Win32/Conduit.SearchProtect.H

schaule · 19.01.2015, 04:14

Hallo ich habe beim Eset online Scanner die Meldung bekomme das ich die obengeannte malware aufm Rechner habe ,
Kann mir da jemand helfen wie ich die wieder loskriege.
Hier der Frst Log

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 03
Ran by Florian (administrator) on FLORIAN-PC on 19-01-2015 01:41:42
Running from D:\Installationsprogramme\Antivirensoftware
Loaded Profiles: Florian (Available profiles: Florian)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(TeamViewer GmbH) D:\Programme\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
() C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Malwarebytes Corporation) D:\Programme\Malwarebytes\ Malwarebytes Anti-Malware \mbam.exe
(Malwarebytes Corporation) D:\Programme\Malwarebytes\mbar\mbar\mbar.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1609296 2010-06-26] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [696320 2011-11-18] ()
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2012-08-24] (AVM Berlin)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> DefaultScope {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1211151.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\ebay-kleinanzeigen-.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\myvideo.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube.xml
FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\abs@avira.com [2014-12-12]
FF Extension: German Dictionary - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\de-DE@dictionaries.addons.mozilla.org [2014-08-16]
FF Extension: DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Add to Search Bar - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\add-to-searchbox@maltekraus.de.xpi [2014-08-16]
FF Extension: Classic Theme Restorer - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-08-16]
FF Extension: Get Mail Plus [de] - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\getmail@webdesigns.ms11.net.xpi [2014-08-16]
FF Extension: Linky - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\linky@gemal.dk.xpi [2014-08-16]
FF Extension: Hide Tab Bar With One Tab - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi [2014-08-16]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Florian\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-06-19] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-19] (BlueStack Systems, Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed]
S3 TDslMgrService; D:\Programme\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) [File not signed]
R2 TeamViewer; D:\Programme\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2010-10-27] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2010-09-30] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WOTUpdater; C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-08-24] (AVM Berlin)
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [30208 2006-11-07] (AVM GmbH) [File not signed]
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-06-19] (BlueStack Systems)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-24] (AVM GmbH)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2015-01-19] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-19] (Malwarebytes Corporation)
S3 PciDumpr; C:\Program Files (x86)\Common Files\T-Com\DSLCheck\PciDumpr.sys [2144 2001-01-26] () [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-24] (TuneUp Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 18:39 - 2015-01-15 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-14 19:16 - 2015-01-14 19:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-14 18:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 18:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 18:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 18:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 18:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 18:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 18:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 18:05 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 18:05 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 18:05 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 18:05 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 18:05 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 18:05 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-12 22:29 - 2015-01-12 22:30 - 00000000 ____D () C:\Users\Florian\Downloads\Bearbeiten für JHV
2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-28 15:37 - 2014-12-28 15:37 - 00000669 _____ () C:\Users\Florian\Desktop\teXXas.lnk
2014-12-25 21:34 - 2014-12-25 21:34 - 00000000 ____D () C:\Users\Florian\Documents\eRightSoft
2014-12-22 20:23 - 2014-12-22 20:23 - 00017044 ____N () C:\Users\Florian\Haus Farbenliste.odt
2014-12-20 19:26 - 2014-12-20 19:26 - 00001468 _____ () C:\Users\Public\Desktop\LibreOffice 4.2.lnk
2014-12-20 19:26 - 2014-12-20 19:26 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 01:41 - 2014-08-24 20:37 - 00000000 ____D () C:\FRST
2015-01-19 01:35 - 2014-01-05 23:18 - 00000000 ____D () C:\AdwCleaner
2015-01-19 01:26 - 2014-08-24 21:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-19 01:24 - 2010-05-12 20:21 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{61D97D25-2BEF-4AEC-A94F-510529E28523}
2015-01-19 01:14 - 2012-03-25 12:31 - 00083119 _____ () C:\Users\Florian\Fahrtenbuch.ods
2015-01-19 01:14 - 2010-05-09 12:35 - 00000000 ____D () C:\Users\Florian
2015-01-19 00:57 - 2014-12-14 00:15 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-19 00:54 - 2012-12-02 23:26 - 00000000 ____D () C:\Users\Florian\.BH
2015-01-19 00:54 - 2012-07-08 01:26 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-19 00:46 - 2012-08-15 17:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 00:18 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-19 00:18 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-19 00:14 - 2014-06-29 17:52 - 01734196 _____ () C:\Windows\WindowsUpdate.log
2015-01-19 00:10 - 2014-10-05 18:31 - 00117602 _____ () C:\Windows\PFRO.log
2015-01-19 00:10 - 2014-10-05 00:00 - 04034561 _____ () C:\Windows\setupact.log
2015-01-19 00:10 - 2012-07-08 01:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-19 00:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-18 14:17 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Verzeichnisse
2015-01-18 02:43 - 2014-08-17 14:14 - 00000000 ____D () C:\Users\Florian\dwhelper
2015-01-17 21:07 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Internet
2015-01-17 19:28 - 2010-12-19 00:56 - 00000000 __SHD () C:\Users\Florian\wc
2015-01-17 16:49 - 2014-01-06 03:24 - 00181248 _____ () C:\Users\Florian\Einausgaben.xls
2015-01-17 00:05 - 2013-09-30 20:39 - 00095232 _____ () C:\Users\Florian\Arbeitszeitnachweis.xls
2015-01-16 23:29 - 2011-12-20 19:18 - 00000099 _____ () C:\Users\Public\LMDebug.log
2015-01-15 23:14 - 2012-10-31 19:42 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2015-01-15 22:31 - 2012-05-05 15:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-15 20:36 - 2009-07-14 18:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-01-15 20:36 - 2009-07-14 18:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-01-15 20:36 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-15 20:35 - 2014-10-29 19:53 - 00000000 ____D () C:\Users\Florian\Freundeskreis
2015-01-15 20:30 - 2010-05-13 23:41 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\VSO
2015-01-15 20:09 - 2012-08-15 17:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-15 20:09 - 2012-03-30 13:31 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-15 20:09 - 2012-01-14 19:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-15 20:09 - 2010-05-13 16:52 - 01025024 ___SH () C:\Users\Florian\Thumbs.db
2015-01-14 19:58 - 2013-07-18 14:49 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 19:54 - 2010-05-13 14:03 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 19:23 - 2010-05-13 20:38 - 00077981 _____ () C:\Windows\cdplayer.ini
2015-01-13 19:02 - 2014-01-06 02:51 - 00028851 _____ () C:\Users\Florian\Haus Zählerstände Haus.ods
2015-01-11 16:31 - 2012-09-09 16:34 - 00000000 ____D () C:\Users\Florian\AppData\Local\CrashDumps
2015-01-10 18:24 - 2014-06-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-01-10 18:24 - 2010-05-13 14:13 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2
2015-01-10 18:23 - 2010-07-08 13:11 - 00000000 ____D () C:\Users\Florian\AppData\Local\Downloaded Installations
2015-01-10 15:24 - 2010-05-13 21:57 - 00000000 ____D () C:\ProgramData\DVD Shrink
2015-01-07 00:35 - 2011-06-09 20:07 - 00000000 ____D () C:\ProgramData\tmp
2015-01-07 00:23 - 2010-05-10 18:41 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2015-01-05 15:46 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-01-03 01:13 - 2010-05-14 13:52 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Winamp
2015-01-03 01:13 - 2010-05-10 18:14 - 00000000 ____D () C:\ProgramData\CanonIJ
2015-01-03 01:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-02 01:16 - 2010-05-14 12:57 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Media Player Classic
2014-12-28 17:56 - 2009-07-14 05:45 - 00673912 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-28 16:54 - 2014-08-12 23:56 - 00121688 _____ () C:\Users\Florian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-26 02:16 - 2010-06-06 18:20 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-25 22:52 - 2014-07-26 17:40 - 00000691 _____ () C:\Users\Public\Desktop\dm-Fotowelt.lnk
2014-12-22 20:53 - 2012-12-02 14:32 - 00040645 ____N () C:\Users\Florian\Kalender.ods
2014-12-22 20:51 - 2012-11-01 22:12 - 00112898 ____N () C:\Users\Florian\geburtstagskalender.ods
2014-12-22 20:47 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\cover
2014-12-20 20:23 - 2010-11-07 22:34 - 00000673 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-12-20 19:26 - 2014-02-17 21:19 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4

==================== Files in the root of some directories =======
2010-05-28 18:58 - 2013-05-12 21:00 - 0000192 _____ () C:\Users\Florian\AppData\Roaming\default.rss
2010-05-28 18:58 - 2010-05-28 18:58 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\downloads.m3u
2014-08-17 11:56 - 2014-11-28 18:57 - 0015360 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-07-02 21:31 - 2010-07-02 21:32 - 0000333 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\avgnt.exe
C:\Users\Florian\AppData\Local\Temp\RegSvr32User.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 18:17

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

hier noch der GMER file

Code:

ATTFilter

MER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-19 04:06:46
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000062 Hitachi_ rev.ST6O 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Florian\AppData\Local\Temp\pwdiyfob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448                                                                                                                                fffff800033b0000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495                                                                                                                                fffff800033b002f 23 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                      0000000076571401 2 bytes JMP 7725b21b C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                        0000000076571419 2 bytes JMP 7725b346 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                      0000000076571431 2 bytes JMP 772d8ea9 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                      000000007657144a 2 bytes CALL 772348ad C:\Windows\syswow64\KERNEL32.dll
.text     ...                                                                                                                                                                                               * 9
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                         00000000765714dd 2 bytes JMP 772d87a2 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                  00000000765714f5 2 bytes JMP 772d8978 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                         000000007657150d 2 bytes JMP 772d8698 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                  0000000076571525 2 bytes JMP 772d8a62 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                        000000007657153d 2 bytes JMP 7724fca8 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                             0000000076571555 2 bytes JMP 772568ef C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                      000000007657156d 2 bytes JMP 772d8f61 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                        0000000076571585 2 bytes JMP 772d8ac2 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                           000000007657159d 2 bytes JMP 772d865c C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                        00000000765715b5 2 bytes JMP 7724fd41 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                      00000000765715cd 2 bytes JMP 7725b2dc C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                  00000000765716b2 2 bytes JMP 772d8e24 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                  00000000765716bd 2 bytes JMP 772d85f1 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                      0000000076571401 2 bytes JMP 7725b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                        0000000076571419 2 bytes JMP 7725b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                      0000000076571431 2 bytes JMP 772d8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                      000000007657144a 2 bytes CALL 772348ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                               * 9
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                         00000000765714dd 2 bytes JMP 772d87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                  00000000765714f5 2 bytes JMP 772d8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                         000000007657150d 2 bytes JMP 772d8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                  0000000076571525 2 bytes JMP 772d8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                        000000007657153d 2 bytes JMP 7724fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                             0000000076571555 2 bytes JMP 772568ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                      000000007657156d 2 bytes JMP 772d8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                        0000000076571585 2 bytes JMP 772d8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                           000000007657159d 2 bytes JMP 772d865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                        00000000765715b5 2 bytes JMP 7724fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                      00000000765715cd 2 bytes JMP 7725b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                  00000000765716b2 2 bytes JMP 772d8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                  00000000765716bd 2 bytes JMP 772d85f1 C:\Windows\syswow64\kernel32.dll
---- Processes - GMER 2.1 ----

Process   C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe (*** suspicious ***) @ C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [2492](2012-01-12 10:23:20)                                0000000000120000

---- Registry - GMER 2.1 ----

Reg       HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Florian\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 2.1 ----

Malwarebyte gibt die meldung das es an der Datei CltMngSVC.exe liegt

schrauber · 19.01.2015, 06:40

Hi,

Addition.txt von FRST fehlt noch. Log von MBAM? Log von ESET Onlinescanner?

schaule · 19.01.2015, 15:07

Hier die Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-01-2015 03
Ran by Florian at 2015-01-19 10:16:01
Running from D:\Installationsprogramme\Antivirensoftware
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-PDF Printer 8.2.0.1406 (HKLM\...\7-PDF Printer_is1) (Version: 8.2.0.1406 - 7-PDF, Germany - Th. Hodes)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version:  - ArcSoft)
ATI AVIVO64 Codecs (Version: 10.10.0.40918 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{B85D868D-1415-FDA5-8DB9-D4D457080885}) (Version: 3.0.745.0 - ATI Technologies, Inc.)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
AVM FRITZ!Box AddOn (IE) (x64) (HKLM\...\{EC3671D7-98AC-4951-8FFD-5556BE066137}) (Version: 1.7.0 - AVM Berlin)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
BilderHerunterlader 3.6.6 (HKLM-x32\...\BilderHerunterlader) (Version:  - )
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{9D84E30F-6757-4A56-BCB5-51ADE3AE8631}) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
Brother P-touch Editor 5.1 (HKLM-x32\...\{39270390-A851-4E4B-94A9-D5C468216ED3}) (Version: 5.1.0200 - Brother Industries, Ltd.)
Brother P-touch Update Software (HKLM-x32\...\{42036760-2DA4-43C4-A48A-9F90A0F1FA0E}) (Version: 1.0.0060 - Brother Industries, Ltd.)
CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden
Canon iP3300 (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3300) (Version:  - )
Canon iP3300 Benutzerregistrierung (HKLM-x32\...\Canon iP3300 Benutzerregistrierung) (Version:  - )
Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version:  - )
CanoScan LiDE 200 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4807) (Version:  - )
ccc-core-static (x32 Version: 2009.0918.2132.36825 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CDex extraction audio (HKLM-x32\...\CDex) (Version:  - )
Cefic ERICards Offline (Remove only) (HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\...\Ericards.NET) (Version: 3.4.0.0 - Pharox Automatisering B.V.)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2312.02 - CyberLink Corp.)
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
DolbyFiles (x32 Version: 2.0 - Nero AG) Hidden
DSL-Manager (HKLM-x32\...\{90A455A7-0FC8-4508-B7FA-8F135B8F041A}) (Version:  - )
DVD Shrink 3.2 deutsch (HKLM-x32\...\DVD Shrink DE_is1) (Version:  - DVD Shrink)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
FileZilla Client 3.9.0.5 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)
Geogrid®-Viewer (x32 Version: 6.30.0000 - EADS Deutschland GmbH) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HomeGallery 1.5.0 (HKLM-x32\...\HomeGallery_is1) (Version:  - Stefan Heymann)
HydraVision (x32 Version: 4.2.114.0 - ATI Technologies Inc.) Hidden
ICQ7.6 (HKLM-x32\...\{7644E42D-B096-457F-8B5B-901238FC81AE}) (Version: 7.6 - ICQ)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Inkjet Printer/Scanner Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version:  - )
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
K-Lite Codec Pack (64-bit) v4.1.0 (HKLM\...\KLiteCodecPack64_is1) (Version: 4.1.0 - )
K-Lite Codec Pack 6.6.0 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 6.6.0 - )
LibreOffice 4.2.8.2 (HKLM-x32\...\{2D3234B2-FC7B-41CD-9FC8-4F9C2C20C131}) (Version: 4.2.8.2 - The Document Foundation)
LingoPad 2.6 (Build 360) (HKLM-x32\...\LingoPad_is1) (Version: 2.6 - Lingo4you)
Logitech Motion Detector Gadget (HKLM\...\{5FCF5515-4CC4-4812-8C9A-755336AB85F8}) (Version: 1.00.1082 - Ihr Firmenname)
Logitech SetPoint 6.15 (HKLM\...\SP6) (Version: 6.15.25 - Logitech)
Logitech Webcam Software-Treiberpaket (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Menu Templates - Starter Kit (x32 Version: 9.4.6.0 - Nero AG) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access database engine 2010 (German) (HKLM-x32\...\{90140000-00D1-0407-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM-x32\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSI to redistribute MS VS2005 CRT libraries (HKLM-x32\...\{A8D93648-9F7F-407D-915C-62044644C3DA}) (Version: 8.0.50727.42 - The Firebird Project)
MSI to redistribute MS VS2005 CRT libraries (HKLM-x32\...\{EBFC96E5-4409-426E-88B7-650ADB342E78}) (Version: 8.0.50727.42 - The Firebird Project)
MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 (HKLM-x32\...\{e0b22685-7d0a-4754-91a5-71a010985185}) (Version:  - Nero AG)
NHL™ 09 (HKLM-x32\...\{827B97A9-B347-4110-9F89-37AF2B758F94}) (Version: 2.0.1.0 - Electronic Arts)
Nokia Connectivity Cable Driver (HKLM-x32\...\{2D99A593-C841-43A7-B7C9-D6F3AE70B756}) (Version: 7.1.45.0 - Nokia)
Nokia PC Suite (HKLM-x32\...\Nokia PC Suite) (Version: 7.1.62.1 - Nokia)
Nokia PC Suite (x32 Version: 7.1.62.1 - Nokia) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.5 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{C373F7C4-05D2-4047-96D1-6AF30661C6AA}) (Version: 11.4.21.0 - Nokia)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
QuickTime Alternative 3.2.2 (HKLM-x32\...\QuicktimeAlt_is1) (Version: 3.2.2 - )
Real Alternative 2.0.2 (HKLM-x32\...\RealAlt_is1) (Version: 2.0.2 - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5953 - Realtek Semiconductor Corp.)
Samsung SCX-3200 Series (HKLM-x32\...\Samsung SCX-3200 Series) (Version: __VERSION__ - Samsung Electronics Co., Ltd.)
sceptros (1.1.1.1) (HKLM-x32\...\sceptros_is1) (Version:  - P.Adler)
Setup Simulationsprogramm Integrierte Leitstelle (HKLM-x32\...\{DE15240E-AD3F-4374-AC82-490AAB877A07}) (Version: 4.3 - Kammerbauer GbR)
SoundTrax (x32 Version: 4.4.37.1 - Nero AG) Hidden
SpeedCommander 10 (HKLM-x32\...\SpeedCommander 10) (Version: 10.0 - SpeedProject)
SUPER © v2014.build.61+Recorder (2014/06/19) Version v2014.buil (HKLM-x32\...\{8E2A18E2-96AF-8549-4DE7-5C06B75719A4}_is1) (Version: v2014.build.61+Recorder - eRightSoft)
SUPER © v2014.build.63+Recorder (2014/11/27) Version v2014.buil (HKLM-x32\...\{8E2A19E2-96BF-8659-4DA7-5C06C90719A4}_is1) (Version: v2014.build.63+Recorder - eRightSoft)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36897 - TeamViewer)
teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Top50 V5 Viewer (HKLM-x32\...\{6594F5B0-350C-42AC-A613-F980B88BDB64}) (Version: 6.30.0000 - EADS Deutschland GmbH)
TuneUp Utilities (HKLM-x32\...\TuneUp Utilities) (Version: 9.0.4700.21 - TuneUp Software)
TuneUp Utilities (x32 Version: 9.0.4700.21 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.4700.21 - TuneUp Software) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VSO Image Resizer 3.0.1.76 (HKLM-x32\...\{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1) (Version: 3.0.1.76 - VSO-Software)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Nokia Modem  (02/25/2011 4.7) (HKLM\...\E0AC723A3DE3A04256288CADBBB011B112AED454) (Version: 02/25/2011 4.7 - Nokia)
Windows-Treiberpaket - Nokia Modem  (02/25/2011 7.01.0.9) (HKLM\...\72A50F48CC5601190B9C4E74D81161693133E7F7) (Version: 02/25/2011 7.01.0.9 - Nokia)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D) (Version: 08/22/2008 7.0.0.0 - Nokia)
XynX! NetJet 3.0 (HKLM-x32\...\XynX! NetJet_is1) (Version: 3.0 - XynX!)
XynX! NetJet 3.1 (HKLM-x32\...\{5AF09C8C-96A6-46DF-9006-51FC552E38DB}_is1) (Version: 3.1 - XynX!)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-01-2015 16:29:17 Geplanter Prüfpunkt
03-01-2015 01:11:54 Wiederherstellungsvorgang
14-01-2015 18:24:20 Geplanter Prüfpunkt
14-01-2015 19:54:23 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-02-03 13:46 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3501A96D-7D76-49A6-89C1-9D4CC5A594BD} - System32\Tasks\{6CC98E2B-9BE5-462B-B369-42069058EAD6} => Firefox.exe 
Task: {456917AC-305D-4750-9A8A-97CE3358DACB} - System32\Tasks\{F44ECDBE-298A-40D7-98D3-C0FF3FE1E600} => Firefox.exe 
Task: {601D5388-3E87-4821-B528-5EAAB4552D9E} - System32\Tasks\{C549D747-D157-44A3-B17F-90B8555BB588} => Firefox.exe 
Task: {6AACC338-2AEB-415A-AA0F-6EECC5CE3888} - System32\Tasks\{17CD3FDE-47B6-4A20-B087-66B52DE14763} => pcalua.exe -a "C:\Users\Florian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\67QQDUW5\Firefox%20Setup%203.6.3[1].exe" -d C:\Users\Florian\Desktop
Task: {72E115C5-3CFC-4168-B3C3-D857A10673FA} - System32\Tasks\{8BDA699B-E140-4568-84AA-41BE9AA72E88} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
Task: {827EDDF5-D8A3-4686-8C59-C02451199847} - System32\Tasks\{749E0A3A-4B7C-4FE9-8938-E83057C9F759} => Firefox.exe 
Task: {9EB6674B-35E0-4123-9297-50E920CF9ADB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-08] (Google Inc.)
Task: {A0B7EF38-F73B-4138-8877-B6807C9F13FD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-08] (Google Inc.)
Task: {A4B1FEF0-AC9E-458B-A51E-B56A120387D9} - System32\Tasks\{55D49C19-D136-4A82-BB84-2687B47C5BF1} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {A6BFE4FB-49E1-4C00-A6BA-06FC0EBC463F} - \EPUpdater No Task File <==== ATTENTION
Task: {AA24DB11-CA45-423B-BCC5-855FF7D8B0F4} - System32\Tasks\{ED1502EC-54FB-4E08-A6C0-E820F96C49B8} => Firefox.exe 
Task: {AFD7E2E9-2406-488E-B25F-A63F88F68986} - System32\Tasks\Amazon Music Helper => C:\Users\Florian\AppData\Local\Amazon Music\Amazon Music Helper.exe
Task: {B1BC65B8-59E2-46BC-99F4-A0CC526EA5C8} - System32\Tasks\{8A8F8A70-821C-407C-81ED-A9EE9E8BA180} => Firefox.exe hxxp://ui.skype.com/ui/0/4.2.0.155.259/de/abandoninstall?source=lightinstaller&amp;page=tsMain&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2
Task: {B37247B5-5BD7-40C4-9D77-6C7F85F15DF1} - System32\Tasks\{A805A452-D41C-4266-AE6F-CEBC6B821C20} => D:\Programme\Nettalk6\Nettalk.exe
Task: {B6331BA2-6297-4306-A4BE-5040E4A85628} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {D9DE150F-7E85-41AD-8A1C-D828CD6ABA37} - System32\Tasks\CCleanerSkipUAC => D:\Programme\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {DE071E9B-54DC-424D-A665-E50F611ED24C} - System32\Tasks\{DCBA626F-B7C2-4F6F-A3F9-2EF5298B50F1} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
Task: {F00DBBA9-811A-4C49-B924-3DB7864C713E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-15] (Adobe Systems Incorporated)
Task: {F2BD1B92-FC98-4834-A091-8B040C1021E2} - System32\Tasks\{6A91AEF7-FE4B-4F0C-A8BF-51DB259DA302} => pcalua.exe -a "C:\Program Files (x86)\Avira\AntiVir Desktop\setup.exe" -c /REMOVE
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-01-12 03:54 - 2006-02-23 11:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2011-04-14 02:41 - 2011-04-14 02:41 - 00034304 _____ () C:\Windows\System32\ssb3ml6.dll
2011-04-14 02:40 - 2011-04-14 03:40 - 00968192 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\ssb3mdu.dll
2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () D:\Programme\FileZilla FTP Client\fzshellext_64.dll
2012-01-12 11:23 - 2012-01-12 11:23 - 00018432 _____ () C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe
2013-03-09 18:36 - 2011-11-18 11:22 - 00696320 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2013-03-09 18:36 - 2009-11-19 10:15 - 00306688 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2009-08-28 15:08 - 2009-08-28 15:08 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-05-09 12:38 - 2010-05-09 12:38 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2015-01-15 18:39 - 2015-01-15 18:39 - 03347056 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-01-15 18:39 - 2015-01-15 18:39 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-01-15 18:39 - 2015-01-15 18:39 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2015-01-14 19:16 - 2015-01-14 19:16 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: LogitechQuickCamRibbon => "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
MSCONFIG\startupreg: LWS => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
MSCONFIG\startupreg: QuickTime Task => "D:\Multimediaprogramme\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RemoteControl10 => "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
MSCONFIG\startupreg: Samsung PanelMgr => C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun

========================= Accounts: ==========================

Administrator (S-1-5-21-2977951965-3881512990-2941591932-500 - Administrator - Disabled)
Florian (S-1-5-21-2977951965-3881512990-2941591932-1001 - Administrator - Enabled) => C:\Users\Florian
Gast (S-1-5-21-2977951965-3881512990-2941591932-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2977951965-3881512990-2941591932-1004 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/19/2015 01:43:07 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/19/2015 01:41:36 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (11/13/2014 10:19:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1661 seconds with 960 seconds of active time.  This session ended with a crash.

Error: (05/18/2010 06:24:30 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6524.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 96 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/18/2010 06:22:47 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6524.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 205 seconds with 60 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2012-04-30 01:42:14.389
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:42:14.311
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:42:12.845
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:42:12.767
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:42:10.598
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:42:10.520
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:41:34.141
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-30 01:41:34.063
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Common Files\T-Com\DSLCheck\PCIDumpr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-02-03 13:45:55.746
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-02-03 13:45:55.684
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X4 630 Processor
Percentage of memory in use: 50%
Total physical RAM: 4095.24 MB
Available physical RAM: 2013.85 MB
Total Pagefile: 8188.67 MB
Available Pagefile: 5421.36 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:390.53 GB) (Free:313.97 GB) NTFS
Drive d: (Daten) (Fixed) (Total:263.67 GB) (Free:249.75 GB) NTFS
Drive e: (Medien) (Fixed) (Total:277.21 GB) (Free:247.11 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E274FB94)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=390.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=263.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=277.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================

mbam log

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 19.01.2015
Suchlauf-Zeit: 04:16:15
Logdatei: mbam log.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.18.12
Rootkit Datenbank: v2015.01.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Florian

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 363863
Verstrichene Zeit: 19 Min, 40 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)

(end)

den esetlog liefer ich nach

hier der eset Log

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=1
esets_scanner_update returned -1 esets_gle=1
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=816817d038fd0d459d35c1d83db2b7b0
# engine=22028
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-19 02:34:39
# local_time=2015-01-19 03:34:39 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 11796 15519933 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 13334524 173264729 0 0
# scanned=46737
# found=1
# cleaned=0
# scan_time=5262
sh=660F51E4BD7646C779D56A62D830CAB1506062A9 ft=1 fh=373ed73ae71d8649 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=816817d038fd0d459d35c1d83db2b7b0
# engine=22034
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-19 01:57:33
# local_time=2015-01-19 02:57:33 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 20785 15560907 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 13375498 173305703 0 0
# scanned=273889
# found=1
# cleaned=0
# scan_time=11785
sh=660F51E4BD7646C779D56A62D830CAB1506062A9 ft=1 fh=373ed73ae71d8649 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"

schrauber · 19.01.2015, 18:47

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Task: {A6BFE4FB-49E1-4C00-A6BA-06FC0EBC463F} - \EPUpdater No Task File <==== ATTENTION

Task: {B6331BA2-6297-4306-A4BE-5040E4A85628} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

schaule · 19.01.2015, 23:09

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-01-2015 03
Ran by Florian at 2015-01-19 23:02:17 Run:1
Running from D:\Installationsprogramme\Antivirensoftware
Loaded Profiles: Florian (Available profiles: Florian)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: {A6BFE4FB-49E1-4C00-A6BA-06FC0EBC463F} - \EPUpdater No Task File <==== ATTENTION

Task: {B6331BA2-6297-4306-A4BE-5040E4A85628} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Emptytemp:
         
*****************

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A6BFE4FB-49E1-4C00-A6BA-06FC0EBC463F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6BFE4FB-49E1-4C00-A6BA-06FC0EBC463F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EPUpdater" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B6331BA2-6297-4306-A4BE-5040E4A85628}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B6331BA2-6297-4306-A4BE-5040E4A85628}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar" => Key deleted successfully.
"HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
EmptyTemp: => Removed 62.7 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 23:02:27 ====

schrauber · 20.01.2015, 12:38

Frisches FRST Log bitte. Bestehen noch Probleme?

schaule · 20.01.2015, 12:47

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 03
Ran by Florian (administrator) on FLORIAN-PC on 20-01-2015 12:45:13
Running from D:\Installationsprogramme\Antivirensoftware
Loaded Profiles: Florian (Available profiles: Florian)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(TeamViewer GmbH) D:\Programme\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
() C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Frontend.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1609296 2010-06-26] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [696320 2011-11-18] ()
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2012-08-24] (AVM Berlin)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\...\RunOnce: [Adobe Speed Launcher] => 1421750065
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> DefaultScope {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1211151.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\ebay-kleinanzeigen-.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\myvideo.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube.xml
FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\abs@avira.com [2014-12-12]
FF Extension: German Dictionary - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\de-DE@dictionaries.addons.mozilla.org [2014-08-16]
FF Extension: DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Add to Search Bar - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\add-to-searchbox@maltekraus.de.xpi [2014-08-16]
FF Extension: Classic Theme Restorer - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-08-16]
FF Extension: Get Mail Plus [de] - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\getmail@webdesigns.ms11.net.xpi [2014-08-16]
FF Extension: Linky - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\linky@gemal.dk.xpi [2014-08-16]
FF Extension: Hide Tab Bar With One Tab - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi [2014-08-16]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Florian\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-06-19] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-19] (BlueStack Systems, Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed]
S3 TDslMgrService; D:\Programme\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) [File not signed]
R2 TeamViewer; D:\Programme\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2010-10-27] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2010-09-30] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WOTUpdater; C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-08-24] (AVM Berlin)
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [30208 2006-11-07] (AVM GmbH) [File not signed]
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-06-19] (BlueStack Systems)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-24] (AVM GmbH)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 PciDumpr; C:\Program Files (x86)\Common Files\T-Com\DSLCheck\PciDumpr.sys [2144 2001-01-26] () [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-24] (TuneUp Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 03:35 - 2015-01-19 03:35 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\194961DD.sys
2015-01-15 18:39 - 2015-01-15 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-14 19:16 - 2015-01-14 19:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-14 18:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 18:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 18:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 18:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 18:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 18:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 18:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 18:05 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 18:05 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 18:05 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 18:05 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 18:05 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 18:05 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-12 22:29 - 2015-01-20 00:38 - 00000000 ____D () C:\Users\Florian\Downloads\Bearbeiten für JHV
2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-28 15:37 - 2014-12-28 15:37 - 00000669 _____ () C:\Users\Florian\Desktop\teXXas.lnk
2014-12-25 21:34 - 2014-12-25 21:34 - 00000000 ____D () C:\Users\Florian\Documents\eRightSoft
2014-12-22 20:23 - 2014-12-22 20:23 - 00017044 ____N () C:\Users\Florian\Haus Farbenliste.odt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-20 12:45 - 2014-08-24 20:37 - 00000000 ____D () C:\FRST
2015-01-20 11:55 - 2012-07-08 01:26 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-20 11:46 - 2012-08-15 17:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-20 11:45 - 2012-12-02 23:26 - 00000000 ____D () C:\Users\Florian\.BH
2015-01-20 11:41 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-20 11:41 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-20 11:37 - 2014-06-29 17:52 - 01837535 _____ () C:\Windows\WindowsUpdate.log
2015-01-20 11:37 - 2010-05-12 20:21 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{61D97D25-2BEF-4AEC-A94F-510529E28523}
2015-01-20 11:34 - 2012-07-08 01:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-20 11:33 - 2014-10-05 18:31 - 00119812 _____ () C:\Windows\PFRO.log
2015-01-20 11:33 - 2014-10-05 00:00 - 04144937 _____ () C:\Windows\setupact.log
2015-01-20 11:33 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-19 11:40 - 2014-08-17 14:14 - 00000000 ____D () C:\Users\Florian\dwhelper
2015-01-19 11:23 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Internet
2015-01-19 10:16 - 2014-08-24 21:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-19 03:58 - 2013-11-17 21:27 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-19 01:35 - 2014-01-05 23:18 - 00000000 ____D () C:\AdwCleaner
2015-01-19 01:14 - 2012-03-25 12:31 - 00083119 _____ () C:\Users\Florian\Fahrtenbuch.ods
2015-01-19 01:14 - 2010-05-09 12:35 - 00000000 ____D () C:\Users\Florian
2015-01-19 00:57 - 2014-12-14 00:15 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-18 14:17 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Verzeichnisse
2015-01-17 19:28 - 2010-12-19 00:56 - 00000000 __SHD () C:\Users\Florian\wc
2015-01-17 16:49 - 2014-01-06 03:24 - 00181248 _____ () C:\Users\Florian\Einausgaben.xls
2015-01-17 00:05 - 2013-09-30 20:39 - 00095232 _____ () C:\Users\Florian\Arbeitszeitnachweis.xls
2015-01-16 23:29 - 2011-12-20 19:18 - 00000099 _____ () C:\Users\Public\LMDebug.log
2015-01-15 23:14 - 2012-10-31 19:42 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2015-01-15 22:31 - 2012-05-05 15:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-15 20:36 - 2009-07-14 18:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-01-15 20:36 - 2009-07-14 18:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-01-15 20:36 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-15 20:35 - 2014-10-29 19:53 - 00000000 ____D () C:\Users\Florian\Freundeskreis
2015-01-15 20:30 - 2010-05-13 23:41 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\VSO
2015-01-15 20:09 - 2012-08-15 17:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-15 20:09 - 2012-03-30 13:31 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-15 20:09 - 2012-01-14 19:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-15 20:09 - 2010-05-13 16:52 - 01025024 ___SH () C:\Users\Florian\Thumbs.db
2015-01-14 19:58 - 2013-07-18 14:49 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 19:54 - 2010-05-13 14:03 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 19:23 - 2010-05-13 20:38 - 00077981 _____ () C:\Windows\cdplayer.ini
2015-01-13 19:02 - 2014-01-06 02:51 - 00028851 _____ () C:\Users\Florian\Haus Zählerstände Haus.ods
2015-01-11 16:31 - 2012-09-09 16:34 - 00000000 ____D () C:\Users\Florian\AppData\Local\CrashDumps
2015-01-10 18:24 - 2014-06-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-01-10 18:24 - 2010-05-13 14:13 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2
2015-01-10 18:23 - 2010-07-08 13:11 - 00000000 ____D () C:\Users\Florian\AppData\Local\Downloaded Installations
2015-01-10 15:24 - 2010-05-13 21:57 - 00000000 ____D () C:\ProgramData\DVD Shrink
2015-01-07 00:35 - 2011-06-09 20:07 - 00000000 ____D () C:\ProgramData\tmp
2015-01-07 00:23 - 2010-05-10 18:41 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2015-01-05 15:46 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-01-03 01:13 - 2010-05-14 13:52 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Winamp
2015-01-03 01:13 - 2010-05-10 18:14 - 00000000 ____D () C:\ProgramData\CanonIJ
2015-01-03 01:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-02 01:16 - 2010-05-14 12:57 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Media Player Classic
2014-12-28 17:56 - 2009-07-14 05:45 - 00673912 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-28 16:54 - 2014-08-12 23:56 - 00121688 _____ () C:\Users\Florian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-26 02:16 - 2010-06-06 18:20 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-25 22:52 - 2014-07-26 17:40 - 00000691 _____ () C:\Users\Public\Desktop\dm-Fotowelt.lnk
2014-12-22 20:53 - 2012-12-02 14:32 - 00040645 ____N () C:\Users\Florian\Kalender.ods
2014-12-22 20:51 - 2012-11-01 22:12 - 00112898 ____N () C:\Users\Florian\geburtstagskalender.ods
2014-12-22 20:47 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\cover

==================== Files in the root of some directories =======
2010-05-28 18:58 - 2013-05-12 21:00 - 0000192 _____ () C:\Users\Florian\AppData\Roaming\default.rss
2010-05-28 18:58 - 2010-05-28 18:58 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\downloads.m3u
2014-08-17 11:56 - 2014-11-28 18:57 - 0015360 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-07-02 21:31 - 2010-07-02 21:32 - 0000333 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 18:17

==================== End Of Log ============================

--- --- ---

schrauber · 20.01.2015, 17:59

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

19.01.2015, 06:40	#2
schrauber /// the machine /// TB-Ausbilder	Win32/Conduit.SearchProtect.H Hi, Addition.txt von FRST fehlt noch. Log von MBAM? Log von ESET Onlinescanner? __________________ __________________

20.01.2015, 12:38	#6
schrauber /// the machine /// TB-Ausbilder	Win32/Conduit.SearchProtect.H Frisches FRST Log bitte. Bestehen noch Probleme? __________________ --> Win32/Conduit.SearchProtect.H

Win32/Conduit.SearchProtect.H

Plagegeister aller Art und deren Bekämpfung: Win32/Conduit.SearchProtect.H