Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Plagegeister aller Art und deren Bekämpfung: Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 28.01.2015, 12:02   #1
Boris19
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Hallo,
Ich habe meinen Rechner mit Kaspersky, Antivir, Bitdefender, IObitmalware fighter und Panda
(Test- oder Freewareversionen) auf Viren überprüft.

Panda hat den Trojaner Trj/Chgt.H auf meinem Rechner, Windows 7 Ultimate, im Administrator Konto, entdeckt und in Quarantäne verschoben.

Welchen Schaden kann dieser Trojaner anrichten und was sollte ich unternehmen?

Trojaner erkannt Trj/Chgt.H 28.01.2015 00:15 Gelöscht Speicherort: C:\Users\Boris\AppData\Roaming\RHEng\8AD9C6BAB0274679BD312E8FF115BBCB\13443.exe

Vielen Dank im Voraus, Gruß Boris.

Alt 28.01.2015, 12:04   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 28.01.2015, 12:29   #3
Boris19
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Nein, abgesehen von Cookies gab es keine Funde in den letzten 7 Tagen.

Hier die Farbar`s Logfiles (ausgeführt im Benutzerkonto, richtig?)


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01
Ran by Internet (ATTENTION: The logged in user is not administrator) on BORIS-PC on 28-01-2015 12:13:45
Running from C:\Users\Internet\Downloads
Loaded Profiles: Boris & Internet (Available profiles: Boris & Internet & Administrator)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPStart.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe
(Spotify Ltd) C:\Users\Internet\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPStart] => C:\Program Files\Synaptics\SynTP\SynTPStart.exe [102400 2007-10-09] (Synaptics, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12111576 2015-01-19] (Realtek Semiconductor)
HKLM\...\Run: [IObit Malware Fighter] => C:\Program Files\IObit\IObit Malware Fighter\IMF.exe [1802048 2014-10-13] (IObit)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [PSUAMain] => C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Run: [Spotify Web Helper] => C:\Users\Internet\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-13] (Spotify Ltd)
HKU\S-1-5-18\...\Run: [Advanced SystemCare 8] => C:\Program Files\IObit\Advanced SystemCare 8\ASCTray.exe [2426144 2014-11-25] (IObit)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2011-11-29] (Microsoft Corporation)
IFEO\ActionCenterDownloader.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\bfsvc.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\chrmstp.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\fveupdate.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\hh.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\IObitDownloader.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\IsUn0407.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\MakeSFX.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SDInit.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SDSendBugReport.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SD_FreeSoftwareDownloader.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SmartDefrag.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\twunk_16.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\twunk_32.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroBackItUp.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroMediaHome.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroShowTime.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroVision.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNRecode.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\winhelp.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\winhlp32.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\write.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
BootExecute: autocheck autochk * SmartDefragBootTime.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: [S-1-5-21-1916616730-3355624969-3622577331-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
BHO: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\.DEFAULT -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKU\S-1-5-21-1916616730-3355624969-3622577331-1003 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/ig
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.72.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.72.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\searchplugins\suche-in-wikipedia.xml
FF SearchPlugin: C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\searchplugins\webde-suche.xml
FF Extension: Avira Browser Safety - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\abs@avira.com [2015-01-26]
FF Extension: HTTPS-Everywhere - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\https-everywhere@eff.org [2014-11-19]
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\iobitascsurfingprotection@iobit.com [2014-12-13]
FF Extension: Low Quality Flash - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\low_quality_flash@pie2k.com [2014-06-22]
FF Extension: No Name - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\trash [2015-01-26]
FF Extension: Bitdefender QuickScan - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-10-07]
FF Extension: Flash Killer - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\flashkiller@joli.clic.xpi [2014-06-22]
FF Extension: YouTube Flash to HTML5 - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\garg_sms@yahoo.in.xpi [2014-06-22]
FF Extension: Flash Control - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\jid1-sNL73VCI4UB0Fw@jetpack.xpi [2014-06-22]
FF Extension: Adblock Plus - C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\cd69l7t1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-26]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-02-27]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-08]
CHR Extension: (YouTube) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-27]
CHR Extension: (Google-Suche) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-27]
CHR Extension: (CrowdBar) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhinknkceoifkecnmmlgnelmdipmbcdn [2014-11-01]
CHR Extension: (Google Wallet) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-13]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2015-01-27]
CHR Extension: (Google Mail) - C:\Users\Internet\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-27]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.1.crx [2013-10-14]
CHR HKLM\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files\Common Files\Spigot\GC\ErrorAssistant_1.3.crx [2013-12-27]
CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\Boris\AppData\Local\Slick Savings\coupons.crx [Not Found]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx [2012-11-22]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService8; C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe [815392 2014-11-04] (IObit)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [344896 2014-09-30] (IObit)
R2 KSS; C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit)
R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 NanoServiceMain; C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
U2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)
S3 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19405768 2014-04-02] (NVIDIA Corporation)
R2 PandaAgent; C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
S3 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 PSUAService; C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
S3 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-05-14] ()
S3 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [134664 2014-05-29] (Sandboxie Holdings, LLC)
S3 UPnPService; C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [544768 2006-12-14] (Magix AG) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdsata; C:\Windows\system32\drivers\amdsata.sys [0 2011-03-11] () <==== ATTENTION (zero size file/folder)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)
R3 DCamUSBGene; C:\Windows\System32\DRIVERS\usbgene.sys [175360 2008-10-02] ()
S3 FileMonitor; C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [21480 2013-03-23] (IObit)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60552 2011-04-25] (FTDI Ltd.)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [23840 2015-01-19] (REALiX(tm))
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [88992 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [166816 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [110624 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [125216 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [40192 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [96160 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [61984 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [121888 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [288032 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [208800 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [109856 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [244000 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [96928 2014-06-04] (Panda Security, S.L.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2014-03-21] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [139536 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [105232 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [168208 2014-10-02] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [113936 2014-10-02] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [124688 2014-10-02] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [100112 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [48736 2014-03-25] (Panda Security, S.L.)
S3 RegFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [32288 2013-11-19] (IObit.com)
S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [160264 2014-05-29] (Sandboxie Holdings, LLC)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-02-13] ()
R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [62464 2007-09-27] (silex technology, Inc.)
S3 UrlFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [20944 2013-11-19] (IObit.com)
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [43520 2012-02-15] (Apple, Inc.) [File not signed]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\CyberLink\PowerDVD8\000.fcl [87536 2009-08-28] (CyberLink Corp.)
S3 mdf15; \??\C:\Program Files\Clarus\Samsung SecretZone\mdf15.sys [X]
S3 mvd21; \??\C:\Program Files\Clarus\Samsung SecretZone\mvd21.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 12:13 - 2015-01-28 12:15 - 00021304 _____ () C:\Users\Internet\Downloads\FRST.txt
2015-01-28 12:13 - 2015-01-28 12:13 - 01120768 _____ (Farbar) C:\Users\Internet\Downloads\FRST.exe
2015-01-28 12:13 - 2015-01-28 12:13 - 00000000 ____D () C:\FRST
2015-01-28 11:41 - 2015-01-28 11:41 - 00016216 _____ () C:\Users\Internet\Documents\Trojaner gelöscht Trj Chgt H.txt
2015-01-28 01:14 - 2015-01-28 01:14 - 00002225 _____ () C:\Users\Internet\Desktop\Panda GOLD Protection.lnk
2015-01-28 00:48 - 2015-01-28 00:48 - 01029224 _____ () C:\Users\Boris\Downloads\PANDAAP15.exe
2015-01-27 23:33 - 2015-01-27 23:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2015-01-27 23:29 - 2014-03-25 14:15 - 00048736 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2015-01-27 23:28 - 2015-01-27 23:33 - 00000000 ____D () C:\Program Files\Panda Security
2015-01-27 23:28 - 2015-01-27 23:28 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Panda Security
2015-01-27 23:28 - 2015-01-27 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda GOLD Protection
2015-01-27 23:23 - 2015-01-27 23:29 - 00000000 ____D () C:\ProgramData\Panda Security
2015-01-27 23:22 - 2015-01-27 23:22 - 01074080 _____ () C:\Users\Internet\Downloads\PANDAGL15.exe
2015-01-27 14:53 - 2015-01-27 14:53 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-27 14:53 - 2015-01-27 14:53 - 00000000 ____D () C:\Program Files\Kaspersky Lab
2015-01-27 14:45 - 2015-01-27 14:45 - 00416576 _____ (Kaspersky Lab) C:\Users\Internet\Downloads\de-de.setup.exe
2015-01-27 14:44 - 2015-01-27 14:45 - 00184192 _____ () C:\Users\Internet\Downloads\qsinstaller.exe
2015-01-27 14:44 - 2015-01-27 14:44 - 00184192 _____ () C:\Users\Internet\Downloads\qsinstaller (1).exe
2015-01-27 14:15 - 2015-01-27 14:15 - 00001885 _____ () C:\Users\Internet\Desktop\CheckDrive.lnk
2015-01-27 13:55 - 2015-01-27 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CheckDrive
2015-01-27 13:55 - 2015-01-27 14:28 - 00000000 ____D () C:\Program Files\CheckDrive
2015-01-26 21:49 - 2015-01-26 21:49 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Avira
2015-01-26 21:49 - 2015-01-26 21:46 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-01-26 21:32 - 2015-01-26 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-01-26 21:32 - 2015-01-26 21:32 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-01-26 21:31 - 2015-01-26 21:31 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-26 21:30 - 2015-01-26 21:43 - 00000000 ____D () C:\ProgramData\Avira
2015-01-26 21:24 - 2014-12-11 18:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-26 21:24 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-01-26 21:23 - 2015-01-26 21:23 - 00000513 _____ () C:\Users\Internet\Desktop\Programme und Funktionen - Verknüpfung.lnk
2015-01-26 21:05 - 2015-01-26 21:05 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Internet\Downloads\avira_de_av_5808697000__ws.exe
2015-01-26 01:17 - 2015-01-28 10:54 - 00000952 _____ () C:\Windows\setupact.log
2015-01-26 01:17 - 2015-01-27 12:19 - 00136338 _____ () C:\Windows\PFRO.log
2015-01-26 01:17 - 2015-01-26 01:17 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-26 01:10 - 2013-10-02 01:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-01-26 01:10 - 2013-10-02 01:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-01-26 01:10 - 2013-10-02 01:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-01-26 01:10 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-01-26 01:10 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-01-26 01:10 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-01-26 01:10 - 2013-10-02 00:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-01-26 01:10 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-01-26 01:10 - 2013-10-01 23:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-01-26 01:10 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-01-25 23:19 - 2015-01-25 23:24 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\Solvusoft
2015-01-25 23:19 - 2012-10-15 17:02 - 00017840 _____ (solvusoft) C:\Windows\system32\roboot.exe
2015-01-23 21:43 - 2015-01-23 21:43 - 00002266 _____ () C:\Users\Internet\Desktop\outlook fehler.JPG - Verknüpfung.lnk
2015-01-23 21:37 - 2015-01-23 21:37 - 00000891 _____ () C:\Users\Internet\Desktop\Hide.me.exe - Verknüpfung.lnk
2015-01-19 01:19 - 2015-01-19 01:19 - 00719576 _____ (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
2015-01-19 01:19 - 2015-01-19 01:19 - 00076872 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 71040000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes.dat
2015-01-19 00:58 - 2015-01-19 00:58 - 13789440 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 11878656 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO30.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 05804772 _____ () C:\Windows\system32\Drivers\rtvienna.dat
2015-01-19 00:58 - 2015-01-19 00:58 - 04713224 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 03343832 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHDA.sys
2015-01-19 00:58 - 2015-01-19 00:58 - 02588888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkPgExt.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 02513264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 02354544 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApoApi.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01468608 _____ (Conexant Systems Inc.) C:\Windows\system32\CX32APO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01443340 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-01-19 00:58 - 2015-01-19 00:58 - 01175888 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO50.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01145600 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO60.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01053208 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00945456 _____ (Nahimic Inc) C:\Windows\system32\NahimicAPONSControl.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00927448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoInstII.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00844192 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo2.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00818000 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO20.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00790272 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00519368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTACap.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00386072 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00326680 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00276128 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00087864 _____ () C:\Windows\system32\audioLibVc.dll
2015-01-19 00:45 - 2015-01-19 00:45 - 00023840 _____ (REALiX(tm)) C:\Windows\system32\Drivers\HWiNFO32.SYS
2015-01-15 08:43 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-15 08:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-15 08:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-15 08:42 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-15 08:42 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2014-12-31 01:53 - 2015-01-23 21:15 - 00000000 ____D () C:\Program Files\hide.me VPN
2014-12-31 01:53 - 2014-12-31 01:54 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\Hide.me
2014-12-31 01:53 - 2014-12-31 01:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hide.me VPN

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 11:59 - 2009-07-14 05:34 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-28 11:59 - 2009-07-14 05:34 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-28 11:22 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-01-28 11:01 - 2011-10-22 13:56 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-28 10:57 - 2013-01-21 02:48 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-01-28 10:54 - 2014-02-09 20:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-28 10:54 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-28 02:55 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing
2015-01-28 01:11 - 2014-11-23 10:51 - 00476304 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-28 00:32 - 2014-11-01 16:29 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Spotify
2015-01-27 23:28 - 2014-06-29 20:21 - 00127016 _____ () C:\Users\Internet\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-27 14:44 - 2011-11-26 15:18 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\QuickScan
2015-01-27 13:38 - 2014-07-02 16:15 - 01979316 _____ () C:\Windows\WindowsUpdate.log
2015-01-27 12:36 - 2014-06-21 12:38 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-27 12:31 - 2014-11-01 16:32 - 00000000 ____D () C:\Users\Internet\AppData\Local\Spotify
2015-01-27 00:11 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-01-26 21:43 - 2012-12-20 13:15 - 00000000 ____D () C:\Program Files\Avira
2015-01-26 21:16 - 2014-12-24 01:36 - 00000000 ____D () C:\Users\Default\AppData\Roaming\ProductData
2015-01-26 21:16 - 2014-12-24 01:36 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\ProductData
2015-01-26 19:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-01-26 18:27 - 2014-11-08 15:42 - 00002020 _____ () C:\Users\Public\Desktop\Driver Booster 2.lnk
2015-01-26 18:16 - 2011-10-22 18:34 - 00000000 ____D () C:\Users\Internet
2015-01-26 18:14 - 2011-10-22 14:11 - 00000000 ____D () C:\Users\Boris
2015-01-26 17:08 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-26 01:19 - 2009-07-14 03:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-26 01:16 - 2009-07-14 09:47 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2015-01-26 00:35 - 2012-03-12 02:07 - 00000000 ____D () C:\Program Files\GMX SMS-MMS-Manager
2015-01-26 00:30 - 2014-11-22 14:59 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\DVDVideoSoft
2015-01-26 00:23 - 2014-12-13 19:35 - 00002055 _____ () C:\Users\Public\Desktop\Advanced SystemCare 8.lnk
2015-01-26 00:23 - 2014-11-25 22:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2015-01-26 00:18 - 2012-04-17 22:56 - 00000000 ____D () C:\Users\Administrator
2015-01-23 13:28 - 2014-02-10 18:47 - 00000000 ____D () C:\ProgramData\ProductData
2015-01-19 01:38 - 2014-02-10 18:43 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\IObit
2015-01-19 01:28 - 2014-06-22 21:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 01:19 - 2014-02-10 19:52 - 00100896 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
2015-01-19 01:13 - 2014-06-22 21:17 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-01-19 01:13 - 2014-06-22 21:17 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-01-19 01:01 - 2011-10-23 14:19 - 00000000 ____D () C:\Windows\system32\RTCOM
2015-01-19 00:57 - 2014-02-10 18:47 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\IObit
2015-01-19 00:46 - 2014-12-13 19:13 - 00001138 _____ () C:\Users\Internet\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2015-01-19 00:46 - 2014-12-13 19:13 - 00001114 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2015-01-19 00:45 - 2014-11-08 15:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2
2015-01-15 09:45 - 2013-08-15 01:22 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 09:39 - 2011-10-23 23:31 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-06 04:36 - 2011-10-22 14:49 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2008-04-19 17:03 - 2011-10-23 13:18 - 0335360 _____ (RPworld.de) C:\Program Files\RouterReconnect.exe
2012-10-29 13:25 - 2012-10-29 13:39 - 0037188 _____ () C:\Users\Internet\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
2012-10-29 13:19 - 2012-10-29 13:29 - 0037082 _____ () C:\Users\Internet\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2012-08-09 18:23 - 2012-08-09 18:23 - 0000016 ____H () C:\Users\Internet\AppData\Roaming\mxfilerelatedcache.mxc2
2012-03-14 18:34 - 2013-01-01 04:19 - 0003584 _____ () C:\Users\Internet\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-08-09 18:23 - 2012-08-09 18:23 - 0000016 ____H () C:\Users\Internet\AppData\Local\mxfilerelatedcache.mxc2
2012-03-22 23:59 - 2012-09-29 23:00 - 0001451 _____ () C:\Users\Internet\AppData\Local\RecConfig.xml
2014-02-19 00:43 - 2014-02-19 00:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Internet\AppData\Local\Temp\avgnt.exe
C:\Users\Internet\AppData\Local\Temp\migpmvzr.dll


Some zero byte size files/folders:
==========================
C:\Windows\System32\cca.dll
C:\Windows\System32\Drivers\amdsata.sys

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---

--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-01-2015 01
Ran by Internet at 2015-01-28 12:15:49
Running from C:\Users\Internet\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda GOLD Protection (Enabled - Up to date) {3456760B-FDAA-FFFD-06C2-7BB528D2066C}
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Panda GOLD Protection (Enabled - Up to date) {8F3797EF-DB90-F073-3C72-40C753554CD1}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: IObit Malware Fighter (Enabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}
FW: Panda Firewall (Enabled) {0C6DF72E-B7C5-FEA5-2D9D-D280D6014117}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Photoshop Elements 2.0 (HKLM\...\Adobe Photoshop Elements 2.0) (Version: 2.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Advanced SystemCare 8 (HKLM\...\Advanced SystemCare 8_is1) (Version: 8.0.3 - IObit)
Amazon Cloud Player (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Amazon Amazon Cloud Player) (Version: 2.2.0.399 - Amazon Services LLC)
Amazon Kindle (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Amazon Kindle) (Version:  - Amazon)
Avira (HKLM\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Avira SearchFree Toolbar plus Web Protection Updater (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.0.20064 - Ask.com) <==== ATTENTION
Belkin Netzwerk USB-Hub Kontrollzentrum (HKLM\...\Belkin Network USB Hub Control Center) (Version: 1.4.0 - Belkin International, Inc.)
Biet-O-Matic v2.14.12 (HKLM\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team)
Canon Camera WIA Driver (Version: 5.2 - Canon) Hidden
Canon EOS Kiss REBEL 300D WIA-Treiber (HKLM\...\InstallShield_{31A57C3E-30DD-421F-B5C7-974DACB0D05F}) (Version: 5.2 - Canon)
CanoScan Toolbox Ver4.6 (HKLM\...\{088A077A-8028-408C-AE7B-4512AE2A65A0}) (Version:  - )
CheckDrive (HKLM\...\{B83513EC-2E4D-4621-816D-4CCF397BE702}_is1) (Version: 4.4 - Abelssoft)
CorelDRAW Essential Edition 3 (HKLM\...\_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}) (Version:  - Corel Corporation)
CorelDRAW Essential Edition 3 (Version: 3.0 - Corel Corporation) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3228 - CyberLink Corp.)
DE (Version: 3.0 - Corel Corporation) Hidden
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.84 - DivX, LLC)
Driver Booster 2.1 (HKLM\...\Driver Booster_is1) (Version: 2.1 - IObit)
EOS USB WIA Driver (HKLM\...\EOS USB WIA Driver) (Version: 6.0.0.4 - )
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
hide.me VPN Version 1.0.5 (HKLM\...\{0E00BDA5-7998-4889-BE4B-39A4BBD2EDFB}_is1) (Version: 1.0.5 - eVenture Limited)
IObit Malware Fighter (HKLM\...\IObit Malware Fighter_is1) (Version: 2.5 - IObit)
IObit Uninstaller (HKLM\...\IObitUninstall) (Version: 4.1.5.33 - IObit)
IsoBuster 3.2 (HKLM\...\IsoBuster_is1) (Version: 3.2 - Smart Projects)
Java 7 Update 72 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217072FF}) (Version: 7.0.720 - Oracle)
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Kaspersky Security Scan (HKLM\...\InstallWIX_{D1282694-0693-41A8-ABC1-6D1FFC1F65C4}) (Version: 12.0.1.881 - Kaspersky Lab)
Kaspersky Security Scan (Version: 12.0.1.881 - Kaspersky Lab) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.49a (HKLM\...\Mp3tag) (Version: v2.49a - Florian Heidenreich)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Panda Devices Agent (HKLM\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (Version: 1.05.00 - Panda Security) Hidden
Panda GOLD Protection (HKLM\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0002 - Panda Security)
Panda GOLD Protection (Version: 7.23.00.0000 - Panda Security) Hidden
Password Depot 7 - Panda Secure Vault Edition (HKLM\...\{A6144BFB-45FB-4DDB-BC4F-AB10E9FF0395}_is1) (Version: 7.5.9 - AceBIT GmbH)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7373 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.)
Sandboxie 4.12 (32-bit) (HKLM\...\Sandboxie) (Version: 4.12 - Sandboxie Holdings, LLC)
SHIELD Streaming (Version: 1.8.323 - NVIDIA Corporation) Hidden
Skype™ 6.21 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Smart Defrag 3 (HKLM\...\Smart Defrag 3_is1) (Version: 3.3 - IObit)
Spotify (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.19.0 - Synaptics)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
Windows-Treiberpaket - Google, Inc. AndroidUsbDeviceClass  (08/27/2012 7.0.0000.00001) (HKLM\...\6803A5C44482B015766CD85EAE73F57DAB0CD2D1) (Version: 08/27/2012 7.0.0000.00001 - Google, Inc.)
WinRAR 4.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) =============

2015-01-27 12:36 - 2015-01-25 07:08 - 01117512 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.93\libglesv2.dll
2015-01-27 12:36 - 2015-01-25 07:08 - 00211272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.93\libegl.dll
2015-01-27 12:36 - 2015-01-25 07:08 - 09170760 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.93\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Amazon Cloud Player => "C:\Users\Internet\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe"
MSCONFIG\startupreg: CryptLoad => C:\Users\Internet\Downloads\CryptLoad_1.1.8\RouterClient.exe
MSCONFIG\startupreg: DivXMediaServer => c:\program files\divx\divx media server\divxmediaserver.exe
MSCONFIG\startupreg: GoogleChromeAutoLaunch_223E2B52059A79E544C8556516B => "c:\program files\google\chrome\application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: ISUSPM => "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
MSCONFIG\startupreg: NvBackend => c:\program files\nvidia corporation\update core\nvbackend.exe
MSCONFIG\startupreg: RtHDVCpl => "c:\program files\realtek\audio\hda\rthdvcpl.exe" -s
MSCONFIG\startupreg: SandboxieControl => c:\program files\sandboxie\sbiectrl.exe
MSCONFIG\startupreg: Spotify => "c:\users\internet\appdata\roaming\spotify\spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => c:\users\internet\appdata\roaming\spotify\data\spotifywebhelper.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-1916616730-3355624969-3622577331-500 - Administrator - Disabled) => C:\Users\Administrator
Boris (S-1-5-21-1916616730-3355624969-3622577331-1000 - Administrator - Enabled) => C:\Users\Boris
Gast (S-1-5-21-1916616730-3355624969-3622577331-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-1916616730-3355624969-3622577331-1002 - Limited - Enabled)
Internet (S-1-5-21-1916616730-3355624969-3622577331-1003 - Limited - Enabled) => C:\Users\Internet

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/28/2015 03:00:22 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/28/2015 03:00:22 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/27/2015 02:30:05 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/27/2015 02:30:05 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/27/2015 01:50:02 PM) (Source: Avira Service Host) (EventID: 0) (User: )
Description: Fehler beim Verarbeiten von Sitzungsänderung. System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
   bei Avira.OE.ServiceHost.ServiceHost.OnSessionChange(SessionChangeDescription changeDescription)
   bei System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)

Error: (01/26/2015 09:14:22 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/26/2015 08:41:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm avscan.exe, Version 14.0.7.462 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b0c

Startzeit: 01d0398c5e87b3a8

Endzeit: 60000

Anwendungspfad: C:\Program Files\Avira\AntiVir Desktop\avscan.exe

Berichts-ID: 24a071f5-a593-11e4-9837-00222003d275

Error: (01/26/2015 06:25:46 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {7cfdd32b-726b-4088-945f-b9b7276a43db}

Error: (01/26/2015 01:19:16 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: )
Description: Vom Kryptografiedienst konnte die Katalogdatenbank nicht initialisiert werden. "ESENT"-Fehler: -528.

Error: (01/26/2015 01:19:16 AM) (Source: ESENT) (EventID: 455) (User: )
Description: Catalog Database (1392) Catalog Database: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\Windows\system32\CatRoot2\edb.log.


System errors:
=============
Error: (01/28/2015 11:27:58 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:14 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:14 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:14 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:14 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:14 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 40%
Total physical RAM: 3070.43 MB
Available physical RAM: 1832.55 MB
Total Pagefile: 6139.15 MB
Available Pagefile: 4299.16 MB
Total Virtual: 2047.88 MB
Available Virtual: 1882.61 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:86.61 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================
__________________
Alt 28.01.2015, 13:22   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Vier Punkte fallen mir auf:


(1)
Zitat:
Ran by Internet (ATTENTION: The logged in user is not administrator)
Du hast FRST ohne Adminrechte gestartet. Unsere Tools brauchen immer Adminrechte, eine Analyse bzw Bereinigung ohne Adminrechte funktioniert nicht.

(2)
Zukünftig bitte beachten:
Zitat:
Running from C:\Users\Internet\Downloads
Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.

(3)
Zitat:
AV: Panda GOLD Protection (Enabled - Up to date) {3456760B-FDAA-FFFD-06C2-7BB528D2066C}
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
Man verwendet niemals zwei Virenscanner wie Avira und Panda parallel!

(4)
Zitat:
Platform: Microsoft Windows 7 Ultimate
Microsoft Office Enterprise 2007
Windows 7 Ultimate und Office Enterprise lässt den Schluss zu, dass dies ein gewebrliches System sein könnte. Ist dem so?
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 28.01.2015, 13:44   #5
Boris19
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


zu 3. ich werde jetzt Antivir deinstallieren
zu 4. Nein es handelt sich um ein rein privates System.


Hier nochmal die Scans, ausgeführt mit Administratorrechten:


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-01-2015
Ran by Boris (administrator) on BORIS-PC on 28-01-2015 13:35:10
Running from C:\Users\Internet\Desktop
Loaded Profiles: Boris & Internet (Available profiles: Boris & Internet & Administrator)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPStart.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Panda Security, S.L.) C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe
(Spotify Ltd) C:\Users\Internet\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMF.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPStart] => C:\Program Files\Synaptics\SynTP\SynTPStart.exe [102400 2007-10-09] (Synaptics, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12111576 2015-01-19] (Realtek Semiconductor)
HKLM\...\Run: [IObit Malware Fighter] => C:\Program Files\IObit\IObit Malware Fighter\IMF.exe [1802048 2014-10-13] (IObit)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [PSUAMain] => C:\Program Files\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
HKU\S-1-5-21-1916616730-3355624969-3622577331-1000\...\Run: [Hide.me] => C:\Program Files\hide.me VPN\Hide.me.exe [1140912 2015-01-23] ()
HKU\S-1-5-21-1916616730-3355624969-3622577331-1000\...\Run: [KSS] => C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Run: [Spotify Web Helper] => C:\Users\Internet\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-13] (Spotify Ltd)
HKU\S-1-5-18\...\Run: [Advanced SystemCare 8] => C:\Program Files\IObit\Advanced SystemCare 8\ASCTray.exe [2426144 2014-11-25] (IObit)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2011-11-29] (Microsoft Corporation)
IFEO\ActionCenterDownloader.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\bfsvc.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\chrmstp.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\fveupdate.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\hh.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\IObitDownloader.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\IsUn0407.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\MakeSFX.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SDInit.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SDSendBugReport.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SD_FreeSoftwareDownloader.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\SmartDefrag.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\twunk_16.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\twunk_32.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroBackItUp.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroMediaHome.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroShowTime.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNNeroVision.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\UNRecode.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\winhelp.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\winhlp32.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
IFEO\write.exe: [Debugger] C:\Program Files\IObit\Advanced SystemCare 8\AutoReactivator.exe
BootExecute: autocheck autochk * SmartDefragBootTime.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1916616730-3355624969-3622577331-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ie
HKU\S-1-5-21-1916616730-3355624969-3622577331-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: HKU\S-1-5-21-1916616730-3355624969-3622577331-1000 - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKU\S-1-5-21-1916616730-3355624969-3622577331-1000 -> DefaultScope {9BB0BB8A-0E7F-4239-B87C-FAB4D633ABB3} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1916616730-3355624969-3622577331-1000 -> {9BB0BB8A-0E7F-4239-B87C-FAB4D633ABB3} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1916616730-3355624969-3622577331-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = 
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
BHO: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\.DEFAULT -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKU\S-1-5-21-1916616730-3355624969-3622577331-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKU\S-1-5-21-1916616730-3355624969-3622577331-1003 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=800236&p=
FF Homepage: https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ff
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.72.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.72.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\searchplugins\yahoo_ff.xml
FF Extension: Ads Removal - C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\Extensions\adremoveext@adremoveext.net [2015-01-26]
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\Extensions\ascsurfingprotection@iobit.com [2014-12-13]
FF Extension: softonic.com - C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\Extensions\ffxtlbra@softonic.com.xpi [2013-11-23]
FF Extension: Adblock Plus - C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-22]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-02-27]
FF Extension: No Name - C:\Users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\aqi9ki84.default\extensions\adsremoval@adsremoval.net [Not Found]
FF Extension: No Name - C:\Program Files\IObit Apps Toolbar\FF [Not Found]

Chrome: 
=======
CHR HomePage: Default -> https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ch
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Boris\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Boris\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-28]
CHR Extension: (Avira Browserschutz) - C:\Users\Boris\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-28]
CHR Extension: (Ads Removal) - C:\Users\Boris\AppData\Local\Google\Chrome\User Data\Default\Extensions\fopdddcinljmpmioaklghcalngfhbaen [2014-02-26]
CHR Extension: (Google Wallet) - C:\Users\Boris\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-13]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.1.crx [2013-10-14]
CHR HKLM\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files\Common Files\Spigot\GC\ErrorAssistant_1.3.crx [2013-12-27]
CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\Boris\AppData\Local\Slick Savings\coupons.crx [2014-02-10]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx [2012-11-22]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService8; C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe [815392 2014-11-04] (IObit)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [344896 2014-09-30] (IObit)
R2 KSS; C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit)
R2 NanoServiceMain; C:\Program Files\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
U2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)
S3 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19405768 2014-04-02] (NVIDIA Corporation)
R2 PandaAgent; C:\Program Files\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
S3 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 PSUAService; C:\Program Files\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
S3 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-05-14] ()
S3 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [134664 2014-05-29] (Sandboxie Holdings, LLC)
S3 UPnPService; C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [544768 2006-12-14] (Magix AG) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdsata; C:\Windows\system32\drivers\amdsata.sys [0 2011-03-11] () <==== ATTENTION (zero size file/folder)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)
R3 DCamUSBGene; C:\Windows\System32\DRIVERS\usbgene.sys [175360 2008-10-02] ()
S3 FileMonitor; C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [21480 2013-03-23] (IObit)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60552 2011-04-25] (FTDI Ltd.)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [23840 2015-01-19] (REALiX(tm))
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [88992 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [166816 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [110624 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [125216 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [40192 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [96160 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [61984 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [121888 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [288032 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [208800 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [109856 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [244000 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [96928 2014-06-04] (Panda Security, S.L.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2014-03-21] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [139536 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [105232 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [168208 2014-10-02] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [113936 2014-10-02] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [124688 2014-10-02] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [100112 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [48736 2014-03-25] (Panda Security, S.L.)
S3 RegFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [32288 2013-11-19] (IObit.com)
S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [160264 2014-05-29] (Sandboxie Holdings, LLC)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-02-13] ()
R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [62464 2007-09-27] (silex technology, Inc.)
S3 UrlFilter; C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [20944 2013-11-19] (IObit.com)
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [43520 2012-02-15] (Apple, Inc.) [File not signed]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\CyberLink\PowerDVD8\000.fcl [87536 2009-08-28] (CyberLink Corp.)
S3 mdf15; \??\C:\Program Files\Clarus\Samsung SecretZone\mdf15.sys [X]
S3 mvd21; \??\C:\Program Files\Clarus\Samsung SecretZone\mvd21.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 13:35 - 2015-01-28 13:36 - 00022255 _____ () C:\Users\Internet\Desktop\FRST.txt
2015-01-28 12:54 - 2015-01-28 12:54 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\Panda Security
2015-01-28 12:13 - 2015-01-28 13:35 - 00000000 ____D () C:\FRST
2015-01-28 12:13 - 2015-01-28 13:07 - 01121280 _____ (Farbar) C:\Users\Internet\Desktop\FRST.exe
2015-01-28 11:41 - 2015-01-28 11:41 - 00016216 _____ () C:\Users\Internet\Documents\Trojaner gelöscht Trj Chgt H.txt
2015-01-28 01:14 - 2015-01-28 01:14 - 00002225 _____ () C:\Users\Internet\Desktop\Panda GOLD Protection.lnk
2015-01-28 00:48 - 2015-01-28 00:48 - 01029224 _____ () C:\Users\Boris\Downloads\PANDAAP15.exe
2015-01-27 23:33 - 2015-01-27 23:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2015-01-27 23:29 - 2014-03-25 14:15 - 00048736 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2015-01-27 23:28 - 2015-01-27 23:33 - 00000000 ____D () C:\Program Files\Panda Security
2015-01-27 23:28 - 2015-01-27 23:28 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Panda Security
2015-01-27 23:28 - 2015-01-27 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda GOLD Protection
2015-01-27 23:23 - 2015-01-27 23:29 - 00000000 ____D () C:\ProgramData\Panda Security
2015-01-27 23:22 - 2015-01-27 23:22 - 01074080 _____ () C:\Users\Internet\Downloads\PANDAGL15.exe
2015-01-27 14:54 - 2015-01-27 14:54 - 00001047 _____ () C:\Users\Boris\Desktop\Kaspersky Security Scan.lnk
2015-01-27 14:54 - 2015-01-27 14:54 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2015-01-27 14:53 - 2015-01-27 14:53 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-27 14:53 - 2015-01-27 14:53 - 00000000 ____D () C:\Program Files\Kaspersky Lab
2015-01-27 14:45 - 2015-01-27 14:45 - 00416576 _____ (Kaspersky Lab) C:\Users\Internet\Downloads\de-de.setup.exe
2015-01-27 14:15 - 2015-01-27 14:15 - 00001885 _____ () C:\Users\Internet\Desktop\CheckDrive.lnk
2015-01-27 13:56 - 2015-01-27 13:56 - 00000000 ____D () C:\Users\Boris\AppData\Local\Abelssoft
2015-01-27 13:55 - 2015-01-27 14:28 - 00001867 _____ () C:\Users\Boris\Desktop\CheckDrive.lnk
2015-01-27 13:55 - 2015-01-27 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CheckDrive
2015-01-27 13:55 - 2015-01-27 14:28 - 00000000 ____D () C:\Program Files\CheckDrive
2015-01-26 21:49 - 2015-01-26 21:49 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Avira
2015-01-26 21:49 - 2015-01-26 21:46 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-01-26 21:43 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-01-26 21:32 - 2015-01-26 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-01-26 21:32 - 2015-01-26 21:32 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-01-26 21:31 - 2015-01-26 21:31 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-26 21:30 - 2015-01-26 21:43 - 00000000 ____D () C:\ProgramData\Avira
2015-01-26 21:24 - 2014-12-11 18:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-26 21:24 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-01-26 21:23 - 2015-01-26 21:23 - 00000513 _____ () C:\Users\Internet\Desktop\Programme und Funktionen - Verknüpfung.lnk
2015-01-26 21:05 - 2015-01-26 21:05 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Internet\Downloads\avira_de_av_5808697000__ws.exe
2015-01-26 01:17 - 2015-01-28 13:27 - 00001008 _____ () C:\Windows\setupact.log
2015-01-26 01:17 - 2015-01-27 12:19 - 00136338 _____ () C:\Windows\PFRO.log
2015-01-26 01:17 - 2015-01-26 01:17 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-26 01:10 - 2013-10-02 01:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-01-26 01:10 - 2013-10-02 01:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-01-26 01:10 - 2013-10-02 01:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-01-26 01:10 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-01-26 01:10 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-01-26 01:10 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-01-26 01:10 - 2013-10-02 00:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-01-26 01:10 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-01-26 01:10 - 2013-10-01 23:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-01-26 01:10 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-01-25 23:19 - 2015-01-25 23:24 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\Solvusoft
2015-01-25 23:19 - 2012-10-15 17:02 - 00017840 _____ (solvusoft) C:\Windows\system32\roboot.exe
2015-01-23 21:43 - 2015-01-23 21:43 - 00002266 _____ () C:\Users\Internet\Desktop\outlook fehler.JPG - Verknüpfung.lnk
2015-01-23 21:37 - 2015-01-23 21:37 - 00000891 _____ () C:\Users\Internet\Desktop\Hide.me.exe - Verknüpfung.lnk
2015-01-19 01:19 - 2015-01-19 01:19 - 00719576 _____ (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
2015-01-19 01:19 - 2015-01-19 01:19 - 00076872 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 71040000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes.dat
2015-01-19 00:58 - 2015-01-19 00:58 - 13789440 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 11878656 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO30.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 05804772 _____ () C:\Windows\system32\Drivers\rtvienna.dat
2015-01-19 00:58 - 2015-01-19 00:58 - 04713224 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 03343832 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHDA.sys
2015-01-19 00:58 - 2015-01-19 00:58 - 02588888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkPgExt.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 02513264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 02354544 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApoApi.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01468608 _____ (Conexant Systems Inc.) C:\Windows\system32\CX32APO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01443340 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-01-19 00:58 - 2015-01-19 00:58 - 01175888 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO50.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01145600 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO60.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 01053208 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00945456 _____ (Nahimic Inc) C:\Windows\system32\NahimicAPONSControl.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00927448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoInstII.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00844192 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo2.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00818000 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO20.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00790272 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00519368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTACap.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00386072 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00326680 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00276128 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO.dll
2015-01-19 00:58 - 2015-01-19 00:58 - 00087864 _____ () C:\Windows\system32\audioLibVc.dll
2015-01-19 00:45 - 2015-01-19 00:45 - 00023840 _____ (REALiX(tm)) C:\Windows\system32\Drivers\HWiNFO32.SYS
2015-01-15 08:43 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-15 08:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-15 08:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-15 08:42 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-15 08:42 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2014-12-31 01:53 - 2015-01-23 21:15 - 00000000 ____D () C:\Program Files\hide.me VPN
2014-12-31 01:53 - 2014-12-31 01:54 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\Hide.me
2014-12-31 01:53 - 2014-12-31 01:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hide.me VPN

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 13:33 - 2011-10-22 13:56 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-28 13:31 - 2013-01-21 02:48 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-01-28 13:27 - 2014-02-09 20:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-28 13:27 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-28 12:57 - 2011-11-26 15:18 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\QuickScan
2015-01-28 11:59 - 2009-07-14 05:34 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-28 11:59 - 2009-07-14 05:34 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-28 11:22 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-01-28 02:55 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing
2015-01-28 01:11 - 2014-11-23 10:51 - 00476304 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-28 00:32 - 2014-11-01 16:29 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Spotify
2015-01-27 23:29 - 2014-12-13 19:00 - 00127016 _____ () C:\Users\Boris\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-27 23:28 - 2014-06-29 20:21 - 00127016 _____ () C:\Users\Internet\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-27 13:38 - 2014-07-02 16:15 - 01979316 _____ () C:\Windows\WindowsUpdate.log
2015-01-27 12:36 - 2014-06-21 12:38 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-27 12:31 - 2014-11-01 16:32 - 00000000 ____D () C:\Users\Internet\AppData\Local\Spotify
2015-01-27 00:11 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-01-26 21:43 - 2012-12-20 13:15 - 00000000 ____D () C:\Program Files\Avira
2015-01-26 21:16 - 2014-12-24 01:36 - 00000000 ____D () C:\Users\Default\AppData\Roaming\ProductData
2015-01-26 21:16 - 2014-12-24 01:36 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\ProductData
2015-01-26 19:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-01-26 18:27 - 2014-11-08 15:42 - 00002020 _____ () C:\Users\Public\Desktop\Driver Booster 2.lnk
2015-01-26 18:16 - 2014-02-10 20:24 - 63537152 _____ () C:\Windows\system32\config\software.iobit
2015-01-26 18:16 - 2014-02-10 20:24 - 00688128 _____ () C:\Windows\system32\config\default.iobit
2015-01-26 18:16 - 2014-02-10 20:24 - 00069632 _____ () C:\Windows\system32\config\sam.iobit
2015-01-26 18:16 - 2014-02-10 20:24 - 00032768 _____ () C:\Windows\system32\config\security.iobit
2015-01-26 18:16 - 2011-10-22 18:34 - 00000000 ____D () C:\Users\Internet
2015-01-26 18:14 - 2011-10-22 14:11 - 00000000 ____D () C:\Users\Boris
2015-01-26 17:08 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-26 01:19 - 2009-07-14 03:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-26 01:16 - 2009-07-14 09:47 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2015-01-26 00:35 - 2012-03-12 02:07 - 00000000 ____D () C:\Program Files\GMX SMS-MMS-Manager
2015-01-26 00:30 - 2014-11-22 14:59 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\DVDVideoSoft
2015-01-26 00:23 - 2014-12-13 19:35 - 00002055 _____ () C:\Users\Public\Desktop\Advanced SystemCare 8.lnk
2015-01-26 00:23 - 2014-11-25 22:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2015-01-26 00:18 - 2012-04-17 22:56 - 00000000 ____D () C:\Users\Administrator
2015-01-23 13:28 - 2014-02-10 18:47 - 00000000 ____D () C:\ProgramData\ProductData
2015-01-19 01:38 - 2014-02-10 18:43 - 00000000 ____D () C:\Users\Boris\AppData\Roaming\IObit
2015-01-19 01:28 - 2014-06-22 21:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 01:19 - 2014-02-10 19:52 - 00100896 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
2015-01-19 01:13 - 2014-06-22 21:17 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-01-19 01:13 - 2014-06-22 21:17 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-01-19 01:01 - 2011-10-23 14:19 - 00000000 ____D () C:\Windows\system32\RTCOM
2015-01-19 00:57 - 2014-02-10 18:47 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\IObit
2015-01-19 00:46 - 2014-12-13 19:13 - 00001138 _____ () C:\Users\Internet\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2015-01-19 00:46 - 2014-12-13 19:13 - 00001114 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2015-01-19 00:45 - 2014-11-08 15:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2
2015-01-15 09:45 - 2013-08-15 01:22 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 09:39 - 2011-10-23 23:31 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-06 04:36 - 2011-10-22 14:49 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2008-04-19 17:03 - 2011-10-23 13:18 - 0335360 _____ (RPworld.de) C:\Program Files\RouterReconnect.exe
2012-04-17 19:56 - 2012-04-17 19:56 - 0169514 _____ () C:\Users\Boris\AppData\Local\ars.cache
2012-04-17 19:57 - 2012-04-17 19:57 - 0314241 _____ () C:\Users\Boris\AppData\Local\census.cache
2012-04-17 19:38 - 2012-04-17 19:38 - 0000036 _____ () C:\Users\Boris\AppData\Local\housecall.guid.cache
2011-10-23 00:31 - 2014-02-23 18:21 - 0007664 _____ () C:\Users\Boris\AppData\Local\Resmon.ResmonCfg
2014-02-19 00:43 - 2014-02-19 00:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Boris\AppData\Local\Temp\abelssoft.setup.exe
C:\Users\Boris\AppData\Local\Temp\avgnt.exe
C:\Users\Boris\AppData\Local\Temp\wjsgx82c.dll
C:\Users\Boris\AppData\Local\Temp\{A2263F9B-091F-44E6-AF06-266940132D8F}.exe
C:\Users\Internet\AppData\Local\Temp\avgnt.exe
C:\Users\Internet\AppData\Local\Temp\migpmvzr.dll


Some zero byte size files/folders:
==========================
C:\Windows\System32\cca.dll
C:\Windows\System32\Drivers\amdsata.sys

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-24 18:58

==================== End Of Log ============================
--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 28-01-2015
Ran by Boris at 2015-01-28 13:37:10
Running from C:\Users\Internet\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda GOLD Protection (Enabled - Up to date) {3456760B-FDAA-FFFD-06C2-7BB528D2066C}
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Panda GOLD Protection (Enabled - Up to date) {8F3797EF-DB90-F073-3C72-40C753554CD1}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: IObit Malware Fighter (Enabled - Up to date) {A751AC20-3B48-5237-898A-78C4436BB78D}
FW: Panda Firewall (Enabled) {0C6DF72E-B7C5-FEA5-2D9D-D280D6014117}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Photoshop Elements 2.0 (HKLM\...\Adobe Photoshop Elements 2.0) (Version: 2.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Advanced SystemCare 8 (HKLM\...\Advanced SystemCare 8_is1) (Version: 8.0.3 - IObit)
Amazon Cloud Player (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Amazon Amazon Cloud Player) (Version: 2.2.0.399 - Amazon Services LLC)
Amazon Kindle (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Amazon Kindle) (Version:  - Amazon)
Avira (HKLM\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Avira SearchFree Toolbar plus Web Protection Updater (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.0.20064 - Ask.com) <==== ATTENTION
Belkin Netzwerk USB-Hub Kontrollzentrum (HKLM\...\Belkin Network USB Hub Control Center) (Version: 1.4.0 - Belkin International, Inc.)
Biet-O-Matic v2.14.12 (HKLM\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team)
Canon Camera WIA Driver (Version: 5.2 - Canon) Hidden
Canon EOS Kiss REBEL 300D WIA-Treiber (HKLM\...\InstallShield_{31A57C3E-30DD-421F-B5C7-974DACB0D05F}) (Version: 5.2 - Canon)
CanoScan Toolbox Ver4.6 (HKLM\...\{088A077A-8028-408C-AE7B-4512AE2A65A0}) (Version:  - )
CheckDrive (HKLM\...\{B83513EC-2E4D-4621-816D-4CCF397BE702}_is1) (Version: 4.4 - Abelssoft)
CorelDRAW Essential Edition 3 (HKLM\...\_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}) (Version:  - Corel Corporation)
CorelDRAW Essential Edition 3 (Version: 3.0 - Corel Corporation) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3228 - CyberLink Corp.)
DE (Version: 3.0 - Corel Corporation) Hidden
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.84 - DivX, LLC)
Driver Booster 2.1 (HKLM\...\Driver Booster_is1) (Version: 2.1 - IObit)
EOS USB WIA Driver (HKLM\...\EOS USB WIA Driver) (Version: 6.0.0.4 - )
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
hide.me VPN Version 1.0.5 (HKLM\...\{0E00BDA5-7998-4889-BE4B-39A4BBD2EDFB}_is1) (Version: 1.0.5 - eVenture Limited)
IObit Malware Fighter (HKLM\...\IObit Malware Fighter_is1) (Version: 2.5 - IObit)
IObit Uninstaller (HKLM\...\IObitUninstall) (Version: 4.1.5.33 - IObit)
IsoBuster 3.2 (HKLM\...\IsoBuster_is1) (Version: 3.2 - Smart Projects)
Java 7 Update 72 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217072FF}) (Version: 7.0.720 - Oracle)
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Kaspersky Security Scan (HKLM\...\InstallWIX_{D1282694-0693-41A8-ABC1-6D1FFC1F65C4}) (Version: 12.0.1.881 - Kaspersky Lab)
Kaspersky Security Scan (Version: 12.0.1.881 - Kaspersky Lab) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.49a (HKLM\...\Mp3tag) (Version: v2.49a - Florian Heidenreich)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Panda Devices Agent (HKLM\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (Version: 1.05.00 - Panda Security) Hidden
Panda GOLD Protection (HKLM\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0002 - Panda Security)
Panda GOLD Protection (Version: 7.23.00.0000 - Panda Security) Hidden
Password Depot 7 - Panda Secure Vault Edition (HKLM\...\{A6144BFB-45FB-4DDB-BC4F-AB10E9FF0395}_is1) (Version: 7.5.9 - AceBIT GmbH)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7373 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.)
Sandboxie 4.12 (32-bit) (HKLM\...\Sandboxie) (Version: 4.12 - Sandboxie Holdings, LLC)
Search Protection (HKU\S-1-5-21-1916616730-3355624969-3622577331-1000\...\Search Protection) (Version: 9.4.0.2 - Spigot, Inc.) <==== ATTENTION
SHIELD Streaming (Version: 1.8.323 - NVIDIA Corporation) Hidden
Skype™ 6.21 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Smart Defrag 3 (HKLM\...\Smart Defrag 3_is1) (Version: 3.3 - IObit)
Spotify (HKU\S-1-5-21-1916616730-3355624969-3622577331-1003\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.19.0 - Synaptics)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
Windows-Treiberpaket - Google, Inc. AndroidUsbDeviceClass  (08/27/2012 7.0.0000.00001) (HKLM\...\6803A5C44482B015766CD85EAE73F57DAB0CD2D1) (Version: 08/27/2012 7.0.0000.00001 - Google, Inc.)
WinRAR 4.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1916616730-3355624969-3622577331-1003_Classes\CLSID\{4D72E5BC-BC7C-11E0-83CA-10424824019B}\InprocServer32 -> C:\Users\Internet\AppData\Local\AskToolbar\Downloaded Program Files\AviraIDW.dll (Ask.com)
CustomCLSID: HKU\S-1-5-21-1916616730-3355624969-3622577331-1003_Classes\CLSID\{7F902AD4-FC6A-4B2F-8B8D-B6DD4E329B76}\InprocServer32 -> C:\Users\Internet\AppData\Local\AskToolbar\Downloaded Program Files\AviraWidget.dll (Ask.com)
CustomCLSID: HKU\S-1-5-21-1916616730-3355624969-3622577331-1003_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\Internet\AppData\Local\AskToolbar\Downloaded Program Files\AviraIDWUS.dll (Ask.com)

==================== Restore Points  =========================

19-01-2015 01:25:45 Windows Update
25-01-2015 23:22:03 WinThruster So, Jan 25, 15  23:22
26-01-2015 00:31:50 Removed GMX SMS-Manager
26-01-2015 00:31:50 Windows Update
26-01-2015 01:09:57 Windows Update
26-01-2015 18:25:47 Driver Booster : Samsung CLP-310 Series
27-01-2015 00:11:02 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D044433-37B5-4DDE-9081-6D1DEF69FA56} - System32\Tasks\SmartDefrag3_Update => C:\Program Files\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-23] (IObit)
Task: {30712CF3-754C-4B9C-9CBB-B8569695BCC8} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe [2014-11-04] (IObit)
Task: {3B14576D-0549-48C0-A03D-64086A1A7028} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files\IObit\IObit Uninstaller\IObitUninstaler.exe [2015-01-19] (IObit)
Task: {58FEABA1-5199-48DA-BF4D-BA0B1492E03D} - System32\Tasks\Uninstaller_SkipUac_Internet => C:\Program Files\IObit\IObit Uninstaller\IObitUninstaler.exe [2015-01-19] (IObit)
Task: {72B1E24F-3203-4A07-B63B-45F478A32839} - System32\Tasks\Driver Booster Scan => C:\Program Files\IObit\Driver Booster\Scheduler.exe [2014-12-17] (IObit)
Task: {7E494F6D-CE6D-401D-89B8-2BAB8350F54D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {886D9B70-28C7-4F47-BC88-978FD9964C52} - System32\Tasks\arp_flush => C:\Program Files\hide.me VPN\FlushArpCache.exe [2014-11-26] ()
Task: {8FE3C6B1-335F-451B-8332-5E401E172C03} - System32\Tasks\{9F851648-D1AD-49B3-B677-2B5173B7A606} => pcalua.exe -a C:\PROGRA~1\BIET-O~1\UNWISE.EXE -c C:\PROGRA~1\BIET-O~1\install.log
Task: {9A48DFCA-7B2C-4145-873A-DF7569898AE9} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
Task: {B004B35F-CDC5-4FF9-946C-B1B28C0DABE3} - System32\Tasks\Driver Booster SkipUAC (Boris) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe [2015-01-07] (IObit)
Task: {C0C32F8E-C27A-4094-B3BE-5738A2D41417} - System32\Tasks\ASC8_SkipUac_Boris => C:\Program Files\IObit\Advanced SystemCare 8\ASC.exe [2014-11-26] (IObit)
Task: {C9583492-3AF1-4A66-A905-720387F5A98D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-19] (Adobe Systems Incorporated)
Task: {D3B2BCD5-A477-49F9-8BA6-47281A322490} - System32\Tasks\Driver Booster Update => C:\Program Files\IObit\Driver Booster\AutoUpdate.exe [2014-12-09] (IObit)
Task: {E341F955-C701-4D29-A6FC-68C27E754159} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {EA0F0ED7-B985-44D4-A8D8-A981833156E5} - System32\Tasks\Abelssoft\CheckDriveBackgroundGuard => C:\Program Files\CheckDrive\CheckDriveBackgroundGuard.exe [2014-01-28] (Abelssoft)
Task: {F5D5C89B-7922-41F8-B9A7-CB64904712C4} - System32\Tasks\Driver Booster SkipUAC (SYSTEM) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe [2015-01-07] (IObit)
Task: {F6084EE5-C452-4281-AF10-089C5497D3FA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {FE9C7BDE-F5A6-4CF8-8033-F75C5C3650FA} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2013-08-29] ()

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-12-13 19:35 - 2013-10-25 12:08 - 00517408 _____ () C:\Program Files\IObit\Advanced SystemCare 8\sqlite3.dll
2012-09-15 15:24 - 2014-07-02 20:42 - 00107992 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2008-09-08 10:19 - 2008-09-08 10:19 - 00022723 _____ () C:\Windows\System32\cl31cl3.dll
2011-10-23 14:09 - 2011-05-28 21:04 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files\Panda Security\Panda Security Protection\SQLite3.dll
2014-02-13 18:08 - 2013-01-15 18:48 - 00348992 _____ () C:\Program Files\IObit\IObit Malware Fighter\madExcept_.bpl
2014-02-13 18:08 - 2013-01-15 18:48 - 00183616 _____ () C:\Program Files\IObit\IObit Malware Fighter\madBasic_.bpl
2014-02-13 18:08 - 2013-01-15 18:48 - 00051008 _____ () C:\Program Files\IObit\IObit Malware Fighter\madDisAsm_.bpl
2014-02-13 18:08 - 2013-12-12 18:46 - 08001344 _____ () C:\Program Files\IObit\IObit Malware Fighter\WebUI.dll
2014-02-13 18:08 - 2013-05-16 19:26 - 00182080 _____ () C:\Program Files\IObit\IObit Malware Fighter\unrar.dll
2014-02-13 18:08 - 2013-10-16 22:17 - 00185168 _____ () C:\Program Files\IObit\IObit Malware Fighter\libcurl-4.dll
2014-02-13 18:08 - 2013-05-16 19:26 - 00145216 _____ () C:\Program Files\IObit\IObit Malware Fighter\zlibwapi.dll
2015-01-27 12:36 - 2015-01-25 07:08 - 01117512 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.93\libglesv2.dll
2015-01-27 12:36 - 2015-01-25 07:08 - 00211272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.93\libegl.dll
2015-01-27 12:36 - 2015-01-25 07:08 - 09170760 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.93\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Amazon Cloud Player => "C:\Users\Internet\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe"
MSCONFIG\startupreg: CryptLoad => C:\Users\Internet\Downloads\CryptLoad_1.1.8\RouterClient.exe
MSCONFIG\startupreg: DivXMediaServer => c:\program files\divx\divx media server\divxmediaserver.exe
MSCONFIG\startupreg: GoogleChromeAutoLaunch_223E2B52059A79E544C8556516B => "c:\program files\google\chrome\application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: ISUSPM => "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
MSCONFIG\startupreg: NvBackend => c:\program files\nvidia corporation\update core\nvbackend.exe
MSCONFIG\startupreg: RtHDVCpl => "c:\program files\realtek\audio\hda\rthdvcpl.exe" -s
MSCONFIG\startupreg: SandboxieControl => c:\program files\sandboxie\sbiectrl.exe
MSCONFIG\startupreg: Spotify => "c:\users\internet\appdata\roaming\spotify\spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => c:\users\internet\appdata\roaming\spotify\data\spotifywebhelper.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-1916616730-3355624969-3622577331-500 - Administrator - Disabled) => C:\Users\Administrator
Boris (S-1-5-21-1916616730-3355624969-3622577331-1000 - Administrator - Enabled) => C:\Users\Boris
Gast (S-1-5-21-1916616730-3355624969-3622577331-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-1916616730-3355624969-3622577331-1002 - Limited - Enabled)
Internet (S-1-5-21-1916616730-3355624969-3622577331-1003 - Limited - Enabled) => C:\Users\Internet

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/28/2015 01:18:49 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/28/2015 01:18:49 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/28/2015 03:00:22 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/28/2015 03:00:22 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/27/2015 02:30:05 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/27/2015 02:30:05 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/27/2015 01:50:02 PM) (Source: Avira Service Host) (EventID: 0) (User: )
Description: Fehler beim Verarbeiten von Sitzungsänderung. System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
   bei Avira.OE.ServiceHost.ServiceHost.OnSessionChange(SessionChangeDescription changeDescription)
   bei System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)

Error: (01/26/2015 09:14:22 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig

Error: (01/26/2015 08:41:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm avscan.exe, Version 14.0.7.462 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b0c

Startzeit: 01d0398c5e87b3a8

Endzeit: 60000

Anwendungspfad: C:\Program Files\Avira\AntiVir Desktop\avscan.exe

Berichts-ID: 24a071f5-a593-11e4-9837-00222003d275

Error: (01/26/2015 06:25:46 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {7cfdd32b-726b-4088-945f-b9b7276a43db}


System errors:
=============
Error: (01/28/2015 01:29:35 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (01/28/2015 01:28:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (01/28/2015 01:27:03 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (01/28/2015 00:46:02 PM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\wisptis.exe -Embedding740{A5B020FD-E04B-4E67-B65A-E7DEED25B2CF}

Error: (01/28/2015 11:27:58 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:15 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.

Error: (01/28/2015 11:27:14 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy4" den Befehl "chkdsk" aus.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz
Percentage of memory in use: 35%
Total physical RAM: 3070.43 MB
Available physical RAM: 1974.35 MB
Total Pagefile: 6139.15 MB
Available Pagefile: 4464.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1894.29 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:86.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 68216821)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================


Alt 28.01.2015, 14:22   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Zitat:
zu 3. ich werde jetzt Antivir deinstallieren
zu 4. Nein es handelt sich um ein rein privates System.
Avira ist lt. Log noch drauf bzw aktiv
Wenn es ein reines privates System ist, stellt sich die Frage, wie das Enterprise Office da raufgekommen ist. Das ist so für Privatuser nämlich nicht verfügbar.
__________________
--> Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?

Alt 28.01.2015, 14:36   #7
Boris19
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Antivir ist mittlerweile deinstalliert.
Das Office Enterprise habe ich bei ebay erworben.

Muss ich davon ausgehen, das es sich um illegale Software handelt?

Alt 28.01.2015, 14:51   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Nein, Enterprise ist nur sehr ungewöhnlich für Privatnutzer.

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 28.01.2015, 16:01   #9
Boris19
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Ich habe mich jetzt doch dazu entschlossen das Betriebssystem neu zu installieren und gleich auf Windows 8 umzusteigen und hoffe das das jetzt nicht unbefriedigend für Dich ist.
Herzlichen Dank für Deine schnelle und kompetente Hilfe!
Gruß, Boris.

Alt 28.01.2015, 17:08   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Standard

Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


Nö, ist doch gut

Nimm aber Win 8.1 und kein Win 8
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?
administrator, antivir, appdata, bitdefender, defender, entdeck, entdeckt, erkannt, gelöscht, kaspersky, konto, malware, quarantäne, rechner, roaming, speicherort, troja, trojaner, ultimate, unternehmen, users, viren, was tun?, windows, windows 7


« 'BOO/TDss.A' auf Rechner und externer Festplatte | Töne und Werbung, ohne etwas geöffnet zu haben (evtl. Audio Trojaner?) »


Ähnliche Themen: Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?


  1. Windows 7: Avira hat TR/Dropper.MSIL.Gen beim installieren eines Programmes entdeckt, wurde in Quarantäne verschoben
    Log-Analyse und Auswertung - 19.02.2015 (19)
  2. 2 Trojaner in der Avira Quarantäne, Was tun ?
    Plagegeister aller Art und deren Bekämpfung - 12.01.2015 (10)
  3. GVU-Trojaner in Malwarebytes-Quarantäne - PC nun Trojaner-frei?
    Plagegeister aller Art und deren Bekämpfung - 25.11.2012 (9)
  4. Verschlüsselungs-Trojaner mit Malwarebytes in Quarantäne und nun??
    Plagegeister aller Art und deren Bekämpfung - 11.11.2012 (5)
  5. GVU Trojaner - unter Quarantäne, wirklich weg?
    Log-Analyse und Auswertung - 18.09.2012 (13)
  6. Trojaner in Quarantäne schieben, aber wie ?
    Plagegeister aller Art und deren Bekämpfung - 09.09.2012 (2)
  7. GVU Trojaner/ in Quarantäne verschoben...und nun?
    Plagegeister aller Art und deren Bekämpfung - 15.08.2012 (16)
  8. EXP/2012-0507.CR von Antivir entdeckt - jetzt in Quarantäne
    Plagegeister aller Art und deren Bekämpfung - 27.07.2012 (1)
  9. Trojaner TR/ADH.2.4490 in Quarantäne bei Avira
    Plagegeister aller Art und deren Bekämpfung - 27.02.2012 (33)
  10. Trojaner in Quarantäne löschen? (Anti-Maleware)
    Plagegeister aller Art und deren Bekämpfung - 14.09.2010 (7)
  11. Trojaner TR/Dropper.Gen - Quarantäne ausreichend?
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (15)
  12. Trojaner entdeckt / gelöscht, am Folgetag neuen entdeckt (Trojan.Downloader, Trojan.Vundo)
    Plagegeister aller Art und deren Bekämpfung - 30.07.2010 (6)
  13. Trojaner Ageent2.AXDD in Quarantäne
    Plagegeister aller Art und deren Bekämpfung - 05.07.2010 (18)
  14. Trojaner per AntiVir zugelassen(wie bekomme ich den in Quarantäne ??
    Plagegeister aller Art und deren Bekämpfung - 14.10.2009 (5)
  15. Trojaner erkannt und in Quarantäne
    Log-Analyse und Auswertung - 09.06.2009 (4)
  16. Trojaner in Quarantäne noch schädlich?
    Plagegeister aller Art und deren Bekämpfung - 20.04.2009 (30)
  17. Trojaner in Quarantäne und Probleme mit Windows XP
    Log-Analyse und Auswertung - 31.10.2004 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? - Hallo, Ich habe meinen Rechner mit Kaspersky, Antivir, Bitdefender, IObitmalware fighter und Panda (Test- oder Freewareversionen) auf Viren überprüft. Panda hat den Trojaner Trj/Chgt.H auf meinem Rechner, Windows 7 Ultimate, - Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun?...
Archiv
Du betrachtest: Trojaner Trj/Chgt.H entdeckt und in Quarantäne- was tun? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55