Auf suspekten Link geklickt/Kaspersky findet nichts

Andigo · 04.02.2015, 10:49

Moin moin,

Ich habe vorgestern abend auf einen Link geklickt, der mir von einem Kontakt bei Steam gesendet wurde. Obwohl der Link schon einigermaßen suspekt aussah, habe ich ihn blöderweise geöffnet.

Bevor der Steam Browser ihn allerdings geladen hatte, kam schon die Meldung von Kaspersky, dass es sich um einen als unsicher eingestuften Link handelt. Umgehend habe ich das System von Kaspersky überprüfen lassen, jedoch blieben sowohl vollständiger Systemcheck als auch die Rootkitsuche ergebnislos.

Um Sicherheit zu haben würde ich deshalb gerne die Meinung von jemandem mit Erfahrung hören, ich habe vorsorglich frst und GMER nach Anleitung benutzt und logs angefertigt, falls diese gebraucht werden.

Hoffe ihr könnt mir helfen

schrauber · 04.02.2015, 11:06

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Andigo · 04.02.2015, 11:46

Hoffe das klappt so

FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by paul (administrator) on PAUL-PC on 03-02-2015 19:33:05
Running from C:\Users\paul\Downloads
Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avpui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
() C:\Users\paul\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKone+] => C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE [557056 2013-09-13] (ROCCAT GmbH)
HKLM-x32\...\RunOnce: [DXTempFolder] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\paul\AppData\Local\Temp\DXBE5F.tmp\" <===== ATTENTION
HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\MountPoints2: {7aafdb6c-d0ef-11e1-8409-806e6f6e6963} - F:\setup.exe
HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\MountPoints2: {7aafdb6d-d0ef-11e1-8409-806e6f6e6963} - G:\Setup.exe -check
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-11-27] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2492140108-2297389676-158246720-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF user.js: detected! => C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\user.js
FF SearchPlugin: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\searchplugins\trovi.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-03]
FF Extension: DownloadHelper - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]
FF Extension: Adblock Plus - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-25]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-27]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]
FF HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-03]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2014-12-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2014-12-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2014-12-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 19:33 - 2015-02-03 19:33 - 00011766 _____ () C:\Users\paul\Downloads\FRST.txt
2015-02-03 19:33 - 2015-02-03 19:33 - 00000000 ____D () C:\FRST
2015-02-03 19:32 - 2015-02-03 19:32 - 02131456 _____ (Farbar) C:\Users\paul\Downloads\FRST64.exe
2015-02-03 19:30 - 2015-02-03 19:30 - 00000470 _____ () C:\Users\paul\Downloads\defogger_disable.log
2015-02-03 19:30 - 2015-02-03 19:30 - 00000000 _____ () C:\Users\paul\defogger_reenable
2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe
2015-02-02 13:12 - 2015-02-02 13:12 - 00000869 _____ () C:\Users\paul\Desktop\BitTorrent.lnk
2015-02-02 13:12 - 2015-02-02 13:12 - 00000849 _____ () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk
2015-02-02 13:11 - 2015-02-02 13:25 - 00000000 ____D () C:\Users\paul\AppData\Roaming\BitTorrent
2015-02-02 13:11 - 2015-02-02 13:11 - 01738840 _____ (BitTorrent Inc.) C:\Users\paul\Downloads\BitTorrent_7.9.2.38398.exe
2015-01-31 22:45 - 2015-01-31 22:46 - 01983604 _____ () C:\Users\paul\Downloads\HoxHud P8.8 Self-installer.exe
2015-01-29 14:16 - 2015-01-29 14:30 - 44769901 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.33_95.exe
2015-01-28 20:54 - 2015-01-28 20:54 - 00001111 _____ () C:\Users\Public\Desktop\Fragen-Lern-CD 4.6.lnk
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\paul\AppData\Roaming\de.wendel.flcd-de
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Wendel-Verlag
2015-01-27 21:02 - 2015-01-27 21:26 - 00000000 ____D () C:\Users\paul\Downloads\DSfix24
2015-01-27 21:01 - 2015-01-27 21:02 - 00392093 _____ () C:\Users\paul\Downloads\DSfix24.zip
2015-01-27 16:38 - 2015-01-27 16:38 - 00000000 ____D () C:\Users\paul\AppData\Local\NBGI
2015-01-27 16:37 - 2015-01-27 16:37 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Windows\SysWOW64\xlive
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2015-01-27 10:13 - 2015-01-27 10:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 20:32 - 2015-02-02 13:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\FLV and Media Player
2015-01-25 20:31 - 2015-01-25 20:31 - 00001325 _____ () C:\Users\Public\Desktop\FLV and Media Player.lnk
2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies
2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\Program Files (x86)\Applian Technologies
2015-01-25 20:29 - 2015-01-25 20:30 - 23750568 _____ () C:\Users\paul\Downloads\FLVPlayer4211Install.exe
2015-01-25 19:34 - 2015-02-02 13:23 - 00000000 ____D () C:\Users\paul\dwhelper
2015-01-25 19:28 - 2015-01-25 19:30 - 00000000 ____D () C:\Users\paul\Downloads\chrome
2015-01-25 19:28 - 2015-01-25 19:28 - 00000979 _____ () C:\Users\Public\Desktop\WinRAR.lnk
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Program Files\WinRAR
2015-01-25 19:28 - 2014-09-05 09:15 - 00003914 _____ () C:\Users\paul\Downloads\chrome.manifest
2015-01-25 19:28 - 2014-09-05 09:15 - 00001956 _____ () C:\Users\paul\Downloads\install.rdf
2015-01-25 19:28 - 2014-09-05 09:15 - 00000000 ____D () C:\Users\paul\Downloads\defaults
2015-01-25 19:27 - 2015-01-25 19:27 - 02060888 _____ () C:\Users\paul\Downloads\winrar-x64-520d.exe
2015-01-25 19:26 - 2015-01-25 19:26 - 00772184 _____ () C:\Users\paul\Downloads\video_downloadhelper-4.9.24-sm_fx.zip
2015-01-24 15:17 - 2015-01-24 15:17 - 00000000 ____D () C:\Users\paul\Documents\nbgi
2015-01-24 14:34 - 2015-01-24 14:34 - 00000222 _____ () C:\Users\paul\Desktop\Dark Souls Prepare to Die Edition.url
2015-01-22 10:37 - 2015-02-03 19:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-22 10:37 - 2015-01-25 12:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-18 02:02 - 2015-01-18 02:02 - 40177100 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.26_95.exe
2015-01-15 01:02 - 2015-01-15 01:02 - 00302688 _____ () C:\Windows\Minidump\011515-40326-01.dmp
2015-01-14 12:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 12:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 12:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 12:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 12:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 12:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 12:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 12:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 12:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 12:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 12:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 12:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 12:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 20:29 - 2015-01-13 20:29 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Wargaming.net
2015-01-11 19:09 - 2015-01-11 19:09 - 00000769 _____ () C:\Users\paul\Desktop\World of Tanks.lnk
2015-01-11 19:09 - 2015-01-11 19:09 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks
2015-01-07 12:05 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-01-07 12:05 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-01-06 20:26 - 2015-01-06 20:26 - 00000000 ____D () C:\Users\paul\AppData\Roaming\OpenOffice
2015-01-05 12:37 - 2015-01-05 12:37 - 05994752 _____ (Wargaming.net ) C:\Users\paul\Downloads\WoT_internet_install_eu(1).exe
2015-01-05 12:33 - 2015-01-05 12:33 - 05994752 _____ (Wargaming.net ) C:\Users\paul\Downloads\WoT_internet_install_eu.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 19:30 - 2012-07-18 17:14 - 00000000 ____D () C:\Users\paul
2015-02-03 19:13 - 2012-07-18 16:47 - 01227670 _____ () C:\Windows\WindowsUpdate.log
2015-02-03 16:30 - 2014-11-27 10:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-03 13:26 - 2014-11-27 11:58 - 00057813 _____ () C:\Windows\DirectX.log
2015-02-03 13:04 - 2014-12-22 12:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-03 12:56 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 12:56 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 12:49 - 2014-11-29 09:27 - 00108862 _____ () C:\Windows\PFRO.log
2015-02-03 12:49 - 2012-07-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-03 12:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-03 12:49 - 2009-07-14 05:51 - 00037167 _____ () C:\Windows\setupact.log
2015-01-31 13:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-29 09:45 - 2012-07-18 17:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-28 20:46 - 2014-11-27 10:59 - 00000000 ____D () C:\Users\paul\AppData\Local\Adobe
2015-01-28 20:46 - 2012-07-18 17:36 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Adobe
2015-01-27 16:37 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-27 16:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-27 13:25 - 2012-07-18 17:37 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Skype
2015-01-25 12:50 - 2012-07-18 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 12:50 - 2012-07-18 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-24 14:34 - 2014-11-27 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-18 12:52 - 2012-07-18 18:09 - 00065832 _____ () C:\Users\paul\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-18 12:43 - 2009-07-14 05:45 - 00301632 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-17 15:46 - 2012-07-18 18:08 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-01-15 01:02 - 2012-07-19 15:07 - 477307799 _____ () C:\Windows\MEMORY.DMP
2015-01-15 01:02 - 2012-07-19 15:07 - 00000000 ____D () C:\Windows\Minidump
2015-01-11 19:09 - 2012-05-08 19:50 - 00000000 ____D () C:\Games
2015-01-11 13:21 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-01-06 20:37 - 2012-07-18 17:37 - 00000000 ____D () C:\Windows.old
2015-01-06 04:36 - 2012-07-18 17:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-05 12:38 - 2014-12-27 14:52 - 00000000 ____D () C:\Windows\SysWOW64\directx
2015-01-05 12:37 - 2014-12-27 14:52 - 00000000 ___HD () C:\Windows\msdownld.tmp

Some content of TEMP:
====================
C:\Users\paul\AppData\Local\Temp\FreeYouTubeDownload.exe
C:\Users\paul\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\paul\AppData\Local\Temp\uttAFC8.tmp.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-24 22:37

==================== End Of Log ============================

--- --- ---

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
Ran by paul at 2015-02-03 19:34:02
Running from C:\Users\paul\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Anti-Virus (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Apple Application Support (HKLM-x32\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Aslain's XVM Mod Version 4.1.33 (HKLM-x32\...\ZRwTINhSZfduKONYrSCTiCiGPggQZdcLRvoAVxyCOXXpkHeC~1DC3968F_is1) (Version: 4.1.33 - Aslain)
AutoHotkey 1.0.48.05 (HKLM-x32\...\AutoHotkey) (Version: 1.0.48.05 - Chris Mallett)
BitTorrent (HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\BitTorrent) (Version: 7.9.2.38398 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - FromSoftware)
DARK SOULS™ II (HKLM-x32\...\Steam App 236430) (Version:  - FromSoftware, Inc)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
FLV and Media Player 4.2.1.1 (HKLM-x32\...\FLV and Media Player) (Version: 4.2.1.1 - Applian Technologies)
Fragen-Lern-CD 4.6 (HKLM-x32\...\de.wendel.flcd-de) (Version: 4.6.5 - Wendel-Verlag GmbH)
Fragen-Lern-CD 4.6 (x32 Version: 4.6.5 - Wendel-Verlag GmbH) Hidden
Free YouTube Download version 3.2.49.1122 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.49.1122 - DVDVideoSoft Ltd.)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
NVIDIA 3D Vision Controller-Treiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 301.42 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 301.42 - NVIDIA Corporation)
NVIDIA Grafiktreiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 301.42 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.16.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.16.0 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.8.15 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.8.15 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)
ROCCAT Kone[+] Mouse Driver (HKLM-x32\...\{B99CB207-4704-4C51-9309-0FA90AA26DD4}) (Version:  - Roccat GmbH)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
World of Tanks (HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

30-01-2015 11:07:09 Windows Update
01-02-2015 12:24:07 DirectX wurde installiert
02-02-2015 09:24:59 DirectX wurde installiert
02-02-2015 13:31:26 Removed Fragen-Lern-CD 4.6
03-02-2015 12:54:09 Windows Update
03-02-2015 13:24:40 DirectX wurde installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3C5BEC23-61CF-49D4-83C5-AD5D8DD161F0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {787D2A08-39B4-4E29-918E-A175A362829B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-07-18 17:38 - 2012-05-15 10:28 - 00085824 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2009-11-19 05:01 - 2009-11-19 05:01 - 00022016 _____ () C:\Windows\System32\sugw2l6.dll
2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe
2014-08-30 17:12 - 2014-08-30 17:12 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\kpcengine.2.3.dll
2014-12-23 17:51 - 2010-06-22 13:50 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\hiddriver.dll
2015-01-27 10:13 - 2015-01-27 10:13 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-30 17:12 - 2014-12-22 12:15 - 00459048 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-08-30 17:12 - 2014-12-22 12:15 - 00587048 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2015-01-25 12:50 - 2015-01-25 12:50 - 16844976 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll
2014-11-27 10:55 - 2014-12-01 22:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-11-27 10:55 - 2014-12-01 22:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-11-27 10:55 - 2014-12-01 22:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-11-27 10:55 - 2014-12-01 22:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-11-27 10:55 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-20 11:37 - 2014-12-02 01:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-20 11:37 - 2014-12-02 01:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-20 11:37 - 2014-12-02 01:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-11-27 10:55 - 2015-01-23 23:34 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll
2014-11-27 10:55 - 2014-12-01 22:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-11-27 10:55 - 2015-01-23 23:33 - 00696512 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-11-27 10:55 - 2015-01-16 00:42 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-11-27 10:55 - 2015-01-16 00:42 - 01709960 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2492140108-2297389676-158246720-500 - Administrator - Disabled)
Gast (S-1-5-21-2492140108-2297389676-158246720-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2492140108-2297389676-158246720-1002 - Limited - Enabled)
paul (S-1-5-21-2492140108-2297389676-158246720-1001 - Administrator - Enabled) => C:\Users\paul
UpdatusUser (S-1-5-21-2492140108-2297389676-158246720-1003 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10000

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10000

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/02/2015 01:13:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: BitTorrent.exe, Version: 7.9.2.38398, Zeitstempel: 0x54c6c76c
Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.1.7601.18532, Zeitstempel: 0x53c3352a
Ausnahmecode: 0xc0020043
Fehleroffset: 0x0005d111
ID des fehlerhaften Prozesses: 0x1bd0
Startzeit der fehlerhaften Anwendung: 0xBitTorrent.exe0
Pfad der fehlerhaften Anwendung: BitTorrent.exe1
Pfad des fehlerhaften Moduls: BitTorrent.exe2
Berichtskennung: BitTorrent.exe3

Error: (01/28/2015 03:17:10 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 90080108

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7004

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7004

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6006

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6006


System errors:
=============
Error: (01/24/2015 11:24:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/24/2015 11:24:46 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (01/20/2015 11:37:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/20/2015 11:37:14 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (01/17/2015 02:38:10 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/16/2015 01:09:09 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/15/2015 01:02:21 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000000a (0x00000000001d7c1b, 0x0000000000000002, 0x0000000000000000, 0xfffff800032841b0)C:\Windows\MEMORY.DMP011515-40326-01

Error: (01/07/2015 01:45:21 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/02/2015 01:41:57 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/02/2015 01:18:02 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.


Microsoft Office Sessions:
=========================
Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10000

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10000

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/02/2015 01:13:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: BitTorrent.exe7.9.2.3839854c6c76cRPCRT4.dll6.1.7601.1853253c3352ac00200430005d1111bd001d03ee1a81863caC:\Users\paul\AppData\Roaming\BitTorrent\BitTorrent.exeC:\Windows\syswow64\RPCRT4.dlle63b1a6e-aad4-11e4-a785-50465d06929f

Error: (01/28/2015 03:17:10 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 90080108

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7004

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7004

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6006

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6006


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
Percentage of memory in use: 23%
Total physical RAM: 8125.66 MB
Available physical RAM: 6213.25 MB
Total Pagefile: 16249.51 MB
Available Pagefile: 13422.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:306.44 GB) (Free:122.42 GB) NTFS
Drive e: () (Fixed) (Total:289.64 GB) (Free:282.29 GB) NTFS
Drive h: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 9DC5DB2A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=306.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=289.6 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 04.02.2015, 19:06

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Andigo · 04.02.2015, 22:35

Hi, hoffe du kannst damit was anfangen^^

Code:

ATTFilter

ComboFix 15-02-02.01 - paul 04.02.2015  22:22:35.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8126.3448 [GMT 1:00]
ausgeführt von:: c:\users\paul\Downloads\ComboFix.exe
AV: Kaspersky Anti-Virus *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
SP: Kaspersky Anti-Virus *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msdownld.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-01-04 bis 2015-02-04  ))))))))))))))))))))))))))))))
.
.
2015-02-04 21:27 . 2015-02-04 21:27	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2015-02-04 21:27 . 2015-02-04 21:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-02-03 18:33 . 2015-02-03 18:34	--------	d-----w-	C:\FRST
2015-02-03 11:54 . 2014-12-02 10:26	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{1038CAF4-F873-4158-B52E-82DFB2899200}\mpengine.dll
2015-02-02 12:11 . 2015-02-02 12:25	--------	d-----w-	c:\users\paul\AppData\Roaming\BitTorrent
2015-01-28 19:54 . 2015-01-28 19:54	--------	d-----w-	c:\users\paul\AppData\Roaming\de.wendel.flcd-de
2015-01-28 19:54 . 2015-02-02 12:31	--------	d-----w-	c:\program files (x86)\Common Files\Adobe AIR
2015-01-28 19:54 . 2015-01-28 19:54	--------	d-----w-	c:\program files (x86)\Wendel-Verlag
2015-01-27 15:38 . 2015-01-27 15:38	--------	d-----w-	c:\users\paul\AppData\Local\NBGI
2015-01-27 15:37 . 2015-01-27 15:37	--------	d-----w-	c:\windows\SysWow64\xlive
2015-01-27 15:37 . 2015-01-27 15:37	--------	d-----w-	c:\program files (x86)\Microsoft Games for Windows - LIVE
2015-01-25 19:32 . 2015-02-04 10:04	--------	d-----w-	c:\users\paul\AppData\Roaming\FLV and Media Player
2015-01-25 19:31 . 2015-01-25 19:31	--------	d-----w-	c:\program files (x86)\Applian Technologies
2015-01-25 18:34 . 2015-02-04 09:57	--------	d-----w-	c:\users\paul\dwhelper
2015-01-25 18:28 . 2015-01-25 18:28	--------	d-----w-	c:\program files\WinRAR
2015-01-13 19:29 . 2015-01-13 19:29	--------	d-----w-	c:\users\paul\AppData\Roaming\Wargaming.net
2015-01-07 11:05 . 2013-04-09 23:34	1247744	----a-w-	c:\windows\SysWow64\DWrite.dll
2015-01-07 11:05 . 2013-04-02 22:51	1643520	----a-w-	c:\windows\system32\DWrite.dll
2015-01-06 19:26 . 2015-01-06 19:26	--------	d-----w-	c:\users\paul\AppData\Roaming\OpenOffice
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-04 17:57 . 2014-11-27 09:58	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2015-01-27 15:40 . 2009-08-18 11:49	564632	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2015-01-27 15:40 . 2009-08-18 10:24	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2015-01-25 11:50 . 2012-07-18 16:33	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-25 11:50 . 2012-07-18 16:33	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-06 03:36 . 2012-07-18 16:26	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-12-22 11:15 . 2014-08-20 17:04	818888	----a-w-	c:\windows\system32\drivers\klif.sys
2014-12-22 11:15 . 2014-08-18 13:43	150536	----a-w-	c:\windows\system32\drivers\klflt.sys
2014-12-22 11:15 . 2014-08-13 18:34	77512	----a-w-	c:\windows\system32\drivers\klwtp.sys
2014-12-13 05:09 . 2014-12-18 10:30	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-13 03:33 . 2014-12-18 10:30	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2014-12-04 02:50 . 2014-12-16 18:17	413184	----a-w-	c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-16 18:17	741376	----a-w-	c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-16 18:17	396800	----a-w-	c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-16 18:17	830976	----a-w-	c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-16 18:17	192000	----a-w-	c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-16 18:17	227328	----a-w-	c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-16 18:17	1083392	----a-w-	c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-16 18:17	1232040	----a-w-	c:\windows\system32\aitstatic.exe
2014-12-01 19:31 . 2014-12-01 19:31	113848	----a-w-	c:\windows\system32\pdfcmon.dll
2014-11-28 20:01 . 2014-11-28 20:01	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2014-11-28 20:01 . 2014-11-28 20:01	942592	----a-w-	c:\windows\system32\jsIntl.dll
2014-11-28 20:01 . 2014-11-28 20:01	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2014-11-28 20:01 . 2014-11-28 20:01	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2014-11-28 20:01 . 2014-11-28 20:01	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2014-11-28 20:01 . 2014-11-28 20:01	81408	----a-w-	c:\windows\system32\icardie.dll
2014-11-28 20:01 . 2014-11-28 20:01	774144	----a-w-	c:\windows\system32\jscript.dll
2014-11-28 20:01 . 2014-11-28 20:01	77312	----a-w-	c:\windows\system32\tdc.ocx
2014-11-28 20:01 . 2014-11-28 20:01	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2014-11-28 20:01 . 2014-11-28 20:01	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2014-11-28 20:01 . 2014-11-28 20:01	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2014-11-28 20:01 . 2014-11-28 20:01	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2014-11-28 20:01 . 2014-11-28 20:01	62464	----a-w-	c:\windows\system32\pngfilt.dll
2014-11-28 20:01 . 2014-11-28 20:01	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2014-11-28 20:01 . 2014-11-28 20:01	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2014-11-28 20:01 . 2014-11-28 20:01	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2014-11-28 20:01 . 2014-11-28 20:01	48640	----a-w-	c:\windows\system32\mshtmler.dll
2014-11-28 20:01 . 2014-11-28 20:01	48128	----a-w-	c:\windows\system32\imgutil.dll
2014-11-28 20:01 . 2014-11-28 20:01	413696	----a-w-	c:\windows\system32\html.iec
2014-11-28 20:01 . 2014-11-28 20:01	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2014-11-28 20:01 . 2014-11-28 20:01	337408	----a-w-	c:\windows\SysWow64\html.iec
2014-11-28 20:01 . 2014-11-28 20:01	30208	----a-w-	c:\windows\system32\licmgr10.dll
2014-11-28 20:01 . 2014-11-28 20:01	247808	----a-w-	c:\windows\system32\msls31.dll
2014-11-28 20:01 . 2014-11-28 20:01	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2014-11-28 20:01 . 2014-11-28 20:01	243200	----a-w-	c:\windows\system32\webcheck.dll
2014-11-28 20:01 . 2014-11-28 20:01	235520	----a-w-	c:\windows\system32\url.dll
2014-11-28 20:01 . 2014-11-28 20:01	235008	----a-w-	c:\windows\system32\elshyph.dll
2014-11-28 20:01 . 2014-11-28 20:01	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2014-11-28 20:01 . 2014-11-28 20:01	167424	----a-w-	c:\windows\system32\iexpress.exe
2014-11-28 20:01 . 2014-11-28 20:01	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2014-11-28 20:01 . 2014-11-28 20:01	147968	----a-w-	c:\windows\system32\occache.dll
2014-11-28 20:01 . 2014-11-28 20:01	143872	----a-w-	c:\windows\system32\wextract.exe
2014-11-28 20:01 . 2014-11-28 20:01	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2014-11-28 20:01 . 2014-11-28 20:01	13824	----a-w-	c:\windows\system32\mshta.exe
2014-11-28 20:01 . 2014-11-28 20:01	135680	----a-w-	c:\windows\system32\iepeers.dll
2014-11-28 20:01 . 2014-11-28 20:01	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2014-11-28 20:01 . 2014-11-28 20:01	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2014-11-28 20:01 . 2014-11-28 20:01	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2014-11-28 20:01 . 2014-11-28 20:01	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2014-11-28 20:01 . 2014-11-28 20:01	105984	----a-w-	c:\windows\system32\iesysprep.dll
2014-11-28 20:01 . 2014-11-28 20:01	101376	----a-w-	c:\windows\system32\inseng.dll
2014-11-28 19:58 . 2014-11-28 19:58	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2014-11-28 19:58 . 2014-11-28 19:58	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2014-11-28 19:58 . 2014-11-28 19:58	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2014-11-28 19:58 . 2014-11-28 19:58	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2014-11-28 19:58 . 2014-11-28 19:58	363008	----a-w-	c:\windows\system32\dxgi.dll
2014-11-28 19:58 . 2014-11-28 19:58	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2014-11-28 19:58 . 2014-11-28 19:58	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	296960	----a-w-	c:\windows\system32\d3d10core.dll
2014-11-28 19:58 . 2014-11-28 19:58	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2014-11-28 19:58 . 2014-11-28 19:58	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2014-11-28 19:58 . 2014-11-28 19:58	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2014-11-28 19:58 . 2014-11-28 19:58	221184	----a-w-	c:\windows\system32\UIAnimation.dll
2014-11-28 19:58 . 2014-11-28 19:58	220160	----a-w-	c:\windows\SysWow64\d3d10core.dll
2014-11-28 19:58 . 2014-11-28 19:58	207872	----a-w-	c:\windows\SysWow64\WindowsCodecsExt.dll
2014-11-28 19:58 . 2014-11-28 19:58	194560	----a-w-	c:\windows\system32\d3d10_1.dll
2014-11-28 19:58 . 2014-11-28 19:58	187392	----a-w-	c:\windows\SysWow64\UIAnimation.dll
2014-11-28 19:58 . 2014-11-28 19:58	1682432	----a-w-	c:\windows\system32\XpsPrint.dll
2014-11-28 19:58 . 2014-11-28 19:58	161792	----a-w-	c:\windows\SysWow64\d3d10_1.dll
2014-11-28 19:58 . 2014-11-28 19:58	1238528	----a-w-	c:\windows\system32\d3d10.dll
2014-11-28 19:58 . 2014-11-28 19:58	1175552	----a-w-	c:\windows\system32\FntCache.dll
2014-11-28 19:58 . 2014-11-28 19:58	1158144	----a-w-	c:\windows\SysWow64\XpsPrint.dll
2014-11-28 19:58 . 2014-11-28 19:58	1080832	----a-w-	c:\windows\SysWow64\d3d10.dll
2014-11-28 19:58 . 2014-11-28 19:58	10752	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-11-28 19:58 . 2014-11-28 19:58	10752	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-11-22 12:54	323752	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 AVP15.0.1;Kaspersky Anti-Virus Service 15.0.1;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
S0 cm_km_w;Kaspersky Lab Crypto Module (FDE PDK);c:\windows\system32\DRIVERS\cm_km_w.sys;c:\windows\SYSNATIVE\DRIVERS\cm_km_w.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 Klwtp;Klwtp;c:\windows\system32\DRIVERS\klwtp.sys;c:\windows\SYSNATIVE\DRIVERS\klwtp.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 kldisk;kldisk;c:\windows\system32\DRIVERS\kldisk.sys;c:\windows\SYSNATIVE\DRIVERS\kldisk.sys [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 LVUVC64;Logitech HD Webcam C510(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - KXLDAPOD
*Deregistered* - kxldapod
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 11:50]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-11-20 13:53	357376	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: {{09A10376-994C-4BBF-9121-F50CF7BA237E} - {F2A56BFE-7911-451A-BC74-A9C3C2E95126} - c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-02-04  22:28:57
ComboFix-quarantined-files.txt  2015-02-04 21:28
.
Vor Suchlauf: 13 Verzeichnis(se), 130.948.173.824 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 131.980.242.944 Bytes frei
.
- - End Of File - - 4BF2C6C2F6A750DE032F129FE30B4ABE
A36C5E4F47E84449FF07ED3517B43A31

Mir fällt grade auf, dass ich den Defender nicht deaktiviert habe, habe allerdings keine Fehldermeldung oder Ähnliches bekommen. Wenn ich den Scan wiederholen soll dann sag bescheid ^^

schrauber · 05.02.2015, 10:21

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Andigo · 05.02.2015, 12:29

Alles klar!

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 05.02.2015
Suchlauf-Zeit: 11:59:36
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.02.05.04
Rootkit Datenbank: v2015.02.03.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: paul

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 377367
Verstrichene Zeit: 3 Min, 22 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by paul on 05.02.2015 at 12:07:47,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\paul\AppData\Roaming\pdfforge"



~~~ FireFox

Successfully deleted: [File] C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\qfm7bsca.default\user.js
Emptied folder: C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\qfm7bsca.default\minidumps [31 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.02.2015 at 12:09:45,33
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

# AdwCleaner v4.109 - Bericht erstellt am 05/02/2015 um 12:13:11
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-02-04.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : paul - PAUL-PC
# Gestartet von : C:\Users\paul\Downloads\AdwCleaner_4.109.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gefunden : C:\Users\paul\AppData\Roaming\RHEng

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Daten Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v35.0.1 (x86 de)


*************************

AdwCleaner[R0].txt - [1619 octets] - [05/02/2015 12:13:11]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1679 octets] ##########

Code:

ATTFilter

# AdwCleaner v4.109 - Bericht erstellt am 05/02/2015 um 12:16:26
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-02-04.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : paul - PAUL-PC
# Gestartet von : C:\Users\paul\Downloads\AdwCleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\paul\AppData\Roaming\RHEng

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v35.0.1 (x86 de)


*************************

AdwCleaner[R0].txt - [1767 octets] - [05/02/2015 12:13:11]
AdwCleaner[S0].txt - [1680 octets] - [05/02/2015 12:16:26]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1740 octets] ##########

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01
Ran by paul (administrator) on PAUL-PC on 05-02-2015 12:22:40
Running from C:\Users\paul\Desktop
Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avpui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKone+] => C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE [557056 2013-09-13] (ROCCAT GmbH)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2492140108-2297389676-158246720-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2492140108-2297389676-158246720-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2492140108-2297389676-158246720-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\searchplugins\trovi.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-03]
FF Extension: DownloadHelper - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]
FF Extension: Adblock Plus - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-25]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-27]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]
FF HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-03]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2014-12-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2014-12-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2014-12-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 12:22 - 2015-02-05 12:22 - 00000000 ____D () C:\Users\paul\Desktop\FRST-OlderVersion
2015-02-05 12:16 - 2015-02-05 12:20 - 00001828 _____ () C:\Users\paul\Desktop\AdwCleaner[S0].txt
2015-02-05 12:16 - 2015-02-05 12:16 - 00001767 _____ () C:\Users\paul\Desktop\AdwCleaner[R0].txt
2015-02-05 12:13 - 2015-02-05 12:22 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:09 - 2015-02-05 12:09 - 00000940 _____ () C:\Users\paul\Desktop\JRT.txt
2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\Users\paul\Desktop\mbam.txt
2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\mbam.txt
2015-02-05 11:49 - 2015-02-05 11:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 11:49 - 2015-02-05 11:49 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 11:49 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-05 11:49 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-05 11:49 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-05 11:45 - 2015-02-05 11:45 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\paul\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-05 11:45 - 2015-02-05 11:45 - 02194432 _____ () C:\Users\paul\Downloads\AdwCleaner_4.109.exe
2015-02-05 11:45 - 2015-02-05 11:45 - 01388274 _____ (Thisisu) C:\Users\paul\Downloads\JRT.exe
2015-02-04 23:41 - 2015-02-04 23:41 - 00519128 _____ () C:\Windows\Minidump\020415-17908-01.dmp
2015-02-04 22:50 - 2015-02-04 22:50 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-02-04 22:28 - 2015-02-04 22:28 - 00018312 _____ () C:\ComboFix.txt
2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Windows\erdnt
2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Qoobox
2015-02-04 22:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-04 22:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-04 22:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-02-04 22:18 - 2015-02-04 22:18 - 05611380 ____R (Swearware) C:\Users\paul\Downloads\ComboFix.exe
2015-02-04 10:32 - 2015-02-04 10:32 - 00037494 _____ () C:\Users\paul\Desktop\gmer.txt
2015-02-03 19:38 - 2015-02-03 19:38 - 00020073 _____ () C:\Users\paul\Desktop\Addition.txt
2015-02-03 19:37 - 2015-02-05 12:22 - 00011111 _____ () C:\Users\paul\Desktop\FRST.txt
2015-02-03 19:35 - 2015-02-03 19:36 - 00380416 _____ () C:\Users\paul\Downloads\nvdf6jxn.exe
2015-02-03 19:34 - 2015-02-03 19:34 - 00020073 _____ () C:\Users\paul\Downloads\Addition.txt
2015-02-03 19:33 - 2015-02-05 12:22 - 00000000 ____D () C:\FRST
2015-02-03 19:33 - 2015-02-03 19:34 - 00024311 _____ () C:\Users\paul\Downloads\FRST.txt
2015-02-03 19:32 - 2015-02-05 12:22 - 02131968 _____ (Farbar) C:\Users\paul\Desktop\FRST64.exe
2015-02-03 19:30 - 2015-02-03 19:30 - 00000470 _____ () C:\Users\paul\Downloads\defogger_disable.log
2015-02-03 19:30 - 2015-02-03 19:30 - 00000000 _____ () C:\Users\paul\defogger_reenable
2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe
2015-02-02 13:12 - 2015-02-02 13:12 - 00000869 _____ () C:\Users\paul\Desktop\BitTorrent.lnk
2015-02-02 13:12 - 2015-02-02 13:12 - 00000849 _____ () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk
2015-02-02 13:11 - 2015-02-02 13:25 - 00000000 ____D () C:\Users\paul\AppData\Roaming\BitTorrent
2015-02-02 13:11 - 2015-02-02 13:11 - 01738840 _____ (BitTorrent Inc.) C:\Users\paul\Downloads\BitTorrent_7.9.2.38398.exe
2015-01-31 22:45 - 2015-01-31 22:46 - 01983604 _____ () C:\Users\paul\Downloads\HoxHud P8.8 Self-installer.exe
2015-01-29 14:16 - 2015-01-29 14:30 - 44769901 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.33_95.exe
2015-01-28 20:54 - 2015-01-28 20:54 - 00001111 _____ () C:\Users\Public\Desktop\Fragen-Lern-CD 4.6.lnk
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\paul\AppData\Roaming\de.wendel.flcd-de
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Wendel-Verlag
2015-01-27 21:02 - 2015-01-27 21:26 - 00000000 ____D () C:\Users\paul\Downloads\DSfix24
2015-01-27 21:01 - 2015-01-27 21:02 - 00392093 _____ () C:\Users\paul\Downloads\DSfix24.zip
2015-01-27 16:38 - 2015-01-27 16:38 - 00000000 ____D () C:\Users\paul\AppData\Local\NBGI
2015-01-27 16:37 - 2015-01-27 16:37 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Windows\SysWOW64\xlive
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2015-01-27 10:13 - 2015-01-27 10:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 20:32 - 2015-02-04 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\FLV and Media Player
2015-01-25 20:31 - 2015-01-25 20:31 - 00001325 _____ () C:\Users\Public\Desktop\FLV and Media Player.lnk
2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies
2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\Program Files (x86)\Applian Technologies
2015-01-25 20:29 - 2015-01-25 20:30 - 23750568 _____ () C:\Users\paul\Downloads\FLVPlayer4211Install.exe
2015-01-25 19:34 - 2015-02-04 10:57 - 00000000 ____D () C:\Users\paul\dwhelper
2015-01-25 19:28 - 2015-01-25 19:30 - 00000000 ____D () C:\Users\paul\Downloads\chrome
2015-01-25 19:28 - 2015-01-25 19:28 - 00000979 _____ () C:\Users\Public\Desktop\WinRAR.lnk
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Program Files\WinRAR
2015-01-25 19:28 - 2014-09-05 09:15 - 00003914 _____ () C:\Users\paul\Downloads\chrome.manifest
2015-01-25 19:28 - 2014-09-05 09:15 - 00001956 _____ () C:\Users\paul\Downloads\install.rdf
2015-01-25 19:28 - 2014-09-05 09:15 - 00000000 ____D () C:\Users\paul\Downloads\defaults
2015-01-25 19:27 - 2015-01-25 19:27 - 02060888 _____ () C:\Users\paul\Downloads\winrar-x64-520d.exe
2015-01-25 19:26 - 2015-01-25 19:26 - 00772184 _____ () C:\Users\paul\Downloads\video_downloadhelper-4.9.24-sm_fx.zip
2015-01-24 15:17 - 2015-01-24 15:17 - 00000000 ____D () C:\Users\paul\Documents\nbgi
2015-01-24 14:34 - 2015-01-24 14:34 - 00000222 _____ () C:\Users\paul\Desktop\Dark Souls Prepare to Die Edition.url
2015-01-22 10:37 - 2015-02-05 11:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-22 10:37 - 2015-02-04 22:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-18 02:02 - 2015-01-18 02:02 - 40177100 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.26_95.exe
2015-01-15 01:02 - 2015-01-15 01:02 - 00302688 _____ () C:\Windows\Minidump\011515-40326-01.dmp
2015-01-14 12:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 12:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 12:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 12:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 12:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 12:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 12:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 12:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 12:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 12:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 12:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 12:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 12:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 20:29 - 2015-01-13 20:29 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Wargaming.net
2015-01-11 19:09 - 2015-01-11 19:09 - 00000769 _____ () C:\Users\paul\Desktop\World of Tanks.lnk
2015-01-11 19:09 - 2015-01-11 19:09 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks
2015-01-07 12:05 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-01-07 12:05 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-01-06 20:26 - 2015-01-06 20:26 - 00000000 ____D () C:\Users\paul\AppData\Roaming\OpenOffice

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 12:19 - 2014-12-22 12:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-05 12:18 - 2014-11-29 09:27 - 00109980 _____ () C:\Windows\PFRO.log
2015-02-05 12:18 - 2012-07-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-05 12:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-05 12:18 - 2009-07-14 05:51 - 00037391 _____ () C:\Windows\setupact.log
2015-02-05 12:16 - 2012-07-18 16:47 - 01328099 _____ () C:\Windows\WindowsUpdate.log
2015-02-05 11:45 - 2014-11-27 10:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-05 09:52 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-05 09:52 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-04 23:41 - 2012-07-19 15:07 - 1297523543 _____ () C:\Windows\MEMORY.DMP
2015-02-04 23:41 - 2012-07-19 15:07 - 00000000 ____D () C:\Windows\Minidump
2015-02-04 22:50 - 2012-07-18 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-04 22:50 - 2012-07-18 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 22:27 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-04 13:16 - 2014-11-27 11:58 - 00075288 _____ () C:\Windows\DirectX.log
2015-02-03 19:30 - 2012-07-18 17:14 - 00000000 ____D () C:\Users\paul
2015-01-31 13:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-29 09:45 - 2012-07-18 17:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-28 20:46 - 2014-11-27 10:59 - 00000000 ____D () C:\Users\paul\AppData\Local\Adobe
2015-01-28 20:46 - 2012-07-18 17:36 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Adobe
2015-01-27 16:37 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-27 16:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-27 13:25 - 2012-07-18 17:37 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Skype
2015-01-24 14:34 - 2014-11-27 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-18 12:52 - 2012-07-18 18:09 - 00065832 _____ () C:\Users\paul\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-18 12:43 - 2009-07-14 05:45 - 00301632 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-17 15:46 - 2012-07-18 18:08 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-01-11 19:09 - 2012-05-08 19:50 - 00000000 ____D () C:\Games
2015-01-11 13:21 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-01-06 20:37 - 2012-07-18 17:37 - 00000000 ____D () C:\Windows.old
2015-01-06 04:36 - 2012-07-18 17:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\paul\AppData\Local\Temp\Quarantine.exe
C:\Users\paul\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-04 23:59

==================== End Of Log ============================

--- --- ---

Danke für die Hilfe! Wenn was neu gemacht werden muss einfach sagen ^^

schrauber · 05.02.2015, 14:55

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Andigo · 05.02.2015, 17:15

Nur als kurze Zwischenfrage, einige Scanner haben ja anscheinend was gefunden. Habe mich hier im Forum schon etwas umgesehen, bin allerdings noch immer unsicher was die Funde angeht. Handelte es sich dabei um Malware oder waren das mehr oder weniger harmlose Einträge?

Habe außerdem den Link gefunden, auf den ich geklickt habe. Falls du damit was anfangen kannst, poste ich ihn hier.

Zu den Problemen, da ist mir bisher wenig aufgefallen, außer, dass sich Programme teilweise selbst schließen bzw abstürzen und der Pc manchmal beim Hochfahren "festhängt", wobei das auch an der Hardware liegen kann. Ging mir hauptsächlich um das was man eben nicht so einfach bemerkt. Bin bezüglich des Themas Viren auch etwas paranoid muss ich sagen. Bin dir auf jeden Fall für deine Hilfe dankbar!

Code:

ATTFilter

Results of screen317's Security Check version 0.99.95  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Anti-Virus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Kaspersky Lab Kaspersky Anti-Virus 15.0.1 avp.exe  
 Kaspersky Lab Kaspersky Anti-Virus 15.0.1 avpui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Beim Log oben hatte er etwas namens Win32/InstallMonetizer.aq gefunden, bin mir nicht sicher, ob das Programm das allerdings auch bereinigt hat.

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01
Ran by paul (administrator) on PAUL-PC on 05-02-2015 17:07:43
Running from C:\Users\paul\Desktop
Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKone+] => C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE [557056 2013-09-13] (ROCCAT GmbH)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2492140108-2297389676-158246720-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2492140108-2297389676-158246720-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2492140108-2297389676-158246720-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\searchplugins\trovi.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-03]
FF Extension: DownloadHelper - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]
FF Extension: Adblock Plus - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-25]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-27]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]
FF HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-03]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2014-12-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2014-12-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2014-12-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 17:05 - 2015-02-05 17:05 - 00003252 _____ () C:\Windows\System32\Tasks\{6726F217-5D23-4B88-96BC-D68319EDAFA4}
2015-02-05 15:36 - 2015-02-05 15:36 - 00000820 _____ () C:\Users\paul\Desktop\checkup.txt
2015-02-05 15:32 - 2015-02-05 15:32 - 02347384 _____ (ESET) C:\Users\paul\Downloads\esetsmartinstaller_deu.exe
2015-02-05 15:32 - 2015-02-05 15:32 - 00852573 _____ () C:\Users\paul\Downloads\SecurityCheck.exe
2015-02-05 12:24 - 2015-02-05 12:24 - 00026450 _____ () C:\Users\paul\Desktop\FRST1.txt
2015-02-05 12:22 - 2015-02-05 12:22 - 00000000 ____D () C:\Users\paul\Desktop\FRST-OlderVersion
2015-02-05 12:16 - 2015-02-05 12:20 - 00001828 _____ () C:\Users\paul\Desktop\AdwCleaner[S0].txt
2015-02-05 12:16 - 2015-02-05 12:16 - 00001767 _____ () C:\Users\paul\Desktop\AdwCleaner[R0].txt
2015-02-05 12:13 - 2015-02-05 12:33 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:09 - 2015-02-05 12:09 - 00000940 _____ () C:\Users\paul\Desktop\JRT.txt
2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\Users\paul\Desktop\mbam.txt
2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\mbam.txt
2015-02-05 11:49 - 2015-02-05 11:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 11:49 - 2015-02-05 11:49 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 11:49 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-05 11:49 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-05 11:49 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-05 11:45 - 2015-02-05 11:45 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\paul\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-05 11:45 - 2015-02-05 11:45 - 02194432 _____ () C:\Users\paul\Downloads\AdwCleaner_4.109.exe
2015-02-05 11:45 - 2015-02-05 11:45 - 01388274 _____ (Thisisu) C:\Users\paul\Downloads\JRT.exe
2015-02-04 23:41 - 2015-02-04 23:41 - 00519128 _____ () C:\Windows\Minidump\020415-17908-01.dmp
2015-02-04 22:50 - 2015-02-04 22:50 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-02-04 22:28 - 2015-02-04 22:28 - 00018312 _____ () C:\ComboFix.txt
2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Windows\erdnt
2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Qoobox
2015-02-04 22:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-04 22:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-04 22:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-02-04 22:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-02-04 22:18 - 2015-02-04 22:18 - 05611380 ____R (Swearware) C:\Users\paul\Downloads\ComboFix.exe
2015-02-04 10:32 - 2015-02-04 10:32 - 00037494 _____ () C:\Users\paul\Desktop\gmer.txt
2015-02-03 19:38 - 2015-02-03 19:38 - 00020073 _____ () C:\Users\paul\Desktop\Addition.txt
2015-02-03 19:37 - 2015-02-05 17:07 - 00011338 _____ () C:\Users\paul\Desktop\FRST.txt
2015-02-03 19:35 - 2015-02-03 19:36 - 00380416 _____ () C:\Users\paul\Downloads\nvdf6jxn.exe
2015-02-03 19:34 - 2015-02-03 19:34 - 00020073 _____ () C:\Users\paul\Downloads\Addition.txt
2015-02-03 19:33 - 2015-02-05 17:07 - 00000000 ____D () C:\FRST
2015-02-03 19:33 - 2015-02-03 19:34 - 00024311 _____ () C:\Users\paul\Downloads\FRST.txt
2015-02-03 19:32 - 2015-02-05 12:22 - 02131968 _____ (Farbar) C:\Users\paul\Desktop\FRST64.exe
2015-02-03 19:30 - 2015-02-03 19:30 - 00000470 _____ () C:\Users\paul\Downloads\defogger_disable.log
2015-02-03 19:30 - 2015-02-03 19:30 - 00000000 _____ () C:\Users\paul\defogger_reenable
2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe
2015-02-02 13:12 - 2015-02-02 13:12 - 00000869 _____ () C:\Users\paul\Desktop\BitTorrent.lnk
2015-02-02 13:12 - 2015-02-02 13:12 - 00000849 _____ () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk
2015-02-02 13:11 - 2015-02-02 13:25 - 00000000 ____D () C:\Users\paul\AppData\Roaming\BitTorrent
2015-02-02 13:11 - 2015-02-02 13:11 - 01738840 _____ (BitTorrent Inc.) C:\Users\paul\Downloads\BitTorrent_7.9.2.38398.exe
2015-01-31 22:45 - 2015-01-31 22:46 - 01983604 _____ () C:\Users\paul\Downloads\HoxHud P8.8 Self-installer.exe
2015-01-29 14:16 - 2015-01-29 14:30 - 44769901 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.33_95.exe
2015-01-28 20:54 - 2015-01-28 20:54 - 00001111 _____ () C:\Users\Public\Desktop\Fragen-Lern-CD 4.6.lnk
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\paul\AppData\Roaming\de.wendel.flcd-de
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag
2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Wendel-Verlag
2015-01-27 21:02 - 2015-01-27 21:26 - 00000000 ____D () C:\Users\paul\Downloads\DSfix24
2015-01-27 21:01 - 2015-01-27 21:02 - 00392093 _____ () C:\Users\paul\Downloads\DSfix24.zip
2015-01-27 16:38 - 2015-01-27 16:38 - 00000000 ____D () C:\Users\paul\AppData\Local\NBGI
2015-01-27 16:37 - 2015-01-27 16:37 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Windows\SysWOW64\xlive
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2015-01-27 10:13 - 2015-01-27 10:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 20:32 - 2015-02-05 16:49 - 00000000 ____D () C:\Users\paul\AppData\Roaming\FLV and Media Player
2015-01-25 20:31 - 2015-01-25 20:31 - 00001325 _____ () C:\Users\Public\Desktop\FLV and Media Player.lnk
2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies
2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\Program Files (x86)\Applian Technologies
2015-01-25 20:29 - 2015-01-25 20:30 - 23750568 _____ () C:\Users\paul\Downloads\FLVPlayer4211Install.exe
2015-01-25 19:34 - 2015-02-04 10:57 - 00000000 ____D () C:\Users\paul\dwhelper
2015-01-25 19:28 - 2015-01-25 19:30 - 00000000 ____D () C:\Users\paul\Downloads\chrome
2015-01-25 19:28 - 2015-01-25 19:28 - 00000979 _____ () C:\Users\Public\Desktop\WinRAR.lnk
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Program Files\WinRAR
2015-01-25 19:28 - 2014-09-05 09:15 - 00003914 _____ () C:\Users\paul\Downloads\chrome.manifest
2015-01-25 19:28 - 2014-09-05 09:15 - 00001956 _____ () C:\Users\paul\Downloads\install.rdf
2015-01-25 19:28 - 2014-09-05 09:15 - 00000000 ____D () C:\Users\paul\Downloads\defaults
2015-01-25 19:27 - 2015-01-25 19:27 - 02060888 _____ () C:\Users\paul\Downloads\winrar-x64-520d.exe
2015-01-25 19:26 - 2015-01-25 19:26 - 00772184 _____ () C:\Users\paul\Downloads\video_downloadhelper-4.9.24-sm_fx.zip
2015-01-24 15:17 - 2015-01-24 15:17 - 00000000 ____D () C:\Users\paul\Documents\nbgi
2015-01-24 14:34 - 2015-01-24 14:34 - 00000222 _____ () C:\Users\paul\Desktop\Dark Souls Prepare to Die Edition.url
2015-01-22 10:37 - 2015-02-05 16:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-22 10:37 - 2015-02-04 22:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-18 02:02 - 2015-01-18 02:02 - 40177100 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.26_95.exe
2015-01-15 01:02 - 2015-01-15 01:02 - 00302688 _____ () C:\Windows\Minidump\011515-40326-01.dmp
2015-01-14 12:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 12:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 12:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 12:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 12:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 12:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 12:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 12:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 12:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 12:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 12:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 12:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 12:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 20:29 - 2015-01-13 20:29 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Wargaming.net
2015-01-11 19:09 - 2015-01-11 19:09 - 00000769 _____ () C:\Users\paul\Desktop\World of Tanks.lnk
2015-01-11 19:09 - 2015-01-11 19:09 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks
2015-01-07 12:05 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-01-07 12:05 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-01-06 20:26 - 2015-01-06 20:26 - 00000000 ____D () C:\Users\paul\AppData\Roaming\OpenOffice

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 15:49 - 2012-07-18 16:47 - 01346631 _____ () C:\Windows\WindowsUpdate.log
2015-02-05 14:42 - 2014-11-27 10:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-05 12:41 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:41 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:34 - 2014-12-22 12:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-05 12:33 - 2014-11-29 09:27 - 00110290 _____ () C:\Windows\PFRO.log
2015-02-05 12:33 - 2012-07-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-05 12:33 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-05 12:33 - 2009-07-14 05:51 - 00037447 _____ () C:\Windows\setupact.log
2015-02-04 23:41 - 2012-07-19 15:07 - 1297523543 _____ () C:\Windows\MEMORY.DMP
2015-02-04 23:41 - 2012-07-19 15:07 - 00000000 ____D () C:\Windows\Minidump
2015-02-04 22:50 - 2012-07-18 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-04 22:50 - 2012-07-18 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-04 22:27 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-04 13:16 - 2014-11-27 11:58 - 00075288 _____ () C:\Windows\DirectX.log
2015-02-03 19:30 - 2012-07-18 17:14 - 00000000 ____D () C:\Users\paul
2015-01-31 13:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-29 09:45 - 2012-07-18 17:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-28 20:46 - 2014-11-27 10:59 - 00000000 ____D () C:\Users\paul\AppData\Local\Adobe
2015-01-28 20:46 - 2012-07-18 17:36 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Adobe
2015-01-27 16:37 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-27 16:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-27 13:25 - 2012-07-18 17:37 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Skype
2015-01-24 14:34 - 2014-11-27 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-18 12:52 - 2012-07-18 18:09 - 00065832 _____ () C:\Users\paul\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-18 12:43 - 2009-07-14 05:45 - 00301632 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-17 15:46 - 2012-07-18 18:08 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-01-11 19:09 - 2012-05-08 19:50 - 00000000 ____D () C:\Games
2015-01-11 13:21 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-01-06 20:37 - 2012-07-18 17:37 - 00000000 ____D () C:\Windows.old
2015-01-06 04:36 - 2012-07-18 17:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\paul\AppData\Local\Temp\Quarantine.exe
C:\Users\paul\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-04 23:59

==================== End Of Log ============================

--- --- ---

--- --- ---

Edit: Meinte natürlich dieses Log hier, da hatte er was gefunden ...

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f4482bec19d3ba43aae6e029aa49c416
# engine=22323
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-05 03:52:42
# local_time=2015-02-05 04:52:42 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Anti-Virus'
# compatibility_mode=1300 16777213 100 100 15517 50723192 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 184884 174781412 0 0
# scanned=318643
# found=1
# cleaned=0
# scan_time=4117
sh=7BA0A01D63E1511F6101A736D157C4D1F885EDEB ft=1 fh=1aba12d0f1f8efc7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe"

schrauber · 06.02.2015, 07:20

Schau doch mal genau hin was gefunden wurde bei ESET

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Malware ist jetzt komplett runter. Kaspersky bitte komplett deinstallieren und neu installieren.

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

Andigo · 06.02.2015, 15:23

So, das fixlog wäre hier:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01
Ran by paul at 2015-02-06 14:11:21 Run:1
Running from C:\Users\paul\Desktop
Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe
Emptytemp:
         
*****************

C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe => Moved successfully.
EmptyTemp: => Removed 483.1 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 14:11:26 ====

Kaspersky habe ich neu installiert, allerdings sieht Windows Repair bei mir ein bisschen anders aus. Den Repair-Prozess unter 4 und 5 könnte ich zwar starten, allerdings fragt er vorher nicht danach, ein Back-up zu erstellen. Es erscheint stattdessen eine Meldung, dass das letzte erstellte Back-up fehlerhaft wäre -> "The last scheduled Back-up had errors or failed."

schrauber · 06.02.2015, 19:45

Hast Du das mit den Haken gemacht?

Andigo · 07.02.2015, 10:26

So wie ich das verstanden habe soll man ja eigentlich nur auf Defaults klicken oder? Hab ich so gemacht, allerdings kommt die Fehlermeldung auch wenn ich nichts mache. Auf dem zweiten Screenshot sollte man es sehen.

schrauber · 07.02.2015, 12:58

Klick auf ja

Andigo · 09.02.2015, 11:02

Habe das ganze heute nochmal anch Anleitung wiederholt und diesmal keine Fehlermeldung beim Back up bekommen, allerdings ist Windows Repair beim Repariervorgang nach ca 10 Minuten abgestürzt. Soweit ich es erkennen konnte gab es ein Problem bei der Behandlung von Windows Updater. Der Pc an sich ist allerdings nicht abgestürzt. Vielleicht lag es daran, dass ich nicht alle aktuellen Updates heruntergeladen habe?

06.02.2015, 19:45	#12
schrauber /// the machine /// TB-Ausbilder	Auf suspekten Link geklickt/Kaspersky findet nichts Hast Du das mit den Haken gemacht? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

07.02.2015, 12:58	#14
schrauber /// the machine /// TB-Ausbilder	Auf suspekten Link geklickt/Kaspersky findet nichts Klick auf ja __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Auf suspekten Link geklickt/Kaspersky findet nichts

Plagegeister aller Art und deren Bekämpfung: Auf suspekten Link geklickt/Kaspersky findet nichts