau, wenn Du diese SD Karte reinsteckst? Screenshot.

wenn ich ne sd Karte reinstecke und auf die Karte draufklicke, dann ist es wie auf der E: Partition.
Sd Karte voll, will den Ordner mit den Fotos öffnen und bekomme ne Fehlermeldung ''keine zulässige Win32 Anwendung'', sprich wie auf E:

Nochmal kurz für mich: das heisst ich kann die Daten auf E nicht mehr retten?

das heisst ich kann die Daten auf E nicht mehr retten?

Da sind ja nur zwei Dateien drauf?

Nein es waren mehr dateien drauf...z.b Windows ordner, die sind bloss nachdem virusbefall nicht mehr sichtbar.
Wenn ich im Explorer E:windows eingebe komme ich aber auf diesen pfad...ich füge mal ein Bild zu

genau so auch auf der Sd Karte : gebe ich G:/DCIM(Ordner mit Fotos) ein, komme ich direkt auf die Bilder, die ich da drauf habe....ich verstehe es auch nicht??

Avira deaktivieren währenddessen.

Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.

• Klicke auf Wählen Sie eine
• Kopiere nun folgendes in die Suchleiste
  

  E:\keybd.exe
           

• und klicke auf Öffnen.
• Klicke auf Scannen!.
• Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen
  

  Diese Datei wurde bereits von VirusTotal analysiert...

  klicke auf Neu analysieren.
• Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
• Kopiere den Link aus deiner Adresszeile und poste ihn hier.

https://www.virustotal.com/de/file/aab685f5dfbb76d4b819dc38b10acfb2d9ecffdf84cdbea57476caae278ca576/analysis/1418377095/

Die Datei ist eindeutig infiziert. Lösche beide Dateien umgehend.

Dann:



Bitte starte FRST erneut, setze den Haken auch bei Addition.txt und drücke auf Scan.

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 12-12-2014 21:06:16
Running from C:\Users\Andrücha\Desktop
Loaded Profile: Andrücha (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Skype Technologies) C:\Program Files\Skype\Updater\Updater.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [7611640 2014-12-11] (Avira Operations GmbH & Co. KG)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-12-11]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
S2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-12 21:06 - 2014-12-12 21:06 - 00011632 _____ () C:\Users\Andrücha\Desktop\FRST.txt
2014-12-12 10:49 - 2014-12-12 10:49 - 04036200 _____ (Piriform Ltd) C:\Users\Andrücha\Downloads\ccsetup500_slim.exe
2014-12-12 10:49 - 2014-12-12 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-12 10:49 - 2014-12-12 10:49 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-10 15:48 - 2014-12-11 19:25 - 00000996 _____ () C:\Users\Public\Desktop\Avira System Speedup.lnk
2014-12-09 19:05 - 2014-12-09 19:06 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-12-09 09:08 - 2014-12-09 09:08 - 00000000 ____D () C:\Program Files\ESET
2014-12-09 09:02 - 2014-12-09 09:02 - 02347384 _____ (ESET) C:\Users\Andrücha\Downloads\esetsmartinstaller_deu.exe
2014-12-08 10:11 - 2014-12-08 10:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-12-08 09:48 - 2014-12-09 09:07 - 00026927 _____ () C:\Users\Andrücha\Downloads\Addition.txt
2014-12-08 09:47 - 2014-12-12 21:06 - 00000000 ____D () C:\FRST
2014-12-08 09:47 - 2014-12-09 09:07 - 00020273 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Desktop\FRST.exe
2014-12-08 09:34 - 2014-12-11 19:25 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-11 19:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-08 20:22 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-08 20:20 - 00000220 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-08 20:56 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:33 - 2014-12-12 20:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-12-10 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-12 21:04 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-12 21:04 - 2013-04-18 20:07 - 00000440 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-12 21:04 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-12 21:04 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-12 21:04 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-12 21:04 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-12 21:04 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-12 20:54 - 2011-10-06 13:17 - 01530254 _____ () C:\Windows\WindowsUpdate.log
2014-12-12 20:50 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-12-12 20:50 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-12-12 11:06 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-12 11:06 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-12 10:52 - 2014-09-10 16:34 - 00000000 ____D () C:\Windows\Minidump
2014-12-12 10:52 - 2011-10-06 14:10 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Skype
2014-12-12 10:52 - 2008-08-01 07:39 - 00000000 ____D () C:\Windows\panther
2014-12-11 21:05 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 21:02 - 2006-11-02 11:24 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-12-11 19:18 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-10 19:22 - 2014-09-18 17:57 - 00001004 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-10 19:22 - 2014-08-16 16:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-10 19:22 - 2013-11-03 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-10 19:22 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-10 19:15 - 2006-11-02 13:47 - 00299112 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-10 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-10 15:48 - 2011-10-06 14:05 - 00071144 _____ () C:\Users\Andrücha\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-10 15:45 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-08 10:11 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-24 14:04 - 2011-10-07 13:02 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru

Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-12 20:57

==================== End Of Log ============================
         

--- --- ---



FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 12-12-2014 21:11:57
Running from C:\Users\Andrücha\Desktop
Loaded Profile: Andrücha (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [7611640 2014-12-11] (Avira Operations GmbH & Co. KG)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-12-11]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-12 21:06 - 2014-12-12 21:11 - 00011765 _____ () C:\Users\Andrücha\Desktop\FRST.txt
2014-12-12 10:49 - 2014-12-12 10:49 - 04036200 _____ (Piriform Ltd) C:\Users\Andrücha\Downloads\ccsetup500_slim.exe
2014-12-12 10:49 - 2014-12-12 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-12 10:49 - 2014-12-12 10:49 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-10 15:48 - 2014-12-11 19:25 - 00000996 _____ () C:\Users\Public\Desktop\Avira System Speedup.lnk
2014-12-09 19:05 - 2014-12-09 19:06 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-12-09 09:08 - 2014-12-09 09:08 - 00000000 ____D () C:\Program Files\ESET
2014-12-09 09:02 - 2014-12-09 09:02 - 02347384 _____ (ESET) C:\Users\Andrücha\Downloads\esetsmartinstaller_deu.exe
2014-12-08 10:11 - 2014-12-08 10:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-12-08 09:48 - 2014-12-09 09:07 - 00026927 _____ () C:\Users\Andrücha\Downloads\Addition.txt
2014-12-08 09:47 - 2014-12-12 21:12 - 00000000 ____D () C:\FRST
2014-12-08 09:47 - 2014-12-09 09:07 - 00020273 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Desktop\FRST.exe
2014-12-08 09:34 - 2014-12-11 19:25 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-11 19:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-08 20:22 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-08 20:20 - 00000220 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-08 20:56 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:33 - 2014-12-12 20:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-12-10 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-12 21:11 - 2011-10-06 13:17 - 01540972 _____ () C:\Windows\WindowsUpdate.log
2014-12-12 21:04 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-12 21:04 - 2013-04-18 20:07 - 00000440 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-12 21:04 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-12 21:04 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-12 21:04 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-12 21:04 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-12 21:04 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-12 20:50 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-12-12 20:50 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-12-12 11:06 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-12 11:06 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-12 10:52 - 2014-09-10 16:34 - 00000000 ____D () C:\Windows\Minidump
2014-12-12 10:52 - 2011-10-06 14:10 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Skype
2014-12-12 10:52 - 2008-08-01 07:39 - 00000000 ____D () C:\Windows\panther
2014-12-11 21:05 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 21:02 - 2006-11-02 11:24 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-12-11 19:18 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-10 19:22 - 2014-09-18 17:57 - 00001004 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-10 19:22 - 2014-08-16 16:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-10 19:22 - 2013-11-03 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-10 19:22 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-10 19:15 - 2006-11-02 13:47 - 00299112 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-10 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-10 15:48 - 2011-10-06 14:05 - 00071144 _____ () C:\Users\Andrücha\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-10 15:45 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-08 10:11 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-24 14:04 - 2011-10-07 13:02 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru

Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-12 21:10

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-12 21:12:36
Running from C:\Users\Andrücha\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.115.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3975 - APN, LLC)
Avira System Speedup 1.5 (HKLM\...\Avira System Speedup_is1) (Version: 1.5 - 2000 - 2014 Avira Operations GmbH & Co. KG)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
CleanUp! (HKLM\...\CleanUp!) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
ESU for Microsoft Vista (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - FreeCodecPack)
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Hewlett-Packard Active Check for Health Check (Version: 1.1.15.2 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.63.2 - HP) Hidden
HP Customer Experience Enhancements (HKLM\...\{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Help and Support (HKLM\...\{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}) (Version: 2.0.9.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.6204 - HP)
HP Quick Launch Buttons 6.40 D1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 D1 - Hewlett-Packard)
HP QuickPlay 3.7 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - Hewlett-Packard)
HP QuickTouch 1.00 D2 (HKLM\...\{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}) (Version: 1.0.9 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{f32502b5-5b64-4882-bf61-77f23edcac4f}) (Version: 2.1.3359.2635 - Hewlett-Packard)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP User Guides 0103 (HKLM\...\{B8169E45-8E23-430B-91D1-EC64540C8ED0}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{340F521E-3576-4E1A-B75C-EB0ACF751379}) (Version: 3.00 J1 - Hewlett-Packard)
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Html5 geolocation provider (HKLM\...\{12644DC5-2271-442B-816F-8CFFD3DDDF32}) (Version: 3.5.4.872 - AlterGeo)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6017.13 - IDT)
Java(TM) 6 Update 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160060}) (Version: 1.6.0.60 - Sun Microsystems, Inc.)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.16.01 - JMicron Technology Corp.)
LightScribe System Software  1.12.33.2 (HKLM\...\{582287DA-0806-4AC0-BF19-C15E3A466034}) (Version: 1.12.33.2 - LightScribe)
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.43 - WildTangent)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Opera 12.13 (HKLM\...\Opera 12.13.1734) (Version: 12.13.1734 - Opera Software ASA)
Power MP3 WMA Converter 2006, (ver 3.42) (HKLM\...\Power MP3 WMA Converter_is1) (Version: 3.42 - CooolSoft, Inc.)
ProtectSmart Hard Drive Protection (HKLM\...\{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}) (Version: 3.10 A7 - Hewlett-Packard)
QuickPlay SlingPlayer 0.4.6 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.2.4.0 - Synaptics)
TomTom HOME 2.8.2.2264 (HKLM\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Html5 geolocation provider (HKLM\...\{45BECC2D-582C-472D-A754-E2AD10706397}) (Version: 3.5.2.858 - AlterGeo)
Update for Html5 geolocation provider (HKLM\...\{D492942E-9368-48D9-BB8B-68E8E4CE2D43}) (Version: 3.7.6.911 - AlterGeo)
Update for Office 2007 (KB934528) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{2B939677-2FFD-48F6-9075-7BF48CB87C80}) (Version:  - )
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\VKontakte) (Version:  - Andrew Rogozov)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

==================== Restore Points  =========================

09-02-2014 18:20:47 PC Performer So, Feb 09, 14  19:20
14-02-2014 13:54:13 Windows Update
17-03-2014 19:06:00 Installed Adobe Reader XI.
23-03-2014 12:39:27 Windows Update
11-04-2014 12:37:07 Windows Update
14-05-2014 19:19:36 Windows Update
14-06-2014 22:46:50 Windows Update
10-07-2014 18:02:30 Windows Update
16-08-2014 16:00:04 Windows Update
31-08-2014 10:05:45 Removed Facebook Video Calling 3.1.0.521
10-09-2014 15:56:36 Windows Update
17-11-2014 19:16:22 Windows Update
19-11-2014 13:54:53 Windows Update
07-12-2014 20:25:39 Avira System Speedup(1.3.1.9970)
07-12-2014 20:28:50 Windows Update
09-12-2014 07:45:13 Windows Update
09-12-2014 18:13:17 Windows Update
10-12-2014 14:47:31 Avira System Speedup 1.5
11-12-2014 18:24:22 Avira System Speedup 1.5
11-12-2014 20:02:03 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1F286ADE-039E-474D-8EF2-83C14C3CFA0F} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15] (Hewlett-Packard)
Task: {324F6E3C-D83B-431F-BD8A-D240B2CAB216} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {A2F00D8F-F77C-493A-987E-FE33BF780764} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-12-11] (Avira Operations GmbH & Co. KG)
Task: {C163C141-F757-4156-8BE3-AEF8AEE4217C} - System32\Tasks\{6F3DAAC4-5DFC-4603-933B-572D9826C258} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/ru/abandoninstall?page=tsProgressBar
Task: {DD084485-B96E-419D-8561-0E4DE073547E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E5724EA0-F9B1-44B9-8EE9-8C85044BF062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated)
Task: {FAD4286E-AA44-4B22-93DC-0231985E42AE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {FDC4795E-5087-417B-941F-CD78479F4026} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrьcha.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5FD033D5-882A-4E63-8500-180E11B1449B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2008-07-31 22:31 - 2008-06-25 21:36 - 00292216 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-07-31 22:31 - 2008-06-25 21:36 - 00259480 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00116080 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2008-07-31 23:35 - 2008-04-26 00:15 - 00361808 _____ () C:\Windows\SMINST\BLService.exe
2008-07-31 23:35 - 2007-11-15 00:46 - 00126976 _____ () C:\Windows\SMINST\STWmiM.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk => C:\Windows\pss\BTTray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andrücha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AlterGeoUpdater => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
MSCONFIG\startupreg: Avira Systray => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpWirelessAssistant => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
MSCONFIG\startupreg: iLivid => "C:\Users\Andrücha\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MAgent => C:\Program Files\Mail.Ru\Agent\magent.exe -LM
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: OnScreenDisplay => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMERunner.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

========================= Accounts: ==========================

Administrator (S-1-5-21-2119122295-1896836890-182237168-500 - Administrator - Disabled)
Andrücha (S-1-5-21-2119122295-1896836890-182237168-1000 - Administrator - Enabled) => C:\Users\Andrücha
Gast (S-1-5-21-2119122295-1896836890-182237168-501 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/12/2014 09:11:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 344
Anfangszeit: 01d016474a0e92a3
Zeitpunkt der Beendigung: 140

Error: (12/12/2014 09:05:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/12/2014 08:58:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: f88
Anfangszeit: 01d016455089c933
Zeitpunkt der Beendigung: 10

Error: (12/12/2014 08:51:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/12/2014 10:57:36 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CCleaner.exe, Version 5.0.0.5050 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 15fc
Anfangszeit: 01d015f1c67e7c62
Zeitpunkt der Beendigung: 12

Error: (12/12/2014 10:32:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/11/2014 09:04:54 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (12/11/2014 09:04:54 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (12/11/2014 07:13:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/10/2014 07:22:11 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.


System errors:
=============
Error: (12/12/2014 09:05:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/12/2014 09:04:56 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/12/2014 09:04:56 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/12/2014 09:04:19 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (12/12/2014 09:04:16 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 12.12.2014 um 21:02:27 unerwartet heruntergefahren.

Error: (12/12/2014 08:51:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/12/2014 08:51:28 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.

Error: (12/12/2014 08:51:23 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/12/2014 08:51:23 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/12/2014 08:50:43 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-12-12 21:12:18.282
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:18.176
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:18.113
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:18.040
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:17.846
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:17.721
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:17.643
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:17.569
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:06.770
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 21:12:06.662
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 50%
Total physical RAM: 3068.03 MB
Available physical RAM: 1520.23 MB
Total Pagefile: 6335.11 MB
Available Pagefile: 4662.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1925.62 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:289.06 GB) (Free:209.59 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:298.09 GB) (Free:283.14 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:9.03 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 133E133E)
Partition 1: (Active) - (Size=289.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 9DC051CF)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Hast Du beide Dateien gelöscht?