Hallo,

nachdem ich auf www.myvideo.de mir mehrere Video´s angeschaut habe bemerkte ich nach dem letzten klick ungewöhnliche Aktivitäten auf meinem Rechner. Habe dann sofort die Internetverbindung getrennt und wollte den Virenscanner (Avira) laufen lassen. Es kam die Fehlermeldung "Program not found".

Fast zeitgleich konnte ich dann meinen Desktop acht mal auf meinem Bildschirm sehen. Alles war also mini und sehr sehr unscharf.

Nun erstmal alle wichtigen Daten auf externe Festplatte gezogen. Vielleicht kann man diese später noch retten.

Habe dann von "sauberen" Rechner verschiedene Programme downgeloadet und per E-mail verschickt. Anschliessend dann vom infizierten Rechner die gesendeten E-Mails aufgerufen und Dateien installiert.

1. Avira (Scan funktionierte nicht)
2. Winzip Malware Protector (weit über 100 Funde, ich glaube es waren 139 Stück,
hauptsächlich Adware und Malware)
gefundene Dateien wurden dann manuell gelöscht incl. Registry
3. Malwarebytes Antimalware (weitere Funde)
gefundene Dateien wurden dann manuell gelöscht incl. Registry
4. rkitt
5. iobituninstaller41
6. revosetup95

Später stellte ich dann noch fest, dass beim Starten von Google Chrome meine Startseite verändert war. Diese neue Seite wurde jedoch nicht gestartet, da diese als unsicher erkannt wurde.Bei jedem Neustart von Google Chrome immer wieder diese Startseite. Erst als ich einen unsichtbaren und geschützten Ordner, welchen ich mit einem der o.a. Programme gefunden hatte, gelöscht wurde war dieses Problem behoben.

Anschließend wurde bei einem erneuten Scan 12 "Spyware-Dateien gefunden", welche dann ebenfalls manuell gelöscht wurden.

Nun wird meines Erachtens nichts mehr gefunden. Das Problem mit der Darstellung des Desktops besteht immer noch. Das bedeutet alles was man normal nur einmal auf dem Bildschirm sieht, ist bei mir acht mal zu sehen. Teilweise überlappen sich die Ansichten, daher auch nur eingeschränkte Nutzungsmöglichkeiten. Neuinstallation Grafikkartentreiber hat nichts gebracht. Spiegelung ist schon beim starten des PC´s (bevor sich Windows-Vista öffnet) zu erkennen.

Und nun meine Fragen:

1. Ist mein PC noch zu retten?
2. Wie sieht es mit der Rettung meiner Daten auf dem PC und auf der "vielleicht verseuchten" externen Festplatte aus?
3. Habe ich etwa auch noch ein Problem mit meiner Grafikkarte?
4. Wie kann ich den Fehler mit dem gespiegelten Bildschirm eingrenzen?

Vielen Dank schonmal für die Beantwortung meiner Fragen und Eure Hilfe.

Gruß
j. newton

Bin nun die Anleitung für Hilfesuchende durchgegangen:

1. Defogger:
Da ich die einzelnen Buttons so gut wie nicht lesen kann kann ich nicht gerantieren, dass ich nicht den Button "Re-enable" gedrückt habe. Hier das Ergebnis aus der defogger_disable log:

defogger_enable by jpshortstuff (23.02.10.1)
Log created at 15:18 on 27/12/2014 (Administrator Jürgen)

Parsing file...


-=E.O.F=-

2.a. FRST.txt:
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014
Ran by Administrator Jürgen (administrator) on LAPTOPJN on 27-12-2014 14:13:08
Running from C:\Users\Administrator Jürgen\Desktop
Loaded Profile: Administrator Jürgen (Available profiles: Administrator Jürgen & Sabrina)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(O2Micro International) C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
(United Internet AG) C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe
() C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Nico Mak Computing) C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe
(Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [20880 2011-06-24] ()
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-12-22]
FF HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2014-06-09]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-06]
CHR Extension: (Google Drive) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03]
CHR Extension: (YouTube) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-21]
CHR Extension: (Google-Suche) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-21]
CHR Extension: (Google Wallet) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (Google Mail) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-21]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR StartMenuInternet: Google Chrome - Chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [217088 2010-10-25] (Teruten) [File not signed]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit)
R2 o2flash; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [65536 2007-02-12] (O2Micro International) [File not signed]
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
R2 SmartSurferManager; C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [132560 2007-12-18] (United Internet AG)
S2 IHProtect Service; C:\Program Files\STab\ProtectService.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-12-22] () [File not signed]
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-27] (Malwarebytes Corporation)
S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS32_100507.sys [22328 2010-05-10] (Your Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation)
S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS32_100507.sys [16696 2010-05-10] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S0 navgcswl; System32\drivers\boyygxy.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-27 14:13 - 2014-12-27 14:13 - 00009796 _____ () C:\Users\Administrator Jürgen\Desktop\FRST.txt
2014-12-27 14:12 - 2014-12-27 14:13 - 00000000 ____D () C:\FRST
2014-12-27 14:11 - 2014-12-27 14:11 - 01114624 _____ (Farbar) C:\Users\Administrator Jürgen\Desktop\FRST.exe
2014-12-27 14:09 - 2014-12-27 14:09 - 00000274 _____ () C:\Users\Administrator Jürgen\Desktop\defogger_enable.log
2014-12-27 14:08 - 2014-12-27 14:09 - 00000476 _____ () C:\Users\Administrator Jürgen\Desktop\defogger_disable.log
2014-12-27 14:08 - 2014-12-27 14:08 - 00050477 _____ () C:\Users\Administrator Jürgen\Desktop\Defogger.exe
2014-12-27 13:37 - 2014-12-27 13:37 - 00000986 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing
2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-12-27 13:37 - 2014-12-27 13:37 - 00000000 ____D () C:\Program Files\WinZip Malware Protector
2014-12-27 13:37 - 2013-03-15 17:01 - 00016384 _____ () C:\Windows\system32\wsusnative32.exe
2014-12-27 12:19 - 2014-12-27 12:19 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-27 12:19 - 2014-12-27 12:19 - 00000899 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-27 12:19 - 2014-12-27 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-27 12:19 - 2014-12-27 12:19 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-27 12:19 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-27 12:19 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-27 12:19 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 16:58 - 2014-12-07 16:58 - 00237152 _____ () C:\Windows\Minidump\Mini120714-03.dmp
2014-12-07 15:51 - 2014-12-07 15:51 - 00254616 _____ () C:\Windows\Minidump\Mini120714-02.dmp
2014-12-07 13:23 - 2014-12-07 13:23 - 00250624 _____ () C:\Windows\Minidump\Mini120714-01.dmp
2014-12-05 22:55 - 2014-12-05 22:55 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2014-12-05 22:54 - 2014-12-06 22:25 - 00318034 _____ () C:\Windows\PFRO.log
2014-12-05 22:52 - 2014-07-02 20:42 - 02556360 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-12-05 22:52 - 2014-07-02 20:42 - 00670552 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-12-05 22:52 - 2014-07-02 20:42 - 00062936 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-12-05 22:52 - 2014-07-02 06:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-12-05 22:51 - 2014-12-05 22:51 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-05 22:51 - 2014-07-02 21:54 - 00061728 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 24198088 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 16122344 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 15296456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 14498552 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dum.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 11283344 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 11222048 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 10681176 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-12-05 22:50 - 2014-07-02 21:54 - 03988952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 02814656 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 01054552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3234052.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 00907552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3234052.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 00021215 _____ () C:\Windows\system32\nvinfo.pb
2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setupact.log
2014-12-05 22:48 - 2014-12-05 22:52 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-05 22:47 - 2014-12-05 22:47 - 00000000 ____D () C:\NVIDIA
2014-12-05 20:05 - 2014-12-05 20:05 - 00000344 _____ () C:\Windows\Tasks\ReimageUpdater.job
2014-12-05 20:04 - 2014-12-05 20:05 - 00000156 _____ () C:\Windows\Reimage.ini
2014-12-05 19:53 - 2014-12-05 19:53 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2015
2014-12-05 19:52 - 2014-12-05 20:00 - 00000000 ____D () C:\ProgramData\MFAData
2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\MFAData
2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2014
2014-12-05 19:40 - 2014-12-05 19:40 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ___HD () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ____D () C:\Program Files\Dropbox
2014-12-05 19:34 - 2014-12-05 19:35 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox
2014-12-05 19:12 - 2014-12-06 22:25 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-12-05 16:02 - 2014-12-05 16:02 - 00001057 _____ () C:\Users\Administrator Jürgen\Desktop\Revo Uninstaller.lnk
2014-12-05 16:02 - 2014-12-05 16:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Apple Computer
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Program Files\Common Files\IObit
2014-12-05 15:37 - 2014-12-27 12:16 - 00000000 ____D () C:\ProgramData\ProductData
2014-12-05 15:37 - 2014-12-05 19:40 - 00000000 ____D () C:\Program Files\IObit
2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\IObit
2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\IObit
2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\ProductData
2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\IObit
2014-12-05 11:38 - 2014-12-05 11:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-05 11:37 - 2014-12-27 12:18 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Administrator Jürgen\Downloads\mbam-setup-2.0.4.1028_CB-DL-Manager [1].exe
2014-12-03 21:23 - 2014-12-03 21:23 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\dlg
2014-12-03 21:15 - 2014-12-05 11:59 - 00000000 ____D () C:\ProgramData\SystemMedia
2014-12-03 21:15 - 2014-12-03 21:15 - 00000000 ____D () C:\ProgramData\RfndNSIS
2014-12-03 21:15 - 2014-12-03 21:15 - 00000000 ____D () C:\ProgramData\PicColorData
2014-12-03 21:15 - 2014-12-02 15:23 - 00332584 _____ (Say Media Group LTD) C:\Windows\system32\ColorMedia.dll
2014-12-03 20:54 - 2014-12-06 03:23 - 00000000 ____D () C:\OETemp
2014-12-03 20:46 - 2014-12-03 20:46 - 00000000 ____D () C:\Windows\Registration

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-27 14:10 - 2010-12-19 11:28 - 00001356 _____ () C:\Users\Administrator Jürgen\AppData\Local\d3d9caps.dat
2014-12-27 14:10 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-27 14:10 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-27 14:04 - 2012-12-02 14:26 - 00001180 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000UA.job
2014-12-27 14:04 - 2008-01-21 02:35 - 01650615 _____ () C:\Windows\WindowsUpdate.log
2014-12-27 12:22 - 2006-11-02 11:33 - 01576246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-27 12:17 - 2013-01-23 19:48 - 00000000 ____D () C:\Users\Administrator Jürgen\Desktop\To Do
2014-12-27 12:15 - 2010-12-31 14:26 - 00000000 ____D () C:\SmartSurfer
2014-12-27 12:15 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-25 11:55 - 2010-12-19 13:35 - 00004268 _____ () C:\Windows\bthservsdp.dat
2014-12-25 11:55 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-14 21:38 - 2010-12-31 14:26 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\SmartSurfer
2014-12-07 16:58 - 2011-10-30 13:50 - 00000000 ____D () C:\Windows\Minidump
2014-12-07 16:58 - 2011-10-30 13:49 - 221670998 _____ () C:\Windows\MEMORY.DMP
2014-12-07 16:02 - 2012-12-02 14:26 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000Core.job
2014-12-07 07:52 - 2010-12-19 13:55 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-06 07:48 - 2012-01-21 11:36 - 00002109 _____ () C:\Users\Administrator Jürgen\Desktop\Google Chrome.lnk
2014-12-06 07:48 - 2010-12-19 11:43 - 00000919 _____ () C:\Users\Administrator Jürgen\Desktop\Launch Internet Explorer Browser.lnk
2014-12-06 07:48 - 2010-12-19 11:29 - 00000949 ____H () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-05 22:51 - 2012-02-08 20:30 - 00000000 ____D () C:\Temp
2014-12-05 19:29 - 2010-12-19 21:15 - 00000000 ____D () C:\Windows\PANTHER
2014-12-05 19:29 - 2010-12-19 12:51 - 00000000 ____D () C:\Program Files\PDFCreator
2014-12-05 18:55 - 2014-08-19 07:50 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-05 12:33 - 2006-11-02 13:47 - 00318352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-05 10:54 - 2011-08-05 19:02 - 00002451 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-12-03 21:02 - 2010-12-19 11:29 - 00079472 _____ () C:\Users\Administrator Jürgen\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-03 20:40 - 2006-11-02 11:22 - 38535168 _____ () C:\Windows\system32\config\software_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 37224448 _____ () C:\Windows\system32\config\components_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 19398656 _____ () C:\Windows\system32\config\system_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-12-03 20:39 - 2012-04-22 21:07 - 00000000 ____D () C:\Users\Sabrina
2014-12-03 20:39 - 2012-01-21 11:36 - 00000000 ___HD () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration.tmp
2014-12-03 19:53 - 2010-12-24 08:51 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.001
2014-12-02 22:29 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-12-02 21:24 - 2010-12-24 08:28 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.dat

Some content of TEMP:
====================
C:\Users\Administrator Jürgen\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpj26ntx.dll
C:\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe
C:\Users\Administrator Jürgen\AppData\Local\Temp\{837A08FF-493D-41C3-894C-722680E707FA}-39.0.2171.71_38.0.2125.111_chrome_updater.exe
C:\Users\Sabrina\AppData\Local\Temp\AskSLib.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-27 12:21

==================== End Of Log ============================
         

--- --- ---

2. b. Addition.txt:FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-12-2014
Ran by Administrator Jürgen at 2014-12-27 14:13:43
Running from C:\Users\Administrator Jürgen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
Brother MFL-Pro Suite (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2474 - CDBurnerXP)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender und Unternehmer 11.5.3.5585) (Version: 15.3.14949 - Landesfinanzdirektion Thüringen)
FaceFilter Studio Brother Edition (HKLM\...\{F59205C8-E5FB-43F5-AAB2-16C1760D4F59}) (Version: 1.0 - )
Free YouTube to MP3 Converter version 3.12.38.530 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.38.530 - DVDVideoSoft Ltd.)
Google Chrome (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.670 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
O2Micro Flash Memory Card Reader Driver (x86) (HKLM\...\{0F667427-AD37-4089-A4A2-15AF5E44CACD}) (Version: 3.25 - O2Micro)
PaperPort Image Printer (HKLM\...\{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2410.0 - SAMSUNG Electronics Co., Ltd.)
ScanSoft PaperPort 11 (HKLM\...\{B6C89654-A6A2-477C-873B-724EC1C56407}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.13.2 - Synaptics)
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
WEB.DE SmartSurfer (HKLM\...\WEB.DE SmartSurfer) (Version:  - )
WEB.DE SmartSurfer AutoUpdate 5.2 (HKLM\...\{11CA6E01-3992-4115-AB6E-D325552C166D}) (Version:  - )
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version:  - )
WinZip Malware Protector (HKLM\...\WinZip Malware Protector_is1) (Version: 2.1.1000.14260 - WinZip International LLC)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

06-12-2014 08:16:44 Revo Uninstaller's restore point - Reimage Repair
06-12-2014 22:35:51 Windows-Sicherung
07-12-2014 17:47:57 Geplanter Prüfpunkt
14-12-2014 21:20:12 Windows-Sicherung
14-12-2014 21:55:15 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
14-12-2014 21:59:04 Revo Uninstaller's restore point - SpyHunter 4
14-12-2014 22:04:56 Revo Uninstaller's restore point - WinZip Malware Protector
14-12-2014 22:06:46 Revo Uninstaller's restore point - IObit Uninstaller
27-12-2014 12:33:03 Windows-Sicherung
27-12-2014 13:42:05 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {11CA1589-97EF-47DF-9672-B4B173D3A457} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000Core => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02] (Google Inc.)
Task: {591FCC94-8D03-4CE3-AEE4-C90278EFD080} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {7305E863-6072-49D2-9B92-2DBC6B53BA2E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000UA => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02] (Google Inc.)
Task: {78601467-1B67-497E-BCBA-A63F1536F21D} - System32\Tasks\{E4A47A3D-9F11-4D0B-AFD8-3A965876B4F8} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe" -d "C:\Users\Administrator Jürgen\Downloads" -c "C:\Users\Administrator Jürgen\Downloads\Vorlage_WLAN_Verstaerkung.zip"
Task: {EAB8E1C4-6215-432F-A7F7-2A5C5B4CF64E} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe [2014-12-02] (Nico Mak Computing)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000Core.job => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1707432137-198735931-3728340409-1000UA.job => C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ReimageUpdater.job => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2012-01-21 11:52 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00049152 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmlparse.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00073728 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmltok.dll
2010-12-19 12:18 - 2002-05-28 18:11 - 00122880 _____ () C:\Program Files\WinRAR\rarext.dll
2011-06-24 15:54 - 2011-06-24 15:54 - 00020880 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2014-12-14 21:31 - 2014-12-14 21:31 - 00055816 _____ () C:\Users\Administrator Jürgen\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll
2014-12-27 13:37 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll
2014-12-27 13:37 - 2014-12-02 11:26 - 01717936 _____ () C:\Program Files\WinZip Malware Protector\aspsys.dll
2014-12-27 13:37 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files\WinZip Malware Protector\UNRAR.DLL
2014-10-29 19:59 - 2014-10-22 05:04 - 08910664 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\pdf.dll
2014-10-29 19:59 - 2014-10-22 05:04 - 01681224 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
2014-10-29 19:59 - 2014-10-22 05:05 - 14902600 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: Google Update => "C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: IndexSearch => "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: InetStat => C:\Users\Administrator Jürgen\AppData\Roaming\InetStat\inetstat.exe
MSCONFIG\startupreg: KiesHelper => C:\Program Files\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: NvSvc => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PPort11reminder => "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPStart => C:\Program Files\Synaptics\SynTP\SynTPStart.exe
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WinZip Malware Protector_startup => "C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe" autolaunch
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-1707432137-198735931-3728340409-500 - Administrator - Disabled)
Administrator Jürgen (S-1-5-21-1707432137-198735931-3728340409-1000 - Administrator - Enabled) => C:\Users\Administrator Jürgen
Gast (S-1-5-21-1707432137-198735931-3728340409-501 - Limited - Disabled)
Sabrina (S-1-5-21-1707432137-198735931-3728340409-1001 - Limited - Enabled) => C:\Users\Sabrina

==================== Faulty Device Manager Devices =============

Name: NVIDIA GeForce 8400M G 
Description: NVIDIA GeForce 8400M G 
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: nvlddmkm
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (12/14/2014 10:06:46 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}

Error: (12/14/2014 10:04:53 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}

Error: (12/14/2014 09:59:04 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}

Error: (12/14/2014 09:55:12 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}

Error: (12/07/2014 09:55:05 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (12/07/2014 08:00:06 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SpyHunter4.exe, Version 4.18.9.4384 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: a64
Anfangszeit: 01d011ea78d96917
Zeitpunkt der Beendigung: 15

Error: (12/06/2014 10:44:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SpyHunter4.exe, Version 4.18.9.4384 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: afc
Anfangszeit: 01d0119b69634f92
Zeitpunkt der Beendigung: 31

Error: (12/06/2014 10:24:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = C:\Program Files\AVAST Software\Avast\Setup\Instup.exe Files\AVAST Software\Avast\Setup\Instup.exe" /control_panel /instop:uninstall; Beschreibung = avast! antivirus system restore point; Hr = 0x8007043c).

Error: (12/06/2014 10:23:28 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" ; Beschreibung = Revo Uninstaller's restore point - Avast Free Antivirus; Hr = 0x8007043c).

Error: (12/06/2014 10:37:00 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c


System errors:
=============
Error: (12/27/2014 00:17:24 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (12/27/2014 00:17:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl

Error: (12/27/2014 00:17:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: IHProtect Service%%2

Error: (12/25/2014 11:16:59 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (12/25/2014 11:16:30 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl

Error: (12/25/2014 11:16:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: IHProtect Service%%2

Error: (12/14/2014 10:06:21 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (12/14/2014 10:03:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl

Error: (12/14/2014 10:03:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: IHProtect Service%%2

Error: (12/14/2014 09:32:11 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032


Microsoft Office Sessions:
=========================
Error: (12/14/2014 10:06:46 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}

Error: (12/14/2014 10:04:53 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {dfa65fe5-7b6a-49ac-b761-26388d1388ba}

Error: (12/14/2014 09:59:04 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}

Error: (12/14/2014 09:55:12 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {f01c0026-850b-43ed-8301-aab67b7c5909}

Error: (12/07/2014 09:55:05 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (12/07/2014 08:00:06 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SpyHunter4.exe4.18.9.4384a6401d011ea78d9691715

Error: (12/06/2014 10:44:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SpyHunter4.exe4.18.9.4384afc01d0119b69634f9231

Error: (12/06/2014 10:24:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files\AVAST Software\Avast\Setup\Instup.exe Files\AVAST Software\Avast\Setup\Instup.exe" /control_panel /instop:uninstallavast! antivirus system restore point0x8007043c

Error: (12/06/2014 10:23:28 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" Revo Uninstaller's restore point - Avast Free Antivirus0x8007043c

Error: (12/06/2014 10:37:00 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c


CodeIntegrity Errors:
===================================
  Date: 2014-12-27 14:13:38.761
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:38.543
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:38.309
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:38.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:37.700
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:37.451
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:37.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 14:13:36.951
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 13:25:32.419
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 13:25:32.185
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz
Percentage of memory in use: 46%
Total physical RAM: 3070.39 MB
Available physical RAM: 1642.04 MB
Total Pagefile: 6377.05 MB
Available Pagefile: 5177.91 MB
Total Virtual: 2047.88 MB
Available Virtual: 1912.55 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:78.12 GB) (Free:31.14 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATEN) (Fixed) (Total:195.31 GB) (Free:147.29 GB) NTFS
Drive e: (SICHERUNG) (Fixed) (Total:192.32 GB) (Free:53.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 0A255306)
Partition 1: (Active) - (Size=78.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=192.3 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

3. Gmer:
GMER Logfile:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-27 14:47:08
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK5059GSX rev.GK003U 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\uxlcapow.sys


---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2980] ntdll.dll!DbgUiRemoteBreakin  770BCD84 1 Byte  [C3]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                Wdf01000.sys

Device          \Driver\BTHUSB \Device\00000066                                                                        bthport.sys
Device          \Driver\BTHUSB \Device\00000068                                                                        bthport.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6                            
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@e8e5d60f6d9c               0xFA 0x11 0xFD 0xC7 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@ccf9e8e6f344               0x67 0x96 0xF6 0xB2 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@9c0298f4779b               0x6F 0xD5 0xC5 0x6D ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc0011e6@18cf5e5f442f               0xD2 0x82 0x08 0x69 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@e8e5d60f6d9c                   0xFA 0x11 0xFD 0xC7 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@ccf9e8e6f344                   0x67 0x96 0xF6 0xB2 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@9c0298f4779b                   0x6F 0xD5 0xC5 0x6D ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001bdc0011e6@18cf5e5f442f                   0xD2 0x82 0x08 0x69 ...

---- EOF - GMER 2.1 ----
         

--- --- ---

4. weitere Logfiles:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 27.12.2014
Scan Time: 14:50:07
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2014.12.27.04
Rootkit Database: v2014.12.23.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Administrator Jürgen

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 330774
Time Elapsed: 13 min, 30 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe, 620, , [2fa12245f4883ff7e5961645e0233fc1]

Modules: 9
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\aspsys.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Interop.IWshRuntimeLibrary.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Microsoft.Win32.TaskScheduler.DLL, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\scandll.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unrar.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Compression.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.FileSystem.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Zip.dll, , [2fa12245f4883ff7e5961645e0233fc1],

Registry Keys: 3
PUP.Optional.WinZipMalwareProtector.A, HKLM\SOFTWARE\NICO MAK COMPUTING\WinZip Malware Protector, , [d000392e413b290d7fb6d389c340da26],
PUP.Optional.WinZipMalwareProtector.A, HKU\S-1-5-21-1707432137-198735931-3728340409-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\NICO MAK COMPUTING\WinZip Malware Protector, , [fcd469fe0d6f43f33afc76e61ee538c8],
PUP.Optional.WinZipMalwareProtector.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WinZip Malware Protector_is1, , [2fa12245f4883ff7e5961645e0233fc1],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 9
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector, , [b917ec7b334973c37802b1aafc0735cb],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\2.1.1000.14260, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Logs, , [646c8add6d0f3501d3a9015af1129f61],

Files: 69
PUP.Optional.WinZipMalwareProtector.A, C:\Windows\System32\Tasks\WinZip Malware Protector_startup, , [f8d8c4a39fdd9f97fa38bba1d231cb35],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Public\Desktop\WinZip Malware Protector.lnk, , [9c3491d6067614228ea5322a42c1c23e],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector\Register WinZip Malware Protector.lnk, , [b917ec7b334973c37802b1aafc0735cb],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector\WinZip Malware Protector entfernen.lnk, , [b917ec7b334973c37802b1aafc0735cb],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector\WinZip Malware Protector.lnk, , [b917ec7b334973c37802b1aafc0735cb],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\russian_asp_ru.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\AppManager.exe, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\AppResource.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\asp.ico, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\aspsys.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\categories.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Chinese_asp_ZH-CN.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\danish_asp_DA.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\dutch_asp_NL.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\eng_asp_en.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\filetypehelper.exe, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Finnish_asp_FI.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\french_asp_FR.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\german_asp_DE.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Interop.IWshRuntimeLibrary.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\italian_asp_IT.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\japanese_asp_JA.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\loading_withWhiteBG.avi, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Microsoft.Win32.TaskScheduler.DLL, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\norwegian_asp_NO.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\portuguese_asp_PT-BR.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\scandll.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\spanish_asp_ES.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\swedish_asp_SV.ini, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\System.Core.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unins000.dat, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unins000.exe, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unins000.msg, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\unrar.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe.config, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\WMPUninstall.exe, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Compression.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Compression.Formats.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.FileSystem.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\Xceed.Zip.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack\clamscan.exe, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack\libclamav.dll, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\Program Files\WinZip Malware Protector\clamunpack\readme.txt, , [2fa12245f4883ff7e5961645e0233fc1],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\AddonSafelist, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\log.xslt, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\completedatabase.db, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Cookies.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\DigSign.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\FilePaths.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\FileSignature.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Folders.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Md5.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\Registry.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\SetupSign.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\signatures\StrSetupSign.bin, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\1997completedatabase.zip, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2074mupdate.zip, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2075update.zip, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2076update.zip, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2077update.zip, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\ProgramData\Nico Mak Computing\WinZip Malware Protector\updates\2078update.zip, , [e7e95710a5d7bd79ff7d13489f64d828],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\QDetail.db, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Settings.db, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Update.ini, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\2.1.1000.14260\ASPLog.txt, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Logs\log_27-12-14_01-47-42.xml, , [646c8add6d0f3501d3a9015af1129f61],
PUP.Optional.WinZipMalwareProtector.A, C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing\WinZip Malware Protector\Logs\SMLog.xml, , [646c8add6d0f3501d3a9015af1129f61],

Physical Sectors: 0
(No malicious items detected)


(end)

hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Winzip Malware Protector runter, das ist Fake!



Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo,

danke für die schnelle Antwort.

Da ich ja nichts sehe, habe ich "winzip malware protector" und "Malwarebytes Anti Malware" deinstalliert.

Kein gemeckere durch combofix, weder vor noch nach neustart.

Hier die Combofix.txt:

ComboFix 14-12-25.01 - Administrator Jürgen 27.12.2014  18:26:27.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1869 [GMT 1:00]
ausgeführt von:: C:\Users\Administrator J³rgen\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))


C:\Users\ADMINI~1\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll
C:\Users\Administrator Jürgen\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll
C:\Windows\system32\System32\MASetupCleaner.exe
C:\Windows\system32\System32\muzapp.exe


(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_IHProtect Service


(((((((((((((((((((((((   Dateien erstellt von 2014-11-27 bis 2014-12-27  ))))))))))))))))))))))))))))))


2014-12-27 17:31:42 . 2014-12-27 17:34:25	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Local\temp
2014-12-27 17:31:42 . 2014-12-27 17:31:42	--------	d-----w-	C:\Users\Sabrina\AppData\Local\temp
2014-12-27 17:31:42 . 2014-12-27 17:31:42	--------	d-----w-	C:\Users\Default\AppData\Local\temp
2014-12-27 13:12:57 . 2014-12-27 13:14:08	--------	d-----w-	C:\FRST
2014-12-27 12:50:22 . 2014-12-02 11:01:11	9054624	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8351B3A9-B8A3-4878-9981-C3D7106CA3FF}\mpengine.dll
2014-12-27 12:37:33 . 2014-12-27 17:16:48	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing
2014-12-05 21:55:14 . 2014-12-05 21:55:14	--------	d-----w-	C:\ProgramData\IHProtectUpDate
2014-12-05 21:52:32 . 2014-07-02 19:42:23	670552	----a-w-	C:\Windows\system32\nvvsvc.exe
2014-12-05 21:52:32 . 2014-07-02 19:42:23	62936	----a-w-	C:\Windows\system32\nvshext.dll
2014-12-05 21:52:32 . 2014-07-02 19:42:23	2556360	----a-w-	C:\Windows\system32\nvsvcr.dll
2014-12-05 21:52:32 . 2014-07-02 05:14:36	3826628	----a-w-	C:\Windows\system32\nvcoproc.bin
2014-12-05 21:51:57 . 2014-07-02 20:54:57	61728	----a-w-	C:\Windows\system32\OpenCL.dll
2014-12-05 21:51:50 . 2014-12-05 21:51:50	--------	d-----w-	C:\ProgramData\NVIDIA Corporation
2014-12-05 21:50:02 . 2014-07-02 20:54:57	24198088	----a-w-	C:\Windows\system32\nvoglv32.dll
2014-12-05 21:50:02 . 2014-07-02 20:54:57	16122344	----a-w-	C:\Windows\system32\nvwgf2um.dll
2014-12-05 21:50:02 . 2014-07-02 20:54:57	11283344	----a-w-	C:\Windows\system32\nvopencl.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	907552	----a-w-	C:\Windows\system32\nvdispgenco3234052.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	3988952	----a-w-	C:\Windows\system32\nvcuvid.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	2814656	----a-w-	C:\Windows\system32\nvapi.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	15296456	----a-w-	C:\Windows\system32\nvcompiler.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	14498552	----a-w-	C:\Windows\system32\nvd3dum.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	11222048	----a-w-	C:\Windows\system32\nvcuda.dll
2014-12-05 21:50:01 . 2014-07-02 20:54:57	10681176	----a-w-	C:\Windows\system32\drivers\nvlddmkm.sys
2014-12-05 21:50:01 . 2014-07-02 20:54:57	1054552	----a-w-	C:\Windows\system32\nvdispco3234052.dll
2014-12-05 21:48:41 . 2014-12-05 21:52:29	--------	d-----w-	C:\Program Files\NVIDIA Corporation
2014-12-05 21:47:46 . 2014-12-05 21:47:46	--------	d-----w-	C:\NVIDIA
2014-12-05 21:03:14 . 2014-12-05 21:03:14	--------	d-----w-	C:\Users\Administrator Jürgen\Start Menu
2014-12-05 18:53:08 . 2014-12-05 18:53:08	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Local\Avg2015
2014-12-05 18:52:13 . 2014-12-05 19:00:51	--------	d-----w-	C:\ProgramData\MFAData
2014-12-05 18:52:13 . 2014-12-05 18:52:13	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Local\MFAData
2014-12-05 18:52:13 . 2014-12-05 18:52:13	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Local\Avg2014
2014-12-05 18:35:43 . 2014-12-05 18:35:43	--------	d-----w-	C:\Program Files\Dropbox
2014-12-05 18:34:38 . 2014-12-05 18:35:54	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox
2014-12-05 18:12:43 . 2014-12-06 21:25:31	--------	d-----w-	C:\ProgramData\AVAST Software
2014-12-05 15:02:11 . 2014-12-05 15:02:11	--------	d-----w-	C:\Program Files\VS Revo Group
2014-12-05 14:38:41 . 2014-12-05 14:38:41	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Roaming\Apple Computer
2014-12-05 14:38:37 . 2014-12-05 14:38:37	--------	d-----w-	C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2014-12-05 14:38:34 . 2014-12-05 14:38:34	--------	d-----w-	C:\Program Files\Common Files\IObit
2014-12-05 14:37:46 . 2014-12-05 14:37:46	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Roaming\ProductData
2014-12-05 14:37:38 . 2014-12-05 14:38:34	--------	d-----w-	C:\ProgramData\IObit
2014-12-05 14:37:37 . 2014-12-27 11:16:48	--------	d-----w-	C:\ProgramData\ProductData
2014-12-05 14:37:27 . 2014-12-05 18:40:10	--------	d-----w-	C:\Program Files\IObit
2014-12-05 14:37:25 . 2014-12-05 14:38:37	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Roaming\IObit
2014-12-05 10:38:58 . 2014-12-05 10:38:58	--------	d-----w-	C:\ProgramData\Malwarebytes
2014-12-03 20:23:40 . 2014-12-03 20:23:40	--------	d-----w-	C:\Users\Administrator Jürgen\AppData\Roaming\dlg
2014-12-03 20:15:31 . 2014-12-03 20:15:31	--------	d-----w-	C:\ProgramData\PicColorData
2014-12-03 20:15:21 . 2014-12-02 14:23:30	332584	----a-w-	C:\Windows\system32\ColorMedia.dll
2014-12-03 20:15:19 . 2014-12-05 10:59:00	--------	d-----w-	C:\ProgramData\SystemMedia
2014-12-03 20:15:17 . 2014-12-03 20:15:17	--------	d-----w-	C:\ProgramData\RfndNSIS
2014-12-03 19:54:42 . 2014-12-06 02:23:35	--------	d-----w-	C:\OETemp
2014-12-03 19:47:55 . 2014-12-27 17:33:48	--------	d-----w-	C:\Windows\system32\wbem\repository
.


((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2014-11-24 13:04:58 . 2014-02-26 16:19:08	229000	------w-	C:\Windows\system32\MpSigStub.exe
2014-10-27 19:05:44 . 2014-11-14 16:27:22	1810944	----a-w-	C:\Windows\system32\jscript9.dll
2014-10-27 18:59:06 . 2014-11-14 16:27:28	1129472	----a-w-	C:\Windows\system32\wininet.dll
2014-10-27 18:58:19 . 2014-11-14 16:27:29	1427968	----a-w-	C:\Windows\system32\inetcpl.cpl
2014-10-27 18:56:58 . 2014-11-14 16:27:28	142848	----a-w-	C:\Windows\system32\ieUnatt.exe
2014-10-27 18:56:40 . 2014-11-14 16:27:30	421376	----a-w-	C:\Windows\system32\vbscript.dll
2014-10-27 18:55:20 . 2014-11-14 16:27:28	2382848	----a-w-	C:\Windows\system32\mshtml.tlb
2014-10-27 18:55:17 . 2014-11-14 16:27:30	11776	----a-w-	C:\Windows\system32\mshta.exe
2014-10-24 01:04:29 . 2014-11-15 14:18:38	67072	----a-w-	C:\Windows\system32\packager.dll
2014-10-24 01:03:40 . 2014-11-23 08:10:28	499200	----a-w-	C:\Windows\system32\kerberos.dll
2014-10-18 01:08:10 . 2014-11-15 14:16:08	564224	----a-w-	C:\Windows\system32\oleaut32.dll
2014-10-12 23:34:54 . 2014-11-15 14:08:14	2054656	----a-w-	C:\Windows\system32\win32k.sys
2014-10-10 01:01:27 . 2014-11-15 14:20:01	449536	----a-w-	C:\Windows\system32\termsrv.dll
2014-10-10 01:00:34 . 2014-11-15 14:20:09	146432	----a-w-	C:\Windows\system32\msaudite.dll
2014-10-10 01:00:27 . 2014-11-15 14:20:01	1259008	----a-w-	C:\Windows\system32\lsasrv.dll
2014-10-09 23:22:16 . 2014-11-15 14:20:07	619520	----a-w-	C:\Windows\system32\adtschema.dll
2014-10-03 01:18:20 . 2014-11-15 14:16:29	274432	----a-w-	C:\Windows\system32\AUDIOKSE.dll
2014-10-03 01:17:28 . 2014-11-15 14:16:29	170496	----a-w-	C:\Windows\system32\EncDump.dll
2014-10-03 01:17:16 . 2014-11-15 14:16:29	396800	----a-w-	C:\Windows\system32\AudioEng.dll
2014-10-03 01:17:16 . 2014-11-15 14:16:29	316928	----a-w-	C:\Windows\system32\audiosrv.dll


((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))


*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-05-30 10:34:38	297128	----a-w-	C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09:58	131480	----a-w-	C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPDLR"="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-06-24 14:54:46 20880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2014-08-21 16:30:32	959176	----a-w-	C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2007-03-12 13:51:26	663552	------w-	C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-01-26 14:58:28	65536	------w-	C:\Program Files\Brother\ControlCenter3\BrCtrCen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-12-02 13:26:36	116648	----atw-	C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-29 20:10:12	46632	----a-w-	C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-06-24 14:54:30	941968	----a-w-	C:\Program Files\Samsung\Kies\KiesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-06-24 14:54:46	20880	----a-w-	C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-06-24 14:54:36	3373968	----a-w-	C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2014-07-02 19:42:25	4389848	----a-w-	C:\Windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2014-07-02 19:42:23	377288	----a-w-	C:\Windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
2014-07-02 19:42:25	3063256	----a-w-	C:\Windows\System32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-01-29 20:12:14	30248	----a-w-	C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPort11reminder]
2007-02-01 12:46:58	255528	----a-w-	C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-10 22:28:04	1233920	----a-w-	C:\Program Files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 08:03:38	210472	----a-w-	C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2014-07-25 10:29:36	256896	----a-w-	C:\Program Files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
2007-09-15 01:29:10	102400	----a-w-	C:\Program Files\Synaptics\SynTP\SynTPStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23:32	1008184	----a-w-	C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25:33	202240	----a-w-	C:\Program Files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - FSUSBEXDISK

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache

Inhalt des "geplante Tasks" Ordners


------- Zusätzlicher Suchlauf -------

uStart Page = www.google.com
mStart Page = www.google.com
IE: Free YouTube to MP3 Converter - C:\Program Files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft &Excel exportieren - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
Trusted Zone: com\www.msi
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
TCP: DhcpNameServer = 192.168.0.1

- - - - Entfernte verwaiste Registrierungseinträge - - - -

ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-InetStat - C:\Users\Administrator Jürgen\AppData\Roaming\InetStat\inetstat.exe
MSConfigStartUp-WinZip Malware Protector_startup - C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe
         

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,

zuerst möchte ich über ungewöhnliches berichten:

1. Systemstart => System fährt hörbar hoch, Bildschirm bleibt aber schwarz
2. Kaltstart => An-/Ausschalter so lange gedrückt bis alles aus dann wieder gedrückt zum hochfahren
3. System ist sauber hochgefahren, "Juhu" kein Schraffierter Bildschirm mehr, keine achtfache Spiegelung des Bildschirmes => sieht richtig gut aus.
4. Internet gestartet, auf Trojaner-Board angemeldet, Adw.Cleaner runtergeladen ... Suchen gedrückt.
5. Suche war bereits beendet, schraffierter Bildschirm war wieder da, jedoch nur die einfache Ansicht, wollte dann "löschen" drücken => keine Reaktion des Mauszeigers, task-Manager läßt sich auch nicht öffnen.
6. erneuter Kaltstart => achtfacher Bildschirm schon beim hochbooten, im Hintergrund aktivitäten (u.a. veränderung der Registy) => hab dann Wlan per Tastendruck abgeschaltet somit keine Internetverbindung mehr => Hintergrundaktivitäten wurden damit sofort gestoppt => PC bootet weiter bis zur Startseite bzw. bis zur Desktopansicht.
7. Erneuter Suchlauf des Adw.Cleaners und dann ohne weitere Vorkommnisse gemäß deinem Ablaufplan.

Ach ja, Virensoftware hatte ich ja deinstalliert und bin seitdem "ungeschützt"
Bitte Info, wenn ich da wieder etwas installieren soll. Und wenn ja, welche Software zu empfehlen ist.


Hier nun die geforderten Dateiinhalte:

# AdwCleaner v4.106 - Bericht erstellt am 29/12/2014 um 11:28:01
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-21.4 [Local]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Administrator Jürgen - LAPTOPJN
# Gestartet von : C:\Users\Administrator Jürgen\Desktop\AdwCleaner_4.106.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\PicColorData
Ordner Gelöscht : C:\ProgramData\SystemMedia
Ordner Gelöscht : C:\ProgramData\IHProtectUpDate
Ordner Gelöscht : C:\Users\Administrator Jürgen\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Administrator Jürgen\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Administrator Jürgen\AppData\Roaming\pdfforge
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Program Files\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe
Datei Gelöscht : C:\Windows\Reimage.ini

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-260C\ControlCenter3.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-260C\Installationsprüfung.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-260C\Online-Registrierung.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-260C\Status Monitor.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\PicColor Utility
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\webssearches uninstall
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WindowsMangerProtect
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Reimage Repair
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SpyHunter
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinZip Malware Protector_is1

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16599


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [3709 octets] - [29/12/2014 11:11:00]
AdwCleaner[R1].txt - [3770 octets] - [29/12/2014 11:26:10]
AdwCleaner[S0].txt - [4171 octets] - [29/12/2014 11:28:01]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4231 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Administrator Jürgen on 29.12.2014 at 11:39:39,44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.12.2014 at 11:41:45,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014
Ran by Administrator Jürgen (administrator) on LAPTOPJN on 29-12-2014 11:48:46
Running from C:\Users\Administrator Jürgen\Desktop
Loaded Profile: Administrator Jürgen (Available profiles: Administrator Jürgen & Sabrina)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(O2Micro International) C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
(United Internet AG) C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe
() C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
(Microsoft Corporation) C:\Windows\System32\RacAgent.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [20880 2011-06-24] ()
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-12-22]
FF HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2014-06-09]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-06]
CHR Extension: (Google Drive) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03]
CHR Extension: (YouTube) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-21]
CHR Extension: (Google-Suche) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-21]
CHR Extension: (Google Wallet) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (Google Mail) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-21]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR StartMenuInternet: Google Chrome - Chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [217088 2010-10-25] (Teruten) [File not signed]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit)
R2 o2flash; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [65536 2007-02-12] (O2Micro International) [File not signed]
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
R2 SmartSurferManager; C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [132560 2007-12-18] (United Internet AG)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-12-22] () [File not signed]
S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS32_100507.sys [22328 2010-05-10] (Your Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation)
S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS32_100507.sys [16696 2010-05-10] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S0 navgcswl; System32\drivers\boyygxy.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-29 11:48 - 2014-12-29 11:50 - 00009568 _____ () C:\Users\Administrator Jürgen\Desktop\FRST.txt
2014-12-29 11:41 - 2014-12-29 11:41 - 00000649 _____ () C:\Users\Administrator Jürgen\Desktop\JRT.txt
2014-12-29 11:39 - 2014-12-29 11:39 - 00000000 ____D () C:\Windows\ERUNT
2014-12-29 11:32 - 2014-12-29 11:32 - 00004311 _____ () C:\Users\Administrator Jürgen\Desktop\AdwCleaner[S0].txt
2014-12-29 11:10 - 2014-12-29 11:28 - 00000000 ____D () C:\AdwCleaner
2014-12-29 11:09 - 2014-12-03 03:06 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-12-27 18:25 - 2014-12-27 18:44 - 00000000 ____D () C:\ComboFix
2014-12-27 18:25 - 2014-12-27 18:38 - 00000000 ____D () C:\Qoobox
2014-12-27 18:25 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-27 18:25 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-27 18:25 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-27 18:24 - 2014-12-27 18:38 - 00000000 ____D () C:\Windows\erdnt
2014-12-27 18:23 - 2014-12-27 18:23 - 05603624 ____R (Swearware) C:\Users\Administrator Jürgen\Desktop\ComboFix.exe
2014-12-27 15:21 - 2014-12-27 15:21 - 00000000 _____ () C:\Users\Administrator Jürgen\defogger_reenable
2014-12-27 14:12 - 2014-12-29 11:48 - 00000000 ____D () C:\FRST
2014-12-27 14:11 - 2014-12-27 14:11 - 01114624 _____ (Farbar) C:\Users\Administrator Jürgen\Desktop\FRST.exe
2014-12-27 14:03 - 2014-11-24 21:44 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-12-27 14:03 - 2014-11-24 21:41 - 12369920 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-27 14:03 - 2014-11-24 21:40 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-27 14:03 - 2014-11-24 21:37 - 09740800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-27 14:03 - 2014-11-24 21:35 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-27 14:03 - 2014-11-24 21:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-27 14:03 - 2014-11-24 21:34 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-27 14:03 - 2014-11-24 21:34 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-27 14:03 - 2014-11-24 21:33 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-27 14:03 - 2014-11-24 21:32 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-12-27 14:03 - 2014-11-24 21:32 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-12-27 13:37 - 2014-12-27 18:16 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing
2014-12-07 16:58 - 2014-12-07 16:58 - 00237152 _____ () C:\Windows\Minidump\Mini120714-03.dmp
2014-12-07 15:51 - 2014-12-07 15:51 - 00254616 _____ () C:\Windows\Minidump\Mini120714-02.dmp
2014-12-07 13:23 - 2014-12-07 13:23 - 00250624 _____ () C:\Windows\Minidump\Mini120714-01.dmp
2014-12-05 22:54 - 2014-12-29 11:30 - 00319398 _____ () C:\Windows\PFRO.log
2014-12-05 22:52 - 2014-07-02 20:42 - 02556360 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-12-05 22:52 - 2014-07-02 20:42 - 00670552 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-12-05 22:52 - 2014-07-02 20:42 - 00062936 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-12-05 22:52 - 2014-07-02 06:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-12-05 22:51 - 2014-12-05 22:51 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-05 22:51 - 2014-07-02 21:54 - 00061728 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 24198088 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 16122344 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 15296456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 14498552 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dum.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 11283344 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 11222048 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 10681176 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-12-05 22:50 - 2014-07-02 21:54 - 03988952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 02814656 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 01054552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3234052.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 00907552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3234052.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 00021215 _____ () C:\Windows\system32\nvinfo.pb
2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setupact.log
2014-12-05 22:48 - 2014-12-05 22:52 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-05 22:47 - 2014-12-05 22:47 - 00000000 ____D () C:\NVIDIA
2014-12-05 19:53 - 2014-12-05 19:53 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2015
2014-12-05 19:52 - 2014-12-05 20:00 - 00000000 ____D () C:\ProgramData\MFAData
2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\MFAData
2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2014
2014-12-05 19:40 - 2014-12-05 19:40 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ____D () C:\Program Files\Dropbox
2014-12-05 19:34 - 2014-12-05 19:35 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox
2014-12-05 19:12 - 2014-12-06 22:25 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-12-05 16:02 - 2014-12-05 16:02 - 00001057 _____ () C:\Users\Administrator Jürgen\Desktop\Revo Uninstaller.lnk
2014-12-05 16:02 - 2014-12-05 16:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Apple Computer
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Program Files\Common Files\IObit
2014-12-05 15:37 - 2014-12-27 12:16 - 00000000 ____D () C:\ProgramData\ProductData
2014-12-05 15:37 - 2014-12-05 19:40 - 00000000 ____D () C:\Program Files\IObit
2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\IObit
2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\IObit
2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\ProductData
2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\IObit
2014-12-05 11:38 - 2014-12-05 11:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-05 11:37 - 2014-12-27 12:18 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Administrator Jürgen\Downloads\mbam-setup-2.0.4.1028_CB-DL-Manager [1].exe
2014-12-03 21:23 - 2014-12-03 21:23 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\dlg
2014-12-03 21:15 - 2014-12-03 21:15 - 00000000 ____D () C:\ProgramData\RfndNSIS
2014-12-03 21:15 - 2014-12-02 15:23 - 00332584 _____ (Say Media Group LTD) C:\Windows\system32\ColorMedia.dll
2014-12-03 20:54 - 2014-12-06 03:23 - 00000000 ____D () C:\OETemp
2014-12-03 20:46 - 2014-12-03 20:46 - 00000000 ____D () C:\Windows\Registration

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-29 11:40 - 2008-01-21 02:35 - 01697557 _____ () C:\Windows\WindowsUpdate.log
2014-12-29 11:37 - 2006-11-02 11:33 - 01576246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-29 11:32 - 2010-12-19 11:28 - 00001356 _____ () C:\Users\Administrator Jürgen\AppData\Local\d3d9caps.dat
2014-12-29 11:30 - 2010-12-31 14:26 - 00000000 ____D () C:\SmartSurfer
2014-12-29 11:30 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-29 11:30 - 2006-11-02 13:47 - 00003712 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-29 11:30 - 2006-11-02 13:47 - 00003712 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-29 11:28 - 2010-12-19 13:35 - 00004268 _____ () C:\Windows\bthservsdp.dat
2014-12-29 11:28 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-29 11:15 - 2013-08-11 22:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-29 11:15 - 2006-11-02 11:24 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-12-27 19:01 - 2013-01-23 19:48 - 00000000 ____D () C:\Users\Administrator Jürgen\Desktop\To Do
2014-12-27 18:34 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-12-27 18:25 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-12-14 21:38 - 2010-12-31 14:26 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\SmartSurfer
2014-12-07 16:58 - 2011-10-30 13:50 - 00000000 ____D () C:\Windows\Minidump
2014-12-07 16:58 - 2011-10-30 13:49 - 221670998 _____ () C:\Windows\MEMORY.DMP
2014-12-07 07:52 - 2010-12-19 13:55 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-06 07:48 - 2012-01-21 11:36 - 00002109 _____ () C:\Users\Administrator Jürgen\Desktop\Google Chrome.lnk
2014-12-06 07:48 - 2010-12-19 11:43 - 00000919 _____ () C:\Users\Administrator Jürgen\Desktop\Launch Internet Explorer Browser.lnk
2014-12-06 07:48 - 2010-12-19 11:29 - 00000949 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-05 22:51 - 2012-02-08 20:30 - 00000000 ____D () C:\Temp
2014-12-05 19:29 - 2010-12-19 21:15 - 00000000 ____D () C:\Windows\PANTHER
2014-12-05 19:29 - 2010-12-19 12:51 - 00000000 ____D () C:\Program Files\PDFCreator
2014-12-05 18:55 - 2014-08-19 07:50 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-05 12:33 - 2006-11-02 13:47 - 00318352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-05 10:54 - 2011-08-05 19:02 - 00002451 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-12-03 21:02 - 2010-12-19 11:29 - 00079472 _____ () C:\Users\Administrator Jürgen\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-03 20:40 - 2006-11-02 11:22 - 38535168 _____ () C:\Windows\system32\config\software_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 37224448 _____ () C:\Windows\system32\config\components_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 19398656 _____ () C:\Windows\system32\config\system_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-12-03 20:39 - 2012-04-22 21:07 - 00000000 ____D () C:\Users\Sabrina
2014-12-03 20:39 - 2012-01-21 11:36 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration.tmp
2014-12-03 19:53 - 2010-12-24 08:51 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.001
2014-12-02 22:29 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-12-02 21:24 - 2010-12-24 08:28 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.dat

Some content of TEMP:
====================
C:\Users\Administrator Jürgen\AppData\Local\temp\Quarantine.exe
C:\Users\Administrator Jürgen\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-29 11:35
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-12-2014
Ran by Administrator Jürgen at 2014-12-29 11:51:51
Running from C:\Users\Administrator Jürgen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
Brother MFL-Pro Suite (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2474 - CDBurnerXP)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender und Unternehmer 11.5.3.5585) (Version: 15.3.14949 - Landesfinanzdirektion Thüringen)
FaceFilter Studio Brother Edition (HKLM\...\{F59205C8-E5FB-43F5-AAB2-16C1760D4F59}) (Version: 1.0 - )
Free YouTube to MP3 Converter version 3.12.38.530 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.38.530 - DVDVideoSoft Ltd.)
Google Chrome (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.670 - Oracle)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
O2Micro Flash Memory Card Reader Driver (x86) (HKLM\...\{0F667427-AD37-4089-A4A2-15AF5E44CACD}) (Version: 3.25 - O2Micro)
PaperPort Image Printer (HKLM\...\{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2410.0 - SAMSUNG Electronics Co., Ltd.)
ScanSoft PaperPort 11 (HKLM\...\{B6C89654-A6A2-477C-873B-724EC1C56407}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.13.2 - Synaptics)
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
WEB.DE SmartSurfer (HKLM\...\WEB.DE SmartSurfer) (Version:  - )
WEB.DE SmartSurfer AutoUpdate 5.2 (HKLM\...\{11CA6E01-3992-4115-AB6E-D325552C166D}) (Version:  - )
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

06-12-2014 08:16:44 Revo Uninstaller's restore point - Reimage Repair
06-12-2014 22:35:51 Windows-Sicherung
07-12-2014 17:47:57 Geplanter Prüfpunkt
14-12-2014 21:20:12 Windows-Sicherung
14-12-2014 21:55:15 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
14-12-2014 21:59:04 Revo Uninstaller's restore point - SpyHunter 4
14-12-2014 22:04:56 Revo Uninstaller's restore point - WinZip Malware Protector
14-12-2014 22:06:46 Revo Uninstaller's restore point - IObit Uninstaller
27-12-2014 12:33:03 Windows-Sicherung
27-12-2014 13:42:05 Windows Update
27-12-2014 18:16:27 Revo Uninstaller's restore point - WinZip Malware Protector
27-12-2014 18:19:30 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
27-12-2014 20:00:03 Windows-Sicherung
29-12-2014 11:07:05 Windows Update
29-12-2014 11:40:45 Windows-Sicherung

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2014-12-27 18:34 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {591FCC94-8D03-4CE3-AEE4-C90278EFD080} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {78601467-1B67-497E-BCBA-A63F1536F21D} - System32\Tasks\{E4A47A3D-9F11-4D0B-AFD8-3A965876B4F8} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe" -d "C:\Users\Administrator Jürgen\Downloads" -c "C:\Users\Administrator Jürgen\Downloads\Vorlage_WLAN_Verstaerkung.zip"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Loaded Modules (whitelisted) =============

2012-01-21 11:52 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00049152 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmlparse.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00073728 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmltok.dll
2011-06-24 15:54 - 2011-06-24 15:54 - 00020880 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2014-12-27 18:35 - 2014-12-27 18:35 - 00055816 _____ () C:\Users\Administrator Jürgen\AppData\Local\Temp\b01d42a6-0948-4bd0-8dea-54d68f50a791\CliSecureRT.dll
2010-12-19 12:18 - 2002-05-28 18:11 - 00122880 _____ () C:\Program Files\WinRAR\rarext.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: Google Update => "C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: IndexSearch => "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: InetStat => C:\Users\Administrator Jürgen\AppData\Roaming\InetStat\inetstat.exe
MSCONFIG\startupreg: KiesHelper => C:\Program Files\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: NvSvc => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PPort11reminder => "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPStart => C:\Program Files\Synaptics\SynTP\SynTPStart.exe
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WinZip Malware Protector_startup => "C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe" autolaunch
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-1707432137-198735931-3728340409-500 - Administrator - Disabled)
Administrator Jürgen (S-1-5-21-1707432137-198735931-3728340409-1000 - Administrator - Enabled) => C:\Users\Administrator Jürgen
Gast (S-1-5-21-1707432137-198735931-3728340409-501 - Limited - Disabled)
Sabrina (S-1-5-21-1707432137-198735931-3728340409-1001 - Limited - Enabled) => C:\Users\Sabrina

==================== Faulty Device Manager Devices =============

Name: NVIDIA GeForce 8400M G 
Description: NVIDIA GeForce 8400M G 
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: nvlddmkm
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-12-27 15:52:44.728
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:52:44.496
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:52:44.082
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:52:43.771
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:40.513
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:40.279
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:40.045
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:39.780
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:39.390
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:39.156
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz
Percentage of memory in use: 30%
Total physical RAM: 3070.39 MB
Available physical RAM: 2137.07 MB
Total Pagefile: 6387.05 MB
Available Pagefile: 5600.77 MB
Total Virtual: 2047.88 MB
Available Virtual: 1923.12 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:78.12 GB) (Free:28.39 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATEN) (Fixed) (Total:195.31 GB) (Free:147.44 GB) NTFS
Drive e: (SICHERUNG) (Fixed) (Total:192.32 GB) (Free:27.73 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 0A255306)
Partition 1: (Active) - (Size=78.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=192.3 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7c94a3609b374a48a85d1b3cc0d71cdf
# engine=21752
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-30 09:44:07
# local_time=2014-12-30 10:44:07 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 46772 257508575 0 0
# scanned=168452
# found=33
# cleaned=0
# scan_time=43016
sh=3D09B4A1E2E55E7D1DF62B739D434F3F4E51DB90 ft=1 fh=31688d33c108b3f2 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe.vir"
sh=5F437ECC88A691B6161B1D168B3F4A93624F5832 ft=1 fh=400e77a5e5d54a3a vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe.vir"
sh=B7A1757508588C3F277B97F877A74350068370AD ft=1 fh=49b56f64fa90416e vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\2 WinZip Malware Protektor\wzmp_8.exe"
sh=AEB72B4EBC0BBEA21AED9A3DC1F0627C30063C45 ft=1 fh=0390aa1d7a4d063d vn="Variante von Win32/DownloadGuide.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Avg antivirus\avg-anti-virus-free.exe"
sh=3B258DC4D53C9C56BD8CFF38B99C97D6262C6319 ft=1 fh=7166989701ad11de vn="Variante von Win32/InstallCore.TL evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Malware kostenlos löschen\mbam-setup-2.0.4.1028_CB-DL-Manager.exe"
sh=02FB7A5955B2DCFDE1EB939B62C5FDC1C66A5B34 ft=1 fh=42bf00c8c45ffbea vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="C:\Windows\System32\ColorMedia.dll"
sh=A1A6E3BED0FCAEFC4CC604A7D693F935C5592B6E ft=1 fh=afb721294e24b1dc vn="Variante von Win32/DownloadGuide.D evtl. unerwünschte Anwendung" ac=I fn="D:\avira-free-antivir.exe"
sh=1DC8856C6A0152D53A2A88047C1BB015F910A80F ft=0 fh=0000000000000000 vn="Win32/DealPly.J evtl. unerwünschte Anwendung" ac=I fn="E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-02-15 130056\Backup files 90.zip"
sh=60BF0432D2C9F41AF414E634ECD08A0978DCA7AB ft=0 fh=0000000000000000 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-12-29 114041\Backup files 1.zip"
sh=5F437ECC88A691B6161B1D168B3F4A93624F5832 ft=1 fh=400e77a5e5d54a3a vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe"
sh=F8B50E5185574E71AE21FE200E7945B520879025 ft=1 fh=a53d2f80f5d519ac vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\PCSChecker[1].exe"
sh=1FBCCE3ECEBD5955F90E91C6B6B74EE06783CD66 ft=1 fh=cdd42cd0b2145c18 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\spstub[1].exe"
sh=1FBCCE3ECEBD5955F90E91C6B6B74EE06783CD66 ft=1 fh=cdd42cd0b2145c18 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AMY3HMH1\spstub[1].exe"
sh=2CB436E7B155EB60C5993E68377A1098D48F1036 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3C6H11A\welcome[1].htm"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsc100C.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsfE7B3.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsi55F7.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsiC4A.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nss14AF.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsx4F03.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy10ED.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy111.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsyFB46.exe"
sh=A1B14466AE1011E196F03729881D241CACF20EC9 ft=1 fh=c12fae7e09319f7c vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\optprosetup.exe"
sh=F8B50E5185574E71AE21FE200E7945B520879025 ft=1 fh=a53d2f80f5d519ac vn="Variante von Win32/Adware.PicColor.C Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe"
sh=119E149747A552877117A6D91EFD3BE4B26418AE ft=1 fh=d60c8402287380a1 vn="Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\Search_Protect_non_Google_setup.exe"
sh=3CA96836E5258ABAC55BDF186808CCD8773D068F ft=1 fh=2547baac6d1fe263 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\MyBabylonTB.exe"
sh=5F437ECC88A691B6161B1D168B3F4A93624F5832 ft=1 fh=400e77a5e5d54a3a vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\Setup.exe"
sh=3F20DC68A6AAC23C4702D16C8A5388DCFE591AEA ft=1 fh=e5e2264a283a7f45 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\is1438683437\MyBabylonTB.exe"
sh=8398427DEE8FECAF5BC25B22C826FC2DC6DF9747 ft=1 fh=81c159dc949cee29 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssE277\SpSetup.exe"
sh=747967DDF45E05E1DCB00A7596831C061DF1F1B9 ft=1 fh=a103b6b8a66bc93e vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssEAA1\SpSetup.exe"
sh=4F58D1B891DD606908EE3E781A2F5087BDC8A0A6 ft=1 fh=45b65275feca196c vn="Win32/Installium.A evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\4CD5A95ACD28415B8061889AD83EE40C\Search_Protect_non_G.exe"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\CAD2C8041E264DF38C368E2D73AFD0A6\sp-downloader.exe"
         

 Results of screen317's Security Check version 0.99.93  
 Windows Vista Service Pack 2 x86   
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 67  
 Java version 32-bit out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Reader 10.1.12 Adobe Reader out of Date!  
 Google Chrome 38.0.2125.104  Google Chrome out of date!  
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014
Ran by Administrator Jürgen (administrator) on LAPTOPJN on 30-12-2014 23:18:14
Running from C:\Users\Administrator Jürgen\Desktop
Loaded Profile: Administrator Jürgen (Available profiles: Administrator Jürgen & Sabrina)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(O2Micro International) C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
(United Internet AG) C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe
(Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [20880 2011-06-24] ()
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1707432137-198735931-3728340409-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-12-22]
FF HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2014-06-09]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-06]
CHR Extension: (Google Drive) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03]
CHR Extension: (YouTube) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-21]
CHR Extension: (Google-Suche) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-21]
CHR Extension: (Google Wallet) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (Google Mail) - C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-21]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR StartMenuInternet: Google Chrome - Chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [217088 2010-10-25] (Teruten) [File not signed]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit)
R2 o2flash; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [65536 2007-02-12] (O2Micro International) [File not signed]
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
R2 SmartSurferManager; C:\Program Files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [132560 2007-12-18] (United Internet AG)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-12-22] () [File not signed]
S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS32_100507.sys [22328 2010-05-10] (Your Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation)
S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS32_100507.sys [16696 2010-05-10] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S0 navgcswl; System32\drivers\boyygxy.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-30 23:18 - 2014-12-30 23:18 - 00009575 _____ () C:\Users\Administrator Jürgen\Desktop\FRST.txt
2014-12-30 23:12 - 2014-12-30 23:12 - 00852505 _____ () C:\Users\Administrator Jürgen\Desktop\SecurityCheck.exe
2014-12-30 10:43 - 2014-12-30 10:43 - 02347384 _____ (ESET) C:\Users\Administrator Jürgen\Desktop\esetsmartinstaller_deu.exe
2014-12-29 11:39 - 2014-12-29 11:39 - 00000000 ____D () C:\Windows\ERUNT
2014-12-29 11:10 - 2014-12-29 11:28 - 00000000 ____D () C:\AdwCleaner
2014-12-29 11:09 - 2014-12-03 03:06 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-12-27 18:25 - 2014-12-27 18:44 - 00000000 ____D () C:\ComboFix
2014-12-27 18:25 - 2014-12-27 18:38 - 00000000 ____D () C:\Qoobox
2014-12-27 18:25 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-27 18:25 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-27 18:25 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-27 18:25 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-27 18:24 - 2014-12-27 18:38 - 00000000 ____D () C:\Windows\erdnt
2014-12-27 15:21 - 2014-12-27 15:21 - 00000000 _____ () C:\Users\Administrator Jürgen\defogger_reenable
2014-12-27 14:12 - 2014-12-30 23:18 - 00000000 ____D () C:\FRST
2014-12-27 14:11 - 2014-12-27 14:11 - 01114624 _____ (Farbar) C:\Users\Administrator Jürgen\Desktop\FRST.exe
2014-12-27 14:03 - 2014-11-24 21:44 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-12-27 14:03 - 2014-11-24 21:41 - 12369920 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-27 14:03 - 2014-11-24 21:40 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-27 14:03 - 2014-11-24 21:37 - 09740800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-27 14:03 - 2014-11-24 21:35 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-27 14:03 - 2014-11-24 21:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-27 14:03 - 2014-11-24 21:34 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-27 14:03 - 2014-11-24 21:34 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-27 14:03 - 2014-11-24 21:33 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-27 14:03 - 2014-11-24 21:33 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-27 14:03 - 2014-11-24 21:32 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-27 14:03 - 2014-11-24 21:32 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-12-27 14:03 - 2014-11-24 21:32 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-12-27 13:37 - 2014-12-27 18:16 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Nico Mak Computing
2014-12-07 16:58 - 2014-12-07 16:58 - 00237152 _____ () C:\Windows\Minidump\Mini120714-03.dmp
2014-12-07 15:51 - 2014-12-07 15:51 - 00254616 _____ () C:\Windows\Minidump\Mini120714-02.dmp
2014-12-07 13:23 - 2014-12-07 13:23 - 00250624 _____ () C:\Windows\Minidump\Mini120714-01.dmp
2014-12-05 22:54 - 2014-12-29 11:30 - 00319398 _____ () C:\Windows\PFRO.log
2014-12-05 22:52 - 2014-07-02 20:42 - 02556360 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-12-05 22:52 - 2014-07-02 20:42 - 00670552 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-12-05 22:52 - 2014-07-02 20:42 - 00062936 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-12-05 22:52 - 2014-07-02 06:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-12-05 22:51 - 2014-12-05 22:51 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-05 22:51 - 2014-07-02 21:54 - 00061728 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 24198088 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 16122344 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 15296456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 14498552 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dum.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 11283344 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 11222048 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 10681176 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-12-05 22:50 - 2014-07-02 21:54 - 03988952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 02814656 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 01054552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3234052.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 00907552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3234052.dll
2014-12-05 22:50 - 2014-07-02 21:54 - 00021215 _____ () C:\Windows\system32\nvinfo.pb
2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-05 22:49 - 2014-12-05 22:49 - 00000000 _____ () C:\Windows\setupact.log
2014-12-05 22:48 - 2014-12-05 22:52 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-05 22:47 - 2014-12-05 22:47 - 00000000 ____D () C:\NVIDIA
2014-12-05 19:53 - 2014-12-05 19:53 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2015
2014-12-05 19:52 - 2014-12-05 20:00 - 00000000 ____D () C:\ProgramData\MFAData
2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\MFAData
2014-12-05 19:52 - 2014-12-05 19:52 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Local\Avg2014
2014-12-05 19:40 - 2014-12-05 19:40 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-05 19:35 - 2014-12-05 19:35 - 00000000 ____D () C:\Program Files\Dropbox
2014-12-05 19:34 - 2014-12-05 19:35 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox
2014-12-05 19:12 - 2014-12-06 22:25 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-12-05 16:02 - 2014-12-05 16:02 - 00001057 _____ () C:\Users\Administrator Jürgen\Desktop\Revo Uninstaller.lnk
2014-12-05 16:02 - 2014-12-05 16:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Apple Computer
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2014-12-05 15:38 - 2014-12-05 15:38 - 00000000 ____D () C:\Program Files\Common Files\IObit
2014-12-05 15:37 - 2014-12-27 12:16 - 00000000 ____D () C:\ProgramData\ProductData
2014-12-05 15:37 - 2014-12-05 19:40 - 00000000 ____D () C:\Program Files\IObit
2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\IObit
2014-12-05 15:37 - 2014-12-05 15:38 - 00000000 ____D () C:\ProgramData\IObit
2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\ProductData
2014-12-05 15:37 - 2014-12-05 15:37 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\IObit
2014-12-05 11:38 - 2014-12-05 11:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-05 11:37 - 2014-12-27 12:18 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Administrator Jürgen\Downloads\mbam-setup-2.0.4.1028_CB-DL-Manager [1].exe
2014-12-03 21:23 - 2014-12-03 21:23 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\dlg
2014-12-03 21:15 - 2014-12-03 21:15 - 00000000 ____D () C:\ProgramData\RfndNSIS
2014-12-03 21:15 - 2014-12-02 15:23 - 00332584 _____ (Say Media Group LTD) C:\Windows\system32\ColorMedia.dll
2014-12-03 20:54 - 2014-12-06 03:23 - 00000000 ____D () C:\OETemp
2014-12-03 20:46 - 2014-12-03 20:46 - 00000000 ____D () C:\Windows\Registration

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-30 23:11 - 2008-01-21 02:35 - 01736158 _____ () C:\Windows\WindowsUpdate.log
2014-12-30 22:29 - 2006-11-02 13:47 - 00003712 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-30 22:29 - 2006-11-02 13:47 - 00003712 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-30 10:35 - 2006-11-02 11:33 - 01576246 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-30 10:31 - 2010-12-19 11:28 - 00001356 _____ () C:\Users\Administrator Jürgen\AppData\Local\d3d9caps.dat
2014-12-30 10:29 - 2010-12-31 14:26 - 00000000 ____D () C:\SmartSurfer
2014-12-30 10:29 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-29 12:29 - 2010-12-19 13:35 - 00004268 _____ () C:\Windows\bthservsdp.dat
2014-12-29 12:29 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-29 11:15 - 2013-08-11 22:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-29 11:15 - 2006-11-02 11:24 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-12-27 19:01 - 2013-01-23 19:48 - 00000000 ____D () C:\Users\Administrator Jürgen\Desktop\To Do
2014-12-27 18:34 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-12-27 18:25 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-12-14 21:38 - 2010-12-31 14:26 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\SmartSurfer
2014-12-07 16:58 - 2011-10-30 13:50 - 00000000 ____D () C:\Windows\Minidump
2014-12-07 16:58 - 2011-10-30 13:49 - 221670998 _____ () C:\Windows\MEMORY.DMP
2014-12-07 07:52 - 2010-12-19 13:55 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-06 07:48 - 2012-01-21 11:36 - 00002109 _____ () C:\Users\Administrator Jürgen\Desktop\Google Chrome.lnk
2014-12-06 07:48 - 2010-12-19 11:43 - 00000919 _____ () C:\Users\Administrator Jürgen\Desktop\Launch Internet Explorer Browser.lnk
2014-12-06 07:48 - 2010-12-19 11:29 - 00000949 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-05 22:51 - 2012-02-08 20:30 - 00000000 ____D () C:\Temp
2014-12-05 19:29 - 2010-12-19 21:15 - 00000000 ____D () C:\Windows\PANTHER
2014-12-05 19:29 - 2010-12-19 12:51 - 00000000 ____D () C:\Program Files\PDFCreator
2014-12-05 18:55 - 2014-08-19 07:50 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-05 12:33 - 2006-11-02 13:47 - 00318352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-05 10:54 - 2011-08-05 19:02 - 00002451 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-12-03 21:02 - 2010-12-19 11:29 - 00079472 _____ () C:\Users\Administrator Jürgen\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-03 20:40 - 2006-11-02 11:22 - 38535168 _____ () C:\Windows\system32\config\software_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 37224448 _____ () C:\Windows\system32\config\components_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 19398656 _____ () C:\Windows\system32\config\system_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-12-03 20:40 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-12-03 20:39 - 2012-04-22 21:07 - 00000000 ____D () C:\Users\Sabrina
2014-12-03 20:39 - 2012-01-21 11:36 - 00000000 ____D () C:\Users\Administrator Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-12-03 20:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration.tmp
2014-12-03 19:53 - 2010-12-24 08:51 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.001
2014-12-02 22:29 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-12-02 21:24 - 2010-12-24 08:28 - 00028760 _____ () C:\Users\Administrator Jürgen\AppData\Roaming\nvModes.dat

Some content of TEMP:
====================
C:\Users\Administrator Jürgen\AppData\Local\temp\Quarantine.exe
C:\Users\Administrator Jürgen\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-30 22:46

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-12-2014
Ran by Administrator Jürgen at 2014-12-30 23:18:52
Running from C:\Users\Administrator Jürgen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
Brother MFL-Pro Suite (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2474 - CDBurnerXP)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender und Unternehmer 11.5.3.5585) (Version: 15.3.14949 - Landesfinanzdirektion Thüringen)
FaceFilter Studio Brother Edition (HKLM\...\{F59205C8-E5FB-43F5-AAB2-16C1760D4F59}) (Version: 1.0 - )
Free YouTube to MP3 Converter version 3.12.38.530 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.38.530 - DVDVideoSoft Ltd.)
Google Chrome (HKU\S-1-5-21-1707432137-198735931-3728340409-1000\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.670 - Oracle)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
O2Micro Flash Memory Card Reader Driver (x86) (HKLM\...\{0F667427-AD37-4089-A4A2-15AF5E44CACD}) (Version: 3.25 - O2Micro)
PaperPort Image Printer (HKLM\...\{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2410.0 - SAMSUNG Electronics Co., Ltd.)
ScanSoft PaperPort 11 (HKLM\...\{B6C89654-A6A2-477C-873B-724EC1C56407}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.13.2 - Synaptics)
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
WEB.DE SmartSurfer (HKLM\...\WEB.DE SmartSurfer) (Version:  - )
WEB.DE SmartSurfer AutoUpdate 5.2 (HKLM\...\{11CA6E01-3992-4115-AB6E-D325552C166D}) (Version:  - )
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR Archivierer (HKLM\...\WinRAR archiver) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1707432137-198735931-3728340409-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator Jürgen\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

06-12-2014 22:35:51 Windows-Sicherung
07-12-2014 17:47:57 Geplanter Prüfpunkt
14-12-2014 21:20:12 Windows-Sicherung
14-12-2014 21:55:15 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
14-12-2014 21:59:04 Revo Uninstaller's restore point - SpyHunter 4
14-12-2014 22:04:56 Revo Uninstaller's restore point - WinZip Malware Protector
14-12-2014 22:06:46 Revo Uninstaller's restore point - IObit Uninstaller
27-12-2014 12:33:03 Windows-Sicherung
27-12-2014 13:42:05 Windows Update
27-12-2014 18:16:27 Revo Uninstaller's restore point - WinZip Malware Protector
27-12-2014 18:19:30 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
27-12-2014 20:00:03 Windows-Sicherung
29-12-2014 11:07:05 Windows Update
29-12-2014 11:40:45 Windows-Sicherung
30-12-2014 10:32:44 Windows Update
30-12-2014 20:04:09 Windows-Sicherung

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2014-12-27 18:34 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {78601467-1B67-497E-BCBA-A63F1536F21D} - System32\Tasks\{E4A47A3D-9F11-4D0B-AFD8-3A965876B4F8} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe" -d "C:\Users\Administrator Jürgen\Downloads" -c "C:\Users\Administrator Jürgen\Downloads\Vorlage_WLAN_Verstaerkung.zip"
Task: {B7030D5A-A4A1-4FAF-A266-1D85E18A3170} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Loaded Modules (whitelisted) =============

2012-01-21 11:52 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00049152 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmlparse.dll
2006-03-09 17:33 - 2006-03-09 17:33 - 00073728 _____ () C:\Program Files\WEB.DE\WEB.DE SmartSurfer\xmltok.dll
2010-12-19 12:18 - 2002-05-28 18:11 - 00122880 _____ () C:\Program Files\WinRAR\rarext.dll
2014-10-29 19:59 - 2014-10-22 05:04 - 08910664 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\pdf.dll
2014-10-29 19:59 - 2014-10-22 05:04 - 01681224 _____ () C:\Users\Administrator Jürgen\AppData\Local\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: Google Update => "C:\Users\Administrator Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: IndexSearch => "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: InetStat => C:\Users\Administrator Jürgen\AppData\Roaming\InetStat\inetstat.exe
MSCONFIG\startupreg: KiesHelper => C:\Program Files\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: NvSvc => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PPort11reminder => "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPStart => C:\Program Files\Synaptics\SynTP\SynTPStart.exe
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WinZip Malware Protector_startup => "C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe" autolaunch
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-1707432137-198735931-3728340409-500 - Administrator - Disabled)
Administrator Jürgen (S-1-5-21-1707432137-198735931-3728340409-1000 - Administrator - Enabled) => C:\Users\Administrator Jürgen
Gast (S-1-5-21-1707432137-198735931-3728340409-501 - Limited - Disabled)
Sabrina (S-1-5-21-1707432137-198735931-3728340409-1001 - Limited - Enabled) => C:\Users\Sabrina

==================== Faulty Device Manager Devices =============

Name: NVIDIA GeForce 8400M G 
Description: NVIDIA GeForce 8400M G 
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: nvlddmkm
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (12/30/2014 11:18:12 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: KiesPDLR.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 10001296

Error: (12/30/2014 11:17:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung KiesPDLR.exe, Version 1.0.0.0, Zeitstempel 0x4de37890, fehlerhaftes Modul CliSecureRT.dll, Version 5.2.0.2, Zeitstempel 0x4c492bfd, Ausnahmecode 0xc0000005, Fehleroffset 0x00001296,
Prozess-ID 0x%9, Anwendungsstartzeit KiesPDLR.exe0.


System errors:
=============
Error: (12/30/2014 10:31:04 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (12/30/2014 10:30:48 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: navgcswl


Microsoft Office Sessions:
=========================
Error: (12/30/2014 11:18:12 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: KiesPDLR.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: Ausnahmecode c0000005, Ausnahmeadresse 10001296

Error: (12/30/2014 11:17:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: KiesPDLR.exe1.0.0.04de37890CliSecureRT.dll5.2.0.24c492bfdc000000500001296


CodeIntegrity Errors:
===================================
  Date: 2014-12-27 15:52:44.728
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:52:44.496
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:52:44.082
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:52:43.771
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\NVIDIA\DisplayDriver\340.52\Win8_WinVista_Win7\International\GFExperience.NvStreamSrv\x86\server\NvStreamKms.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:40.513
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:40.279
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:40.045
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:39.780
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:39.390
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-27 15:17:39.156
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz
Percentage of memory in use: 45%
Total physical RAM: 3070.39 MB
Available physical RAM: 1673.47 MB
Total Pagefile: 6383.05 MB
Available Pagefile: 5344.6 MB
Total Virtual: 2047.88 MB
Available Virtual: 1926.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:78.12 GB) (Free:28.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATEN) (Fixed) (Total:195.31 GB) (Free:147.41 GB) NTFS
Drive e: (SICHERUNG) (Fixed) (Total:192.32 GB) (Free:11.45 GB) NTFS
Drive g: (FreeAgent GoFlex Drive) (Fixed) (Total:232.88 GB) (Free:151.41 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 0A255306)
Partition 1: (Active) - (Size=78.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=192.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 0E066FDB)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Hallo Schrauber,

hatte jetzt eine Festplatte mit drann, welche nach der Verseuchung noch genutzt wurde (Zwecks Datensicherung). Wie sieht es mit weiteren Speichermedien aus? soll ich diese später auch mit Eset scannen?

Samsung Kies hat gemeckert, dass es nicht mehr läuft. (Hab ich noch irgendwo auf einer sauberen ext. Festplatte gesichert, wird bei Bedarf deinstalliert und neu installiert.)

Mein schraffierter Bildschirm ist immer noch da. Und ich sehe immer noch meinen Bildschirm in acht facher Ausführung => Grafikkarte? => Software- oder Hartwarefehler?

Gruß
j.newton

Java, Flash und Adobe updaten.

Externe Medien kannste im Anschluss mit deinem AV und/oder MBAM scannen.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\2 WinZip Malware Protektor\wzmp_8.exe

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Avg antivirus\avg-anti-virus-free.exe

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Malware kostenlos löschen\mbam-setup-2.0.4.1028_CB-DL-Manager.exe

C:\Windows\System32\ColorMedia.dll

D:\avira-free-antivir.exe

E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-02-15 130056\Backup files 90.zip

E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-12-29 114041\Backup files 1.zip

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\PCSChecker[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\spstub[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AMY3HMH1\spstub[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3C6H11A\welcome[1].htm

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsc100C.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsfE7B3.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsi55F7.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsiC4A.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nss14AF.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsx4F03.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy10ED.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy111.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsyFB46.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\optprosetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\Search_Protect_non_Google_setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\MyBabylonTB.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\Setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\is1438683437\MyBabylonTB.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssE277\SpSetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssEAA1\SpSetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\4CD5A95ACD28415B8061889AD83EE40C\Search_Protect_non_G.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\CAD2C8041E264DF38C368E2D73AFD0A6\sp-downloader.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

• Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
• Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
• Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
• Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
• Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
• Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

Hallo Schrauber,

ich wünsche Dir ein frohes neues Jahr.

Update Java:
Bin jetzt auf Version 7 Update 71 (Build 1.7.0_71-b14). Laut meiner Java Software wäre ich nun aktuell.
Hab irgendwo gesehen, dass es schon Version 8 Update 25 gibt. Gilt das auch für Chrome/Vista/32bit?
P.S. Wöhrend des Updates kam die Meldung " GetDefaultBrowserError:2"

Update Flssh Player:
Dies solle Google Chrome automatisch aktualisieren. Hat er aber nicht. Beim anschubsen kam der Hinweis "Fehler bei der Aktualisierung (Fehler 7)". Habe dann Google Chrome neu installiert und den Flash Player nochmal angeschubst. Jetzt bin ich auf Version 16.0.0.235

Update Adobe:
Hier hab ich die Version 10.1.13

An irgend einer Stelle hatte ich "Search Ask" abgewählt. Ist glaube ich Adware. Wurde somit nicht installiert. Ich hoffe das war richtig.

Bei der ersten Fixlog.txt hatte ich nicht die externe Festplatte angeschlossen.
Hier die erste Fixlog.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-01-2015
Ran by Administrator Jürgen at 2015-01-02 17:49:53 Run:1
Running from C:\Users\Administrator Jürgen\Desktop
Loaded Profile: Administrator Jürgen (Available profiles: Administrator Jürgen & Sabrina)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\2 WinZip Malware Protektor\wzmp_8.exe

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Avg antivirus\avg-anti-virus-free.exe

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Malware kostenlos löschen\mbam-setup-2.0.4.1028_CB-DL-Manager.exe

C:\Windows\System32\ColorMedia.dll

D:\avira-free-antivir.exe

E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-02-15 130056\Backup files 90.zip

E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-12-29 114041\Backup files 1.zip

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\PCSChecker[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\spstub[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AMY3HMH1\spstub[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3C6H11A\welcome[1].htm

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsc100C.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsfE7B3.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsi55F7.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsiC4A.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nss14AF.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsx4F03.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy10ED.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy111.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsyFB46.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\optprosetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\Search_Protect_non_Google_setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\MyBabylonTB.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\Setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\is1438683437\MyBabylonTB.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssE277\SpSetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssEAA1\SpSetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\4CD5A95ACD28415B8061889AD83EE40C\Search_Protect_non_G.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\CAD2C8041E264DF38C368E2D73AFD0A6\sp-downloader.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
Emptytemp:
         
*****************

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\2 WinZip Malware Protektor\wzmp_8.exe => Moved successfully.
C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Avg antivirus\avg-anti-virus-free.exe => Moved successfully.
C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Malware kostenlos löschen\mbam-setup-2.0.4.1028_CB-DL-Manager.exe => Moved successfully.
C:\Windows\System32\ColorMedia.dll => Moved successfully.
D:\avira-free-antivir.exe => Moved successfully.
E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-02-15 130056\Backup files 90.zip => Moved successfully.
E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-12-29 114041\Backup files 1.zip => Moved successfully.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\PCSChecker[1].exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\spstub[1].exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AMY3HMH1\spstub[1].exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3C6H11A\welcome[1].htm" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsc100C.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsfE7B3.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsi55F7.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsiC4A.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nss14AF.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsx4F03.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy10ED.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy111.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsyFB46.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\optprosetup.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\Search_Protect_non_Google_setup.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\MyBabylonTB.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\Setup.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\is1438683437\MyBabylonTB.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssE277\SpSetup.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssEAA1\SpSetup.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\4CD5A95ACD28415B8061889AD83EE40C\Search_Protect_non_G.exe" => File/Directory not found.
"G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\CAD2C8041E264DF38C368E2D73AFD0A6\sp-downloader.exe" => File/Directory not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Key deleted successfully.
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => Key not found. 
C:\Windows\system32\GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
EmptyTemp: => Removed 71.1 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 17:50:27 ====
         

Dann nochmal mit der externen Festplatte.
Hier die zweite Fixlog.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-01-2015
Ran by Administrator Jürgen at 2015-01-02 18:01:36 Run:2
Running from C:\Users\Administrator Jürgen\Desktop
Loaded Profile: Administrator Jürgen (Available profiles: Administrator Jürgen & Sabrina)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\2 WinZip Malware Protektor\wzmp_8.exe

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Avg antivirus\avg-anti-virus-free.exe

C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Malware kostenlos löschen\mbam-setup-2.0.4.1028_CB-DL-Manager.exe

C:\Windows\System32\ColorMedia.dll

D:\avira-free-antivir.exe

E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-02-15 130056\Backup files 90.zip

E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-12-29 114041\Backup files 1.zip

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\PCSChecker[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\spstub[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AMY3HMH1\spstub[1].exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3C6H11A\welcome[1].htm

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsc100C.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsfE7B3.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsi55F7.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsiC4A.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nss14AF.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsx4F03.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy10ED.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy111.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsyFB46.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\optprosetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\Search_Protect_non_Google_setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\MyBabylonTB.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\Setup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\is1438683437\MyBabylonTB.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssE277\SpSetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssEAA1\SpSetup.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\4CD5A95ACD28415B8061889AD83EE40C\Search_Protect_non_G.exe

G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\CAD2C8041E264DF38C368E2D73AFD0A6\sp-downloader.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User: Group Policy restriction detected <======= ATTENTION
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
Emptytemp:
         
*****************

"C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\2 WinZip Malware Protektor\wzmp_8.exe" => File/Directory not found.
"C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Avg antivirus\avg-anti-virus-free.exe" => File/Directory not found.
"C:\Users\Administrator Jürgen\Desktop\zum Drucken\div neue Software\Malware kostenlos löschen\mbam-setup-2.0.4.1028_CB-DL-Manager.exe" => File/Directory not found.
"C:\Windows\System32\ColorMedia.dll" => File/Directory not found.
"D:\avira-free-antivir.exe" => File/Directory not found.
"E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-02-15 130056\Backup files 90.zip" => File/Directory not found.
"E:\LAPTOPJN\Backup Set 2014-02-15 130056\Backup Files 2014-12-29 114041\Backup files 1.zip" => File/Directory not found.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Babylon\Setup\Setup.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\PCSChecker[1].exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGHIWS7A\spstub[1].exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AMY3HMH1\spstub[1].exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3C6H11A\welcome[1].htm => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsc100C.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsfE7B3.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsi55F7.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsiC4A.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nss14AF.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsx4F03.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy10ED.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsy111.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nsyFB46.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\optprosetup.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\PCSChecker.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\Search_Protect_non_Google_setup.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\MyBabylonTB.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\16FA25E0-BAB0-7891-924E-36C23147A2AB\Setup.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\is1438683437\MyBabylonTB.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssE277\SpSetup.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Local\Temp\nssEAA1\SpSetup.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\4CD5A95ACD28415B8061889AD83EE40C\Search_Protect_non_G.exe => Moved successfully.
G:\2014-12-05 Appdata\Users\Administrator Jürgen\AppData\Roaming\OpenCandy\CAD2C8041E264DF38C368E2D73AFD0A6\sp-downloader.exe => Moved successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => Key not found. 
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => Key not found. 
"C:\Windows\system32\GroupPolicyUsers\S-1-5-21-1707432137-198735931-3728340409-1001\User" => File/Directory not found.
HKU\S-1-5-21-1707432137-198735931-3728340409-1000\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found. 
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => Key not found. 
EmptyTemp: => Removed 13.5 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 18:01:44 ====
         

Nun zu Windows Repair All in one:
Programm scheint sich minimal geändert zu haben.
Das in der Bildbeschreibung zwischen 3. und 4. aufgeführte Bestätigungsfenster kam bei mir nicht. Alles andere war wie beschrieben

Als Zwischeninfo: Mein schraffierter und achtfacher Bildschirm ist immer noch da.

Gruß
j.newton

Geh mal bitte in die Anezigeoptionen (Rechtsklick auf dem Desktop > Auflösung) und mach mir von dem Fenster bitte einen Screenshot.

Hallo Schrauber,

habe Dir zuerst einmal ein Foto (siehe Anhang .jpg) von meinem Desktop mit der Digitalkamera gemacht, da der Screenshot nicht den Live-Betrieb abbildet.

Der Screenshot ist im "Anhang .doc" zu sehen. Habe diesen hier mit Strg+V nicht reinbekommen.
Verwunderlich ist, dass hier keine Daten der Grafikkarte angezeigt werden. Ich habe eine "Nvidia GeForce 8400M". steht so zumindest auf der Rechnung aus dem Jahr 2008 drauf.

Das ist doch der richtige Treiber oder?
hxxp://www.nvidia.de/download/driverResults.aspx/77233/de

War auch der Meinung, das ich diesen drüber installiert hatte.

Gruß
j.newton

... siehe auch vorherigen Eintrag.

Hier noch die fehlenden Screenshot´s im Anhang.

Wie gesagt, ich kann den Screenshot mit Strg+V hier nicht einfügen. Mit den Log´s funktioniert es noch. komisch oder.

Konnte zwar den Screenshot in eine doc-Datei einfügen und speichern. Diese Datei war jedoch zu groß für dieses Forum. PDF-Creator funktioniert jetzt auch nicht mehr. Habe die Doc-Datei nun kurzerhand ausgedruckt und wieder eingescannt.

Komisch ist auch, dass der Screenshot nur in einfacher Darstellung erscheint, obwohl bei mir alles achtfach zu sehen ist => siehe Foto mit der DigiCam.

Gruß
J.Newton

Warum steht denn die Auflösung so niedrig, auf 800x600? Stell die mal hoch.

WObei der fette schwarze Balken in der Mitte des Desktops ja so aussieht als hättest Du nen Hardwareschaden.

Auflösung läßt sich nicht höher stellen. Mich wundert ja auch, dass unter Grafikkarteninformationen überall "keine Informationen" steht. Siehe hierzu auch "Scan Screenshot2" in der letzten Antwort. Als Treiber ist "VGASave" angegeben.
Ist das vielleicht so eine Art Notbetrieb?
Hat es meine Grafikkartensoftware zerrissen oder vielleicht sogar die Grafikkarte selbst.

Kann ich das irgendwie testen?

Weiterhin wundert mich, dass per Screenshot alles sehr gut aussieht, nur im Echtbetrieb alles anders aussieht. Greift der Screenshot die Daten irgendwie vorher ab, sodass diese Daten bis Sie auf dem Bildschirm ankommen nochmal gestört werden, oder auch erst dann über die Grafikkarte geleitet werden. Das ganze sieht übrigens auch beim hochbooten schon so aus.

Nur zwischendurch hatte sich das auf einmal von selbst wieder normalisiert (hatte ich hier aber auch kurz erwähnt). Hatte aber nicht lange angehalten. Dies würde wiederum gegen einen Softwarefehler sprechen, da sich dieser ja nicht von alleine repariert und wieder kaputt geht. Es sei den die Software wird von etwas anderem gestört oder unterdrückt.

Hartwarefehler? Dann würden doch meine Grafikkarteninfo´s nicht so bescheuert aussehen. Und es wäre ein dummer Zufall, da dies just in dem Moment passiert ist als ich mir die Seuche eingefangen habe.

Hab im Anhang aus dem Gerätemanager die Eigenschaften der Grafikkarte per Screenshot in .doc kopiert und als PDF umgewandelt.
Irgendwas ist da nicht in Ordnung.

Was soll ich als nächstes tun?

Gruß
J.newton

Grafiktreiber beim Hersteller neu laden und instalieren.