Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Maleware PicColor

Maleware PicColor


Plagegeister aller Art und deren Bekämpfung: Maleware PicColor

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 2 von 5 1 2 34 Letzte »
Alt 01.02.2015, 16:53   #16
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Einen Moment checke das mal eben.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 01.02.2015, 17:21   #17
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Probier bitte mal mit dem geänderten Script.
__________________

__________________
Alt 01.02.2015, 17:26   #18
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor


Selbe Fehlermeldung
__________________
Alt 01.02.2015, 17:28   #19
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Nochmal mit dem geänderten Script bitte.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 01.02.2015, 17:30   #20
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor


Muss Virenscanner dafür aus sein?


Alt 01.02.2015, 17:34   #21
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Nö, einfach mal Feuer frei...
__________________
--> Maleware PicColor

Alt 01.02.2015, 17:38   #22
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Horst (administrator) on LENOVO-PC on 01-02-2015 17:36:55
Running from C:\Users\Horst\Downloads
Loaded Profiles: Horst (Available profiles: Horst)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
() C:\Program Files\Lenovo\iMController\AutoUpdate.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-09-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-09-17] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-01] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2592821730-2572488457-1247367961-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:50860;https=127.0.0.1:50860
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-01]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-30]
CHR Extension: (Google Docs) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-30]
CHR Extension: (Google Drive) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-30]
CHR Extension: (YouTube) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-30]
CHR Extension: (Google-Suche) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-30]
CHR Extension: (Google Tabellen) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-30]
CHR Extension: (Avast Online Security) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-02-01]
CHR Extension: (Google Wallet) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-30]
CHR Extension: (Google Mail) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-30]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-01] (AVAST Software)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-08] (Broadcom Corporation.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [976600 2013-09-04] (Broadcom Corporation.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-09-17] (Lenovo(beijing) Limited)
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2635552 2015-01-31] (IObit)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-09-17] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-01] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-01] ()
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-08-08] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 cmwf; C:\WINDOWS\system32\Drivers\cmwf.sys [33952 2015-01-07] () [File not signed] <==== ATTENTION
R1 cmwr; C:\WINDOWS\system32\Drivers\cmwr.sys [45216 2015-01-07] () [File not signed] <==== ATTENTION
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-01] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S2 CMWFP; \??\C:\WINDOWS\system32\Drivers\CMWFP64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 17:33 - 2015-02-01 17:33 - 00000748 _____ () C:\blitzblank.log
2015-02-01 16:48 - 2015-02-01 17:31 - 01108632 _____ (Emsi Software GmbH) C:\Users\Horst\Downloads\Nicht bestätigt 661023.crdownload
2015-02-01 16:48 - 2015-02-01 16:48 - 01153912 _____ (Emsi Software GmbH) C:\Users\Horst\Downloads\BlitzBlank.exe
2015-02-01 15:53 - 2015-02-01 15:55 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Horst\Downloads\tdsskiller.exe
2015-02-01 15:42 - 2015-02-01 15:42 - 00001991 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-01 15:42 - 2015-02-01 15:42 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\AVAST Software
2015-02-01 15:42 - 2015-02-01 15:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-01 15:41 - 2015-02-01 17:14 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-02-01 15:41 - 2015-02-01 15:41 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-02-01 15:41 - 2015-02-01 15:41 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00087912 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswmonflt.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-02-01 15:41 - 2015-02-01 15:41 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-02-01 15:40 - 2015-02-01 15:40 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-01 15:37 - 2015-02-01 15:40 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-01 15:23 - 2015-02-01 15:35 - 132469808 _____ (AVAST Software) C:\Users\Horst\Downloads\avast_free_antivirus_setup (1).exe
2015-02-01 14:51 - 2015-02-01 14:51 - 00000000 ____D () C:\Users\Horst\Downloads\FRST-OlderVersion
2015-02-01 14:37 - 2015-02-01 14:38 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Horst\Downloads\avira_de_av_5821234446__ws.exe
2015-02-01 14:24 - 2015-02-01 14:24 - 00001192 _____ () C:\Users\Horst\Desktop\Maleware.txt
2015-01-31 20:41 - 2015-01-31 20:41 - 00032062 _____ () C:\Users\Horst\Downloads\FRST1.txt
2015-01-31 19:52 - 2015-01-31 19:52 - 00032057 _____ () C:\Users\Horst\Desktop\FRST.txt
2015-01-31 19:52 - 2015-01-31 19:52 - 00018986 _____ () C:\Users\Horst\Desktop\Addition.txt
2015-01-31 19:51 - 2015-01-31 20:43 - 00024981 _____ () C:\Users\Horst\Downloads\Addition.txt
2015-01-31 19:50 - 2015-02-01 17:36 - 00018048 _____ () C:\Users\Horst\Downloads\FRST.txt
2015-01-31 19:50 - 2015-02-01 17:36 - 00000000 ____D () C:\FRST
2015-01-31 19:48 - 2015-02-01 14:51 - 02131456 _____ (Farbar) C:\Users\Horst\Downloads\FRST64.exe
2015-01-31 19:46 - 2015-02-01 14:33 - 00000000 ____D () C:\OETemp
2015-01-31 19:46 - 2015-01-31 19:46 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Horst\Downloads\avira_de_av_5819538469__ws (1).exe
2015-01-31 19:36 - 2015-01-31 19:36 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Horst\Downloads\avira_de_av_5819538469__ws.exe
2015-01-31 19:06 - 2015-01-31 19:06 - 01707939 _____ (Thisisu) C:\Users\Horst\Downloads\JRT (1).exe
2015-01-31 19:06 - 2015-01-31 19:06 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-31 19:05 - 2015-01-31 19:06 - 01707939 _____ (Thisisu) C:\Users\Horst\Downloads\JRT.exe
2015-01-31 18:51 - 2015-02-01 15:19 - 00000298 _____ () C:\WINDOWS\Tasks\Uninstaller_SkipUac_Horst.job
2015-01-31 17:59 - 2015-02-01 15:17 - 00002398 _____ () C:\WINDOWS\System32\Tasks\Uninstaller_SkipUac_Horst
2015-01-31 17:59 - 2015-01-31 17:59 - 00001283 _____ () C:\Users\Horst\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2015-01-31 17:59 - 2015-01-31 17:59 - 00001259 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2015-01-31 15:52 - 2015-02-01 13:46 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-31 15:52 - 2015-01-31 15:52 - 00001129 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-31 15:52 - 2015-01-31 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-31 15:52 - 2015-01-31 15:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-31 15:52 - 2015-01-31 15:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-31 15:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-31 15:52 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-31 15:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-31 15:40 - 2015-01-31 15:51 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Horst\Downloads\mbam-setup-majorgeeks-2.0.4.1028.exe
2015-01-31 15:28 - 2015-01-31 15:28 - 00000000 ____D () C:\Users\Horst\AppData\IObit
2015-01-31 15:22 - 2015-01-31 15:22 - 00000925 _____ () C:\Users\Horst\Downloads\Dokumente - Verknüpfung.lnk
2015-01-31 15:22 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-01-31 14:51 - 2015-02-01 15:20 - 00000000 ____D () C:\AdwCleaner
2015-01-31 14:50 - 2015-01-31 14:51 - 02194432 _____ () C:\Users\Horst\Downloads\AdwCleaner09.exe
2015-01-22 22:50 - 2015-01-31 15:29 - 00000000 ____D () C:\ProgramData\ProductData
2015-01-22 22:50 - 2015-01-22 22:50 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\ProductData
2015-01-22 22:50 - 2015-01-22 22:50 - 00000000 ____D () C:\ProgramData\IObit
2015-01-22 22:50 - 2015-01-22 22:50 - 00000000 ____D () C:\Program Files (x86)\IObit
2015-01-22 22:49 - 2015-01-22 22:50 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\IObit
2015-01-22 22:48 - 2015-01-22 22:49 - 15971616 _____ (IObit) C:\Users\Horst\Downloads\iobit426uninstaller.exe
2015-01-22 20:37 - 2015-01-31 15:43 - 00027648 ___SH () C:\Users\Horst\Downloads\Thumbs.db
2015-01-22 20:37 - 2015-01-22 20:37 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\dlg
2015-01-22 20:24 - 2015-01-07 21:07 - 00045216 _____ () C:\WINDOWS\system32\Drivers\cmwr.sys
2015-01-22 20:24 - 2015-01-07 21:07 - 00033952 _____ () C:\WINDOWS\system32\Drivers\cmwf.sys
2015-01-15 22:19 - 2015-01-15 22:19 - 00000000 ____D () C:\Users\Horst\AppData\Local\Microsoft Help
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (8).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (7).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (6).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (5).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (4).xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe.xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (3).xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (2).xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (1).xls
2015-01-13 23:09 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 23:09 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 23:09 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 23:09 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 23:09 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 23:09 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 23:09 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 23:09 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 23:09 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 23:09 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 23:09 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 23:09 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 23:09 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 23:09 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 23:09 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 23:09 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 23:09 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 23:09 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 23:09 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 23:09 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 23:09 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 23:09 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 23:09 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 23:09 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 17:36 - 2014-11-30 19:00 - 00005140 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-Horst Lenovo-PC
2015-02-01 17:34 - 2014-12-16 20:41 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\Skype
2015-02-01 17:34 - 2014-11-30 17:17 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-01 17:34 - 2014-11-30 16:55 - 00000000 ___DO () C:\Users\Horst\OneDrive
2015-02-01 17:33 - 2014-03-18 10:44 - 00106730 _____ () C:\WINDOWS\PFRO.log
2015-02-01 17:33 - 2013-08-22 15:46 - 00035290 _____ () C:\WINDOWS\setupact.log
2015-02-01 17:33 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-01 17:32 - 2014-09-17 02:18 - 00004608 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-01 17:22 - 2014-11-30 17:17 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-01 17:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-01 16:54 - 2014-09-17 01:02 - 01637734 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-01 16:38 - 2014-11-30 16:59 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2592821730-2572488457-1247367961-1001
2015-02-01 15:18 - 2014-09-17 02:05 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-01 14:52 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-01 14:35 - 2014-11-30 17:10 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{72B0F1E4-A2C9-4D61-8158-CC1C6C339BA3}
2015-01-31 18:42 - 2014-09-17 02:08 - 00000000 ____D () C:\WINDOWS\Downloaded Installations
2015-01-31 18:03 - 2014-11-30 17:21 - 00001313 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-31 18:03 - 2014-11-30 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-31 18:03 - 2014-11-30 16:53 - 00001018 _____ () C:\Users\Horst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-31 15:23 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-31 14:49 - 2014-11-30 16:52 - 00000000 ____D () C:\Users\Horst\AppData\Local\Pokki
2015-01-30 12:48 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 11:23 - 2014-09-17 10:50 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-25 11:23 - 2014-09-17 10:50 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-25 11:23 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-25 11:10 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-24 21:20 - 2014-12-18 20:34 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-12-18 20:34 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-22 21:16 - 2014-09-17 02:18 - 00009904 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-22 21:16 - 2014-09-17 02:18 - 00004904 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-22 21:16 - 2014-09-17 02:18 - 00004904 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-22 20:48 - 2013-08-22 14:25 - 00000194 _____ () C:\WINDOWS\win.ini
2015-01-22 20:14 - 2014-09-17 02:10 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-22 20:12 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-21 20:19 - 2013-08-22 15:44 - 00518456 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-21 20:15 - 2014-12-07 13:21 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-21 20:08 - 2014-12-07 13:21 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-02 09:46 - 2014-11-30 19:03 - 00002345 _____ () C:\Users\Horst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

==================== Files in the root of some directories =======

2014-09-17 01:31 - 2014-09-17 01:31 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-11-30 17:54 - 2014-11-30 18:20 - 0001973 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Horst\AppData\Local\Temp\LenovoExperienceImprovement.exe
C:\Users\Horst\AppData\Local\Temp\oct31FE.tmp.exe
C:\Users\Horst\AppData\Local\Temp\oct417.tmp.exe
C:\Users\Horst\AppData\Local\Temp\oct7B2C.tmp.exe
C:\Users\Horst\AppData\Local\Temp\octAE06.tmp.exe
C:\Users\Horst\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Horst\AppData\Local\Temp\SPSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 18:35

==================== End Of Log ============================
--- --- ---
Alt 01.02.2015, 17:40   #23
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Bitte mal das Log posten:

Zitat:
C:\blitzblank.log
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 01.02.2015, 17:43   #24
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor


Code:
ATTFilter
BlitzBlank 1.0.0.32

File/Registry Modification Engine native application
DeleteDriverEntryOnReboot: driverName = "cmwr.sys", backupFile = "(null)", deactivateOnly = 1
DisableDriver: ZwOpenKey failed: status = c0000034
DeleteDriverEntryOnReboot: driverName = "cmwf.sys", backupFile = "(null)", deactivateOnly = 1
DisableDriver: ZwOpenKey failed: status = c0000034

Alt 01.02.2015, 17:48   #25
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Ich bin auch ein Vollidiot... Bitte nochmal mit diesem Script. Dann gleich wieder BB.log und FRST.

Code:
ATTFilter
DisableDriver: 
	cmwr
	cmwf
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 01.02.2015, 17:57   #26
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Horst (administrator) on LENOVO-PC on 01-02-2015 17:55:33
Running from C:\Users\Horst\Downloads
Loaded Profiles: Horst (Available profiles: Horst)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\Bluetooth Headset Helper.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-09-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-09-17] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-01] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2592821730-2572488457-1247367961-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:50860;https=127.0.0.1:50860
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-01]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-30]
CHR Extension: (Google Docs) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-30]
CHR Extension: (Google Drive) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-30]
CHR Extension: (YouTube) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-30]
CHR Extension: (Google-Suche) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-30]
CHR Extension: (Google Tabellen) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-30]
CHR Extension: (Avast Online Security) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-02-01]
CHR Extension: (Google Wallet) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-30]
CHR Extension: (Google Mail) - C:\Users\Horst\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-30]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-01] (AVAST Software)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-08] (Broadcom Corporation.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [976600 2013-09-04] (Broadcom Corporation.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-09-17] (Lenovo(beijing) Limited)
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2635552 2015-01-31] (IObit)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-09-17] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-01] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-01] ()
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-08-08] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 cmwf; C:\WINDOWS\system32\Drivers\cmwf.sys [33952 2015-01-07] () [File not signed] <==== ATTENTION
R1 cmwr; C:\WINDOWS\system32\Drivers\cmwr.sys [45216 2015-01-07] () [File not signed] <==== ATTENTION
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-01] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S2 CMWFP; \??\C:\WINDOWS\system32\Drivers\CMWFP64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 17:33 - 2015-02-01 17:51 - 00001274 _____ () C:\blitzblank.log
2015-02-01 16:48 - 2015-02-01 17:31 - 01108632 _____ (Emsi Software GmbH) C:\Users\Horst\Downloads\Nicht bestätigt 661023.crdownload
2015-02-01 16:48 - 2015-02-01 16:48 - 01153912 _____ (Emsi Software GmbH) C:\Users\Horst\Downloads\BlitzBlank.exe
2015-02-01 15:53 - 2015-02-01 15:55 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Horst\Downloads\tdsskiller.exe
2015-02-01 15:42 - 2015-02-01 15:42 - 00001991 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-01 15:42 - 2015-02-01 15:42 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\AVAST Software
2015-02-01 15:42 - 2015-02-01 15:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-01 15:41 - 2015-02-01 17:44 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-02-01 15:41 - 2015-02-01 15:41 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-02-01 15:41 - 2015-02-01 15:41 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00087912 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswmonflt.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-02-01 15:41 - 2015-02-01 15:41 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-02-01 15:41 - 2015-02-01 15:41 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-02-01 15:40 - 2015-02-01 15:40 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-01 15:37 - 2015-02-01 15:40 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-01 15:23 - 2015-02-01 15:35 - 132469808 _____ (AVAST Software) C:\Users\Horst\Downloads\avast_free_antivirus_setup (1).exe
2015-02-01 14:51 - 2015-02-01 14:51 - 00000000 ____D () C:\Users\Horst\Downloads\FRST-OlderVersion
2015-02-01 14:37 - 2015-02-01 14:38 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Horst\Downloads\avira_de_av_5821234446__ws.exe
2015-02-01 14:24 - 2015-02-01 14:24 - 00001192 _____ () C:\Users\Horst\Desktop\Maleware.txt
2015-01-31 20:41 - 2015-01-31 20:41 - 00032062 _____ () C:\Users\Horst\Downloads\FRST1.txt
2015-01-31 19:52 - 2015-01-31 19:52 - 00032057 _____ () C:\Users\Horst\Desktop\FRST.txt
2015-01-31 19:52 - 2015-01-31 19:52 - 00018986 _____ () C:\Users\Horst\Desktop\Addition.txt
2015-01-31 19:51 - 2015-01-31 20:43 - 00024981 _____ () C:\Users\Horst\Downloads\Addition.txt
2015-01-31 19:50 - 2015-02-01 17:55 - 00017910 _____ () C:\Users\Horst\Downloads\FRST.txt
2015-01-31 19:50 - 2015-02-01 17:55 - 00000000 ____D () C:\FRST
2015-01-31 19:48 - 2015-02-01 14:51 - 02131456 _____ (Farbar) C:\Users\Horst\Downloads\FRST64.exe
2015-01-31 19:46 - 2015-02-01 14:33 - 00000000 ____D () C:\OETemp
2015-01-31 19:46 - 2015-01-31 19:46 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Horst\Downloads\avira_de_av_5819538469__ws (1).exe
2015-01-31 19:36 - 2015-01-31 19:36 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\Horst\Downloads\avira_de_av_5819538469__ws.exe
2015-01-31 19:06 - 2015-01-31 19:06 - 01707939 _____ (Thisisu) C:\Users\Horst\Downloads\JRT (1).exe
2015-01-31 19:06 - 2015-01-31 19:06 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-31 19:05 - 2015-01-31 19:06 - 01707939 _____ (Thisisu) C:\Users\Horst\Downloads\JRT.exe
2015-01-31 18:51 - 2015-02-01 15:19 - 00000298 _____ () C:\WINDOWS\Tasks\Uninstaller_SkipUac_Horst.job
2015-01-31 17:59 - 2015-02-01 15:17 - 00002398 _____ () C:\WINDOWS\System32\Tasks\Uninstaller_SkipUac_Horst
2015-01-31 17:59 - 2015-01-31 17:59 - 00001283 _____ () C:\Users\Horst\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2015-01-31 17:59 - 2015-01-31 17:59 - 00001259 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2015-01-31 15:52 - 2015-02-01 13:46 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-31 15:52 - 2015-01-31 15:52 - 00001129 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-31 15:52 - 2015-01-31 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-31 15:52 - 2015-01-31 15:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-31 15:52 - 2015-01-31 15:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-31 15:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-31 15:52 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-31 15:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-31 15:40 - 2015-01-31 15:51 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Horst\Downloads\mbam-setup-majorgeeks-2.0.4.1028.exe
2015-01-31 15:28 - 2015-01-31 15:28 - 00000000 ____D () C:\Users\Horst\AppData\IObit
2015-01-31 15:22 - 2015-01-31 15:22 - 00000925 _____ () C:\Users\Horst\Downloads\Dokumente - Verknüpfung.lnk
2015-01-31 15:22 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-01-31 14:51 - 2015-02-01 17:40 - 00000000 ____D () C:\AdwCleaner
2015-01-31 14:50 - 2015-01-31 14:51 - 02194432 _____ () C:\Users\Horst\Downloads\AdwCleaner09.exe
2015-01-22 22:50 - 2015-01-31 15:29 - 00000000 ____D () C:\ProgramData\ProductData
2015-01-22 22:50 - 2015-01-22 22:50 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\ProductData
2015-01-22 22:50 - 2015-01-22 22:50 - 00000000 ____D () C:\ProgramData\IObit
2015-01-22 22:50 - 2015-01-22 22:50 - 00000000 ____D () C:\Program Files (x86)\IObit
2015-01-22 22:49 - 2015-01-22 22:50 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\IObit
2015-01-22 22:48 - 2015-01-22 22:49 - 15971616 _____ (IObit) C:\Users\Horst\Downloads\iobit426uninstaller.exe
2015-01-22 20:37 - 2015-01-31 15:43 - 00027648 ___SH () C:\Users\Horst\Downloads\Thumbs.db
2015-01-22 20:37 - 2015-01-22 20:37 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\dlg
2015-01-22 20:24 - 2015-01-07 21:07 - 00045216 _____ () C:\WINDOWS\system32\Drivers\cmwr.sys
2015-01-22 20:24 - 2015-01-07 21:07 - 00033952 _____ () C:\WINDOWS\system32\Drivers\cmwf.sys
2015-01-15 22:19 - 2015-01-15 22:19 - 00000000 ____D () C:\Users\Horst\AppData\Local\Microsoft Help
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (8).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (7).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (6).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (5).xls
2015-01-15 22:16 - 2015-01-15 22:16 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (4).xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe.xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (3).xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (2).xls
2015-01-15 22:15 - 2015-01-15 22:15 - 00049152 _____ () C:\Users\Horst\Downloads\kalender-2015-querformat-in-farbe (1).xls
2015-01-13 23:09 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 23:09 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 23:09 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 23:09 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 23:09 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 23:09 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 23:09 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 23:09 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 23:09 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 23:09 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 23:09 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 23:09 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 23:09 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 23:09 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 23:09 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 23:09 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 23:09 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 23:09 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 23:09 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 23:09 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 23:09 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 23:09 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 23:09 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 23:09 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 23:09 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 17:52 - 2014-11-30 19:00 - 00005140 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-Horst Lenovo-PC
2015-02-01 17:52 - 2014-11-30 17:17 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-01 17:52 - 2014-11-30 16:55 - 00000000 __RDO () C:\Users\Horst\OneDrive
2015-02-01 17:51 - 2013-08-22 15:46 - 00035555 _____ () C:\WINDOWS\setupact.log
2015-02-01 17:51 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-01 17:50 - 2014-09-17 02:18 - 00004608 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-01 17:50 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-01 17:38 - 2014-11-30 16:59 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2592821730-2572488457-1247367961-1001
2015-02-01 17:34 - 2014-12-16 20:41 - 00000000 ____D () C:\Users\Horst\AppData\Roaming\Skype
2015-02-01 17:33 - 2014-03-18 10:44 - 00106730 _____ () C:\WINDOWS\PFRO.log
2015-02-01 17:22 - 2014-11-30 17:17 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-01 17:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-01 16:54 - 2014-09-17 01:02 - 01645498 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-01 15:18 - 2014-09-17 02:05 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-01 14:35 - 2014-11-30 17:10 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{72B0F1E4-A2C9-4D61-8158-CC1C6C339BA3}
2015-01-31 18:42 - 2014-09-17 02:08 - 00000000 ____D () C:\WINDOWS\Downloaded Installations
2015-01-31 18:03 - 2014-11-30 17:21 - 00001313 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-31 18:03 - 2014-11-30 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-31 18:03 - 2014-11-30 16:53 - 00001018 _____ () C:\Users\Horst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-31 15:23 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-31 14:49 - 2014-11-30 16:52 - 00000000 ____D () C:\Users\Horst\AppData\Local\Pokki
2015-01-30 12:48 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 11:23 - 2014-09-17 10:50 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-25 11:23 - 2014-09-17 10:50 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-25 11:23 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-25 11:10 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-24 21:20 - 2014-12-18 20:34 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-12-18 20:34 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-22 21:16 - 2014-09-17 02:18 - 00009904 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-22 21:16 - 2014-09-17 02:18 - 00004904 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-22 21:16 - 2014-09-17 02:18 - 00004904 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-22 20:48 - 2013-08-22 14:25 - 00000194 _____ () C:\WINDOWS\win.ini
2015-01-22 20:14 - 2014-09-17 02:10 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-22 20:12 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-21 20:19 - 2013-08-22 15:44 - 00518456 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-21 20:15 - 2014-12-07 13:21 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-21 20:08 - 2014-12-07 13:21 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-02 09:46 - 2014-11-30 19:03 - 00002345 _____ () C:\Users\Horst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

==================== Files in the root of some directories =======

2014-09-17 01:31 - 2014-09-17 01:31 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-11-30 17:54 - 2014-11-30 18:20 - 0001973 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Horst\AppData\Local\Temp\LenovoExperienceImprovement.exe
C:\Users\Horst\AppData\Local\Temp\oct31FE.tmp.exe
C:\Users\Horst\AppData\Local\Temp\oct417.tmp.exe
C:\Users\Horst\AppData\Local\Temp\oct7B2C.tmp.exe
C:\Users\Horst\AppData\Local\Temp\octAE06.tmp.exe
C:\Users\Horst\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Horst\AppData\Local\Temp\SPSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 18:35

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
ATTFilter
BlitzBlank 1.0.0.32

File/Registry Modification Engine native application
DeleteDriverEntryOnReboot: driverName = "cmwr.sys", backupFile = "(null)", deactivateOnly = 1
DisableDriver: ZwOpenKey failed: status = c0000034
DeleteDriverEntryOnReboot: driverName = "cmwf.sys", backupFile = "(null)", deactivateOnly = 1
DisableDriver: ZwOpenKey failed: status = c0000034


BlitzBlank 1.0.0.32

File/Registry Modification Engine native application
DeleteDriverEntryOnReboot: driverName = "cmwr", backupFile = "(null)", deactivateOnly = 1
DeleteDriverEntryOnReboot: driverName = "cmwf", backupFile = "(null)", deactivateOnly = 1

Alt 01.02.2015, 18:03   #27
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Bitte während der Bereinigung keine Programme installieren!

Zitat:
2015-02-01 15:23 - 2015-02-01 15:35 - 132469808 _____ (AVAST Software) C:\Users\Horst\Downloads\avast_free_antivirus_setup (1).exe
Machen es jetzt anders. Bitte das ausführen:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 01.02.2015, 18:31   #28
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor


Der PC nimmt bei der Eingabeaufforderung nicht das Passwort

Alt 01.02.2015, 18:32   #29
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Maleware PicColor - Standard

Maleware PicColor


Passwort leer lassen und ENTER
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 01.02.2015, 18:36   #30
Lilly1
 
Maleware PicColor - Standard

Maleware PicColor


F8 hat nicht funktioniert. Deshalb habe ich es nach Anleitung 1 Bootvariante gemacht

Geht auch nicht

Antwort
Seite 2 von 5 1 2 34 Letzte »

Themen zu Maleware PicColor
avira, bericht, betriebssystem, browser, c:\windows, dateien, deinstallation, dienste, einfach, erstellt, explorer, free, funktioniert, gen, google, internet, internet explorer, live, maleware, maleware fund, neue, ordner, programm, suche, system, system32


« Werbung trotz Addblocker unter Windows 8.1 und Chrome | Positive Finds »


Ähnliche Themen: Maleware PicColor


  1. Skype?Maleware
    Log-Analyse und Auswertung - 16.09.2014 (3)
  2. Techbrwosing Maleware?
    Alles rund um Mac OSX & Linux - 23.02.2014 (3)
  3. maleware problem
    Log-Analyse und Auswertung - 19.02.2014 (27)
  4. Maleware Verschlüsselung?
    Plagegeister aller Art und deren Bekämpfung - 09.02.2014 (1)
  5. Maleware test
    Plagegeister aller Art und deren Bekämpfung - 22.01.2014 (18)
  6. Spyhunter 4, Maleware oder Maleware Security Suite?
    Plagegeister aller Art und deren Bekämpfung - 07.05.2013 (5)
  7. Skype Maleware
    Plagegeister aller Art und deren Bekämpfung - 13.03.2013 (1)
  8. Maleware entfernen
    Plagegeister aller Art und deren Bekämpfung - 04.12.2012 (21)
  9. Maleware gefunden!
    Log-Analyse und Auswertung - 06.10.2012 (2)
  10. Maleware gefunden was tun?
    Log-Analyse und Auswertung - 24.04.2012 (23)
  11. mahilfe - maleware?
    Log-Analyse und Auswertung - 22.02.2012 (11)
  12. Maleware auf der Homepage???
    Plagegeister aller Art und deren Bekämpfung - 18.01.2012 (1)
  13. Maleware utilcrt80.dll?
    Plagegeister aller Art und deren Bekämpfung - 26.12.2011 (20)
  14. Maleware TR/AGENT.GX.361
    Plagegeister aller Art und deren Bekämpfung - 29.06.2010 (19)
  15. Maleware Defense
    Plagegeister aller Art und deren Bekämpfung - 18.01.2010 (12)
  16. Google Maleware
    Log-Analyse und Auswertung - 29.11.2008 (1)
  17. Maleware!!
    Log-Analyse und Auswertung - 01.04.2006 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Maleware PicColor - Einen Moment checke das mal eben. - Maleware PicColor...
Archiv
Du betrachtest: Maleware PicColor auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55