ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hi Schrauber,

anbei die logs:
esetlog:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6a1da17b7c5d28419129b886625f7d2b
# engine=22401
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-10 02:55:11
# local_time=2015-02-10 03:55:11 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='COMODO Antivirus'
# compatibility_mode=3074 16777213 100 84 59345 95307675 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 66 85 48920604 175209961 0 0
# scanned=19583
# found=1
# cleaned=0
# scan_time=550
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6a1da17b7c5d28419129b886625f7d2b
# engine=22401
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-10 09:02:03
# local_time=2015-02-10 10:02:03 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='COMODO Antivirus'
# compatibility_mode=3074 16777213 100 84 25939 95329687 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 66 85 48942616 175231973 0 0
# scanned=403981
# found=45
# cleaned=0
# scan_time=21873
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=EA5F2E6D46B25C68B66EBF49028A5906092A7177 ft=1 fh=9a3b67e49eb71fc7 vn="Win32/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Comodo\Cis\Quarantine\data\{55C9DDD6-A278-4436-B217-CEFB8A2ACBC8}"
sh=5FE38FE7EA21CDB3562F2686FFAAC1D89217F320 ft=1 fh=65f6280592b6dda6 vn="Variante von Win32/ExpressFiles.B evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Comodo\Cis\Quarantine\data\{7262E45C-1083-44D4-B54B-3FEB9E3AC931}"
sh=6261114915F56E131BCDC19BB1DFFC9ADA153A4F ft=1 fh=e56b96b1c700e809 vn="Variante von Win32/TrojanDownloader.Agent.ROV Trojaner" ac=I fn="C:\ProgramData\Comodo\Cis\Quarantine\data\{85514C75-634D-4925-91A2-49E8264420CA}"
sh=9ADE48C2E4104B81F7994284054B5385C18AA667 ft=1 fh=39c59849cb099c22 vn="Variante von Win32/PSW.Agent.NWE Trojaner" ac=I fn="C:\ProgramData\Comodo\Cis\Quarantine\data\{9C8952B8-22C7-4BFE-B8BD-34A2763F8E4D}"
sh=5F9845E1C5A738D08BD9DAAC09673B62AD6A6E3B ft=1 fh=085aec70c54c6c42 vn="Variante von MSIL/Injector.HS Trojaner" ac=I fn="C:\ProgramData\Comodo\Cis\Quarantine\data\{C74B924D-7821-4897-ACCC-ECB48B1BD457}"
sh=8A409FBD97881D1155F334FE256DD39B12EB63B4 ft=1 fh=9890b6b97ee27123 vn="Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Comodo\Cis\Quarantine\data\{CD59876B-E6FC-490E-BE04-04111704F63B}"
sh=A66441EA33B541895F23B3A4F8EB408B616A94BA ft=1 fh=02e58446c958c5ff vn="Win32/Toolbar.DefaultTab.E evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\ich\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabUninstaller.exe.vir"
sh=EA111903F48C1CB7FE5056509351A88EFE85114F ft=1 fh=0f73ddfd31d1def0 vn="Win32/Toolbar.DefaultTab.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\ich\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe.vir"
sh=EA5F2E6D46B25C68B66EBF49028A5906092A7177 ft=1 fh=9a3b67e49eb71fc7 vn="Win32/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Comodo\Cis\Quarantine\data\{55C9DDD6-A278-4436-B217-CEFB8A2ACBC8}"
sh=5FE38FE7EA21CDB3562F2686FFAAC1D89217F320 ft=1 fh=65f6280592b6dda6 vn="Variante von Win32/ExpressFiles.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Comodo\Cis\Quarantine\data\{7262E45C-1083-44D4-B54B-3FEB9E3AC931}"
sh=6261114915F56E131BCDC19BB1DFFC9ADA153A4F ft=1 fh=e56b96b1c700e809 vn="Variante von Win32/TrojanDownloader.Agent.ROV Trojaner" ac=I fn="C:\Users\All Users\Comodo\Cis\Quarantine\data\{85514C75-634D-4925-91A2-49E8264420CA}"
sh=9ADE48C2E4104B81F7994284054B5385C18AA667 ft=1 fh=39c59849cb099c22 vn="Variante von Win32/PSW.Agent.NWE Trojaner" ac=I fn="C:\Users\All Users\Comodo\Cis\Quarantine\data\{9C8952B8-22C7-4BFE-B8BD-34A2763F8E4D}"
sh=5F9845E1C5A738D08BD9DAAC09673B62AD6A6E3B ft=1 fh=085aec70c54c6c42 vn="Variante von MSIL/Injector.HS Trojaner" ac=I fn="C:\Users\All Users\Comodo\Cis\Quarantine\data\{C74B924D-7821-4897-ACCC-ECB48B1BD457}"
sh=8A409FBD97881D1155F334FE256DD39B12EB63B4 ft=1 fh=9890b6b97ee27123 vn="Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Comodo\Cis\Quarantine\data\{CD59876B-E6FC-490E-BE04-04111704F63B}"
sh=EBE1748008422C218FD21BE383F80D627749A777 ft=1 fh=0b398f41eb4bbb2e vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ich\Downloads\FreeAudioCDToMP3Converter_1.3.12.1228.exe"
sh=A66441EA33B541895F23B3A4F8EB408B616A94BA ft=1 fh=02e58446c958c5ff vn="Win32/Toolbar.DefaultTab.E evtl. unerwünschte Anwendung" ac=I fn="C:\VTRoot\HarddiskVolume2\Qoobox\Quarantine\C\Users\ich\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabUninstaller.exe.vir"
sh=695BA26BD4A3A5303F93D3026E78E802535C71CC ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="D:\BackupUSBStickGrau\KangarooEAv4.1_Setup.zip"
sh=08B25CB02873B9533C2FF4EC8DF160F8A205DD95 ft=1 fh=a02e5018662c4b1e vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="D:\BackupUSBStickGrau\Kangaroo_Setup.exe"
sh=5324B530B52FFEDA2AF79ECB558523161257EB82 ft=1 fh=f64f4ef2c52a839c vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\CDRViewerSetup.exe"
sh=DBA72B32751D201938B577C41625BB92098E9309 ft=1 fh=448aed56baceec30 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\setupscreenhunterfree.exe"
sh=3D8F7E8043E426947D2302C2BA515F532E9D849E ft=1 fh=06bce071d0cc1961 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\SoftonicDownloader_for_freeenc.exe"
sh=AE6B31D449DB24A98B96A6D482A8383D90F4E0AA ft=1 fh=958447470f5f569d vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\SoftonicDownloader_fuer_ratdvd.exe"
sh=94C1D44A5A3FF2D4AD682D4C4DFF473FA9A8696D ft=1 fh=293ef637c1e09aa3 vn="Win32/SoftonicDownloader evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\SoftonicDownloader_fuer_streamripper.exe"
sh=C693CAD48554CF69923C7F8F13F0E863F1F1CF01 ft=0 fh=0000000000000000 vn="Win32/Packed.Autoit.H evtl. unerwünschte Anwendung" ac=I fn="D:\Usenext\Bibi Tina Voll Verhext Soundtrack Zum Kinofilm 2014 (2).rar"
sh=3FDE2890D864C2C786119CB463DBAA117F68F612 ft=0 fh=0000000000000000 vn="Variante von MSIL/Injector.FM Trojaner" ac=I fn="D:\Usenext\alt.binaries.cracks\Magic.Forex.Intuition.v1.1.0.10.Multilingual.Cracked-DJiNN.rar"
sh=12FB8147E1EBA6F95861385515A29003E5BE0F0B ft=0 fh=0000000000000000 vn="Win32/CoinMiner.UU Trojaner" ac=I fn="D:\Usenext\alt.binaries.software\Windows7ActivationCrack.zip"
sh=12FB8147E1EBA6F95861385515A29003E5BE0F0B ft=0 fh=0000000000000000 vn="Win32/CoinMiner.UU Trojaner" ac=I fn="D:\Usenext\alt.binaries.software\Windows8KMSActivationCrack.zip"
sh=584A267E5B640B3F5984C957ABB767B1B10FB69B ft=1 fh=c71c0011991a82c0 vn="Win32/Packed.Autoit.H evtl. unerwünschte Anwendung" ac=I fn="D:\Usenext\wizard\Bibi Tina Voll Verhext Soundtrack Zum Kinofilm 201\Bibi Tina Voll Verhext Soundtrack Zum Kinofilm 2014.exe"
sh=E8C873148DBB7347B37427000004A0AF0ECD0540 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\Usenext\wizard\Windows XP Professional 32 - bit en US - Black Edi\Windows XP Professional 32-bit en-US - Black Edition v2010.12.18.iso"
sh=4327E8A7EFBC2C61122E6FC919C36788A1368DE5 ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\KangarooEAv5.1.zip"
sh=CAE47B4DA1C4FB42DB458355FC56FCB887EE7CFB ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\KangarooEAv5.9.zip"
sh=5AD221878C013952A74A3620B86215EFAFFD6DE6 ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\KangarooEA_v6.0.zip"
sh=A205B84DC97243780914BAE14DB842CD9A8F67A7 ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\KangarooEA_v6.0n.zip"
sh=526E279B8868AEBE49485AA8AA08BD16696441BB ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\KangarooEA_v6.2.zip"
sh=5F74F120F006EDD47C200D4954BCD6634282BBBD ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\KangarooEA_v7.3.zip"
sh=08B25CB02873B9533C2FF4EC8DF160F8A205DD95 ft=1 fh=a02e5018662c4b1e vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\forexfiles\kangaroo\Kangaroo_Setup.exe"
sh=9BF14CD4B09B76221BCEF7895DADDA23997C0C4E ft=1 fh=836d96b2f4f56ab7 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\mydocs\LifeAccounts\Eric - Pepperstone\experts\libraries\MillionDollarPips.dll"
sh=6C9F868B1E07A7AD7B7A0515A9C2BDD5FF175D7A ft=1 fh=b8acc5a627783abe vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\mydocs\LifeAccounts\Eric TheCollectiveFX\experts\libraries\kangaroo.dll"
sh=C8814B1D1D809C5BDC7F5A15C439113F38372D50 ft=1 fh=5a7fbd1ad7536245 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\mydocs\LifeAccounts\Eric TheCollectiveFX\experts\libraries\kangaroo_AUDUSD.dll"
sh=0E04DFCF4D2EA11CFAB48B25B12209A6038D68FE ft=1 fh=363921e2662864c4 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\backup VPS 2014 12 09\mydocs\LifeAccounts\Eric TheCollectiveFX\experts\libraries\kangaroo_EURUSD.dll"
sh=235839ED7F756B8AB62DDAB49EC150F929E5AF56 ft=1 fh=7f19f6db235affc0 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\Eigene Dateien\UseNeXT\utorrentready\Forex Tracer.exe"
sh=337CA199AB4B24B5094F524A8CEF2B6E808C9E09 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\Eigene Dateien\UseNeXT\wizard\IsoBuster Pro v2.4.0.1\ind-ib24.zip"
sh=EEA83DB49F52CDCC3BDB69A3E3FDF2FD91419233 ft=1 fh=f78ee07fd38aa416 vn="Win32/Toolbar.AskSBar evtl. unerwünschte Anwendung" ac=I fn="J:\Dokumente und Einstellungen\Eric\Eigene Dateien\UseNeXT\wizard\Nero 8.3.2.1 Ultra Edition Deutsch inkl New Keygen\Nero 8.3.2.1.exe"
sh=D1B9E2306CB7D3973B014F7A9A1889CC6C87E83D ft=1 fh=0d84ac02eeb297ab vn="Variante von Win32/TrojanDownloader.VB.OVJ Trojaner" ac=I fn="J:\Dokumente und Einstellungen\Eric\Eigene Dateien\UseNeXT\wizard\Nero Activation Patch WITH Plugins - XPLOSiON\Nero_9.2.6.0_Setup.exe"
         

security check log:

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Norton Ghost    
 Java 7 Update 71  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Reader XI  
 Google Chrome 39.0.2171.99  Google Chrome out of date!  
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST new log:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by ich (administrator) on ICH-PC on 10-02-2015 23:49:48
Running from C:\Users\ich\Desktop
Loaded Profiles: ich (Available profiles: ich)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Akamai Technologies, Inc.) C:\Users\ich\AppData\Local\Akamai\netsession_win.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(Dropbox, Inc.) C:\Users\ich\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Akamai Technologies, Inc.) C:\Users\ich\AppData\Local\Akamai\netsession_win.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(Razer USA Ltd.) C:\Program Files (x86)\n52te\razerhid.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Robert McNeel & Associates) C:\Program Files (x86)\McNeelUpdate\5.0\McNeelUpdateService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe
(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Symantec) C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
Failed to access process -> javaws.exe
Failed to access process -> javaws.exe
Failed to access process -> javaws.exe
Failed to access process -> javaws.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1297624 2015-02-06] (COMODO)
HKLM\...\Run: [Cm108Sound] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm108.dll,CMICtrlWnd
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-24] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)
HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [Jomantha] => C:\Program Files (x86)\n52te\razerhid.exe [163840 2008-04-09] (Razer USA Ltd.)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [tvncontrol] => C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2014-09-24] (Comodo Security Solutions, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2014-12-17] (SlySoft, Inc.)
HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2008-01-22] (Nero AG)
HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Run: [Akamai NetSession Interface] => C:\Users\ich\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\RunOnce: [Adobe Speed Launcher] => 1423579108
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries)
Startup: C:\Users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\ich\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [SmartFTP Drop] -> {EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} => C:\Program Files\SmartFTP Client\ShellTools.dll (SmartSoft Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-711161388-283650032-2311018211-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-711161388-283650032-2311018211-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-711161388-283650032-2311018211-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-711161388-283650032-2311018211-1000 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)

Chrome: 
=======
CHR Profile: C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]
CHR Extension: (Google Drive) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-08]
CHR Extension: (YouTube) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]
CHR Extension: (Google Search) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]
CHR Extension: (Google Wallet) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-15]
CHR Extension: (Gmail) - C:\Users\ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-05-24] (Advanced Micro Devices, Inc.) [File not signed]
R2 CLPSLauncher; C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe [70864 2014-09-25] (Comodo Security Solutions, Inc.)
R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [7618952 2015-02-06] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265304 2015-02-06] (COMODO)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2370240 2014-11-27] (Comodo Security Solutions, Inc.)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-08-07] (Garmin Ltd or its subsidiaries)
R2 GeekBuddyRSP; C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2014-09-24] (Comodo Security Solutions, Inc.)
S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-12] (Symantec)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-12] (Symantec Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-02-09] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2015-02-09] (Malwarebytes Corporation)
R2 McNeelUpdate; C:\Program Files (x86)\McNeelUpdate\5.0\McNeelUpdateService.exe [67224 2014-03-05] (Robert McNeel & Associates)
R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)
R2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2010-02-11] (Symantec)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 FastUserSwitchingCompatibility; C:\Windows\installer\AMDEx2.msi [X]
S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe /Processid:{CED577F6-63AF-4536-9043-0383D1FC3A40}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [150440 2014-12-11] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [150440 2014-12-11] (SlySoft, Inc.)
S1 CFRMD; C:\Windows\SysWOW64\DRIVERS\CFRMD.sys [37976 2012-09-03] (Windows (R) Win 7 DDK provider) [File not signed]
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [20184 2015-01-30] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [792648 2015-01-30] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [45880 2015-01-30] (COMODO)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [104608 2015-01-30] (COMODO)
S3 JmtFltr; C:\Windows\System32\drivers\JmtFltr.sys [46464 2007-09-29] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-02-09] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-02-09] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2010-02-11] (StorageCraft)
R3 vhidmini; C:\Windows\System32\DRIVERS\vhidmini.sys [13952 2007-09-29] (Windows (R) Codename Longhorn DDK provider)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 V2iMount; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 23:45 - 2015-02-10 23:45 - 00852594 _____ () C:\Users\ich\Desktop\SecurityCheck.exe
2015-02-10 15:44 - 2015-02-10 15:44 - 02347384 _____ (ESET) C:\Users\ich\Desktop\esetsmartinstaller_deu.exe
2015-02-10 00:29 - 2015-02-10 00:29 - 00000623 _____ () C:\Users\ich\Desktop\JRT.txt
2015-02-10 00:09 - 2015-02-10 00:09 - 00002539 _____ () C:\Users\ich\Desktop\AdwCleaner[S0].txt
2015-02-10 00:01 - 2015-02-10 00:03 - 00000000 ____D () C:\AdwCleaner
2015-02-10 00:00 - 2015-02-10 00:01 - 02112512 _____ () C:\Users\ich\Desktop\AdwCleaner_4.110.exe
2015-02-10 00:00 - 2015-02-10 00:01 - 01388274 _____ (Thisisu) C:\Users\ich\Desktop\JRT.exe
2015-02-09 23:59 - 2015-02-09 23:59 - 00002677 _____ () C:\Users\ich\Desktop\mbam.txt
2015-02-09 23:47 - 2015-02-10 23:46 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-09 23:47 - 2015-02-09 23:47 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-09 23:47 - 2015-02-09 23:47 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-09 23:47 - 2015-02-09 23:47 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-09 23:47 - 2015-02-09 23:47 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-09 23:47 - 2015-02-09 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-09 23:47 - 2015-02-09 23:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-09 23:47 - 2015-02-09 23:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-09 23:45 - 2015-02-09 23:46 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\ich\Desktop\mbam-setup-2.0.4.1028.exe
2015-02-09 23:44 - 2015-02-10 23:49 - 00018586 _____ () C:\Users\ich\Desktop\FRST.txt
2015-02-09 23:44 - 2015-02-09 23:45 - 00042874 _____ () C:\Users\ich\Desktop\Addition.txt
2015-02-09 23:43 - 2015-02-09 23:43 - 02132992 _____ (Farbar) C:\Users\ich\Desktop\FRST64.exe
2015-02-09 19:08 - 2015-02-09 19:08 - 00029796 _____ () C:\ComboFix.txt
2015-02-09 18:55 - 2015-02-09 18:53 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00098816 _____ () C:\Windows\sed.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00080412 _____ () C:\Windows\grep.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00068096 _____ () C:\Windows\zip.exe
2015-02-09 18:55 - 2015-02-09 18:53 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-09 18:54 - 2015-02-09 19:08 - 00000000 ____D () C:\Qoobox
2015-02-09 18:54 - 2015-02-09 19:05 - 00000000 ____D () C:\Windows\erdnt
2015-02-09 18:20 - 2015-02-09 18:20 - 05611930 ____R (Swearware) C:\Users\ich\Desktop\ComboFix.exe
2015-02-08 20:45 - 2015-02-08 20:45 - 00000017 _____ () C:\Users\ich\AppData\Local\resmon.resmoncfg
2015-02-06 17:05 - 2015-02-10 23:49 - 00000000 ____D () C:\FRST
2015-01-24 18:03 - 2015-01-24 17:44 - 00088070 _____ () C:\Users\ich\Downloads\Sicherungskopie_von_AÖSMV-UrkundeEhren2015Pichling.cdr
2015-01-24 17:45 - 2015-01-24 17:45 - 00084972 _____ () C:\Users\ich\Downloads\AÖSMV-Urkunde-Allg2014.cdr
2015-01-24 17:44 - 2015-01-24 18:03 - 01456450 _____ () C:\Users\ich\Downloads\AÖSMV-UrkundeEhren2015Pichling.cdr
2015-01-14 21:10 - 2015-01-14 21:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QNAP
2015-01-14 20:40 - 2015-01-14 20:41 - 33653552 _____ (Igor Pavlov) C:\Users\ich\Downloads\QNAPQfinderWindows-4.2.5.0108.exe
2015-01-14 16:13 - 2015-01-14 16:13 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 16:13 - 2015-01-14 16:13 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 16:13 - 2015-01-14 16:13 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 16:13 - 2015-01-14 16:13 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 16:13 - 2015-01-14 16:13 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 16:13 - 2015-01-14 16:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 16:13 - 2015-01-14 16:13 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 16:13 - 2015-01-14 16:13 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 23:48 - 2012-04-26 16:14 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat
2015-02-10 23:46 - 2014-12-13 00:11 - 00400130 _____ () C:\Windows\system32\Drivers\fvstore.dat
2015-02-10 23:23 - 2014-05-15 12:29 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-10 19:23 - 2014-05-15 12:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-10 15:48 - 2012-04-27 22:36 - 00000000 ____D () C:\Users\ich\AppData\Local\Adobe
2015-02-10 15:45 - 2009-07-14 11:57 - 00846100 _____ () C:\Windows\system32\perfh007.dat
2015-02-10 15:45 - 2009-07-14 11:57 - 00196444 _____ () C:\Windows\system32\perfc007.dat
2015-02-10 15:45 - 2009-07-14 06:13 - 01813574 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-10 15:45 - 2009-07-14 05:45 - 00017184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 15:45 - 2009-07-14 05:45 - 00017184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 15:42 - 2012-04-26 16:05 - 01409579 _____ () C:\Windows\WindowsUpdate.log
2015-02-10 15:38 - 2014-10-12 12:17 - 00000000 ____D () C:\Users\ich\AppData\Roaming\Dropbox
2015-02-10 15:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-10 15:38 - 2009-07-14 05:51 - 00101664 _____ () C:\Windows\setupact.log
2015-02-10 00:04 - 2012-05-06 16:59 - 00022888 _____ () C:\Windows\PFRO.log
2015-02-09 23:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI
2015-02-09 19:24 - 2014-05-15 12:29 - 00002135 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-09 19:18 - 2014-05-15 12:29 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-09 19:18 - 2014-05-15 12:29 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-09 19:08 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-02-09 19:04 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-09 18:53 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2015-02-08 20:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-02-06 22:47 - 2012-04-26 17:06 - 00000000 ____D () C:\Users\ich\AppData\Roaming\UseNeXT
2015-02-06 22:27 - 2012-04-26 16:13 - 00002280 _____ () C:\Users\Public\Desktop\COMODO Internet Security.lnk
2015-02-06 19:22 - 2014-10-24 21:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-06 19:22 - 2014-10-24 21:13 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-06 19:22 - 2014-05-15 12:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-06 19:22 - 2014-04-05 22:00 - 00000000 ____D () C:\Users\ich\AppData\Local\Akamai
2015-02-06 19:22 - 2014-04-04 09:26 - 00000000 ____D () C:\Windows\System32\Tasks\COMODO
2015-02-06 19:22 - 2012-04-27 22:33 - 00000000 ____D () C:\Users\ich\AppData\Roaming\vlc
2015-02-06 19:22 - 2012-04-26 16:05 - 00000000 ____D () C:\Users\ich
2015-02-06 19:21 - 2014-04-09 20:24 - 00000000 ____D () C:\Users\ich\AppData\Roaming\Skype
2015-02-03 21:30 - 2013-10-19 00:02 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-30 13:27 - 2014-04-04 09:26 - 00354520 _____ (COMODO) C:\Windows\system32\cmdvrt64.dll
2015-01-30 13:27 - 2014-04-04 09:26 - 00286424 _____ (COMODO) C:\Windows\SysWOW64\cmdvrt32.dll
2015-01-30 13:27 - 2014-04-04 09:26 - 00045784 _____ (COMODO) C:\Windows\system32\cmdkbd64.dll
2015-01-30 13:27 - 2014-04-04 09:26 - 00040664 _____ (COMODO) C:\Windows\SysWOW64\cmdkbd32.dll
2015-01-30 13:27 - 2012-03-11 20:13 - 00792648 _____ (COMODO) C:\Windows\system32\Drivers\cmdGuard.sys
2015-01-30 13:27 - 2012-03-11 20:13 - 00481576 _____ (COMODO) C:\Windows\system32\guard64.dll
2015-01-30 13:27 - 2012-03-11 20:13 - 00386768 _____ (COMODO) C:\Windows\SysWOW64\guard32.dll
2015-01-30 13:27 - 2012-03-11 20:13 - 00045880 _____ (COMODO) C:\Windows\system32\Drivers\cmdhlp.sys
2015-01-30 13:27 - 2012-03-11 20:13 - 00040736 _____ (COMODO) C:\Windows\system32\cmdcsr.dll
2015-01-30 13:27 - 2012-03-11 20:13 - 00020184 _____ (COMODO) C:\Windows\system32\Drivers\cmderd.sys
2015-01-30 13:27 - 2012-02-03 18:27 - 00104608 _____ (COMODO) C:\Windows\system32\Drivers\inspect.sys
2015-01-14 21:10 - 2014-07-11 18:48 - 00002962 _____ () C:\Windows\System32\Tasks\iSCSIAgentAutoStartup
2015-01-14 21:10 - 2014-07-11 18:48 - 00001050 _____ () C:\Users\Public\Desktop\Qfinder.lnk
2015-01-14 20:33 - 2012-04-27 22:21 - 00000124 ___SH () C:\ProgramData\.zreglib
2015-01-14 16:36 - 2013-08-17 18:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 16:33 - 2012-04-26 16:57 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-09-25 22:36 - 2014-09-25 23:09 - 0000086 _____ () C:\Users\ich\AppData\Roaming\2014_09_22_XX
2012-12-09 15:36 - 2012-12-09 15:36 - 0000156 _____ () C:\Users\ich\AppData\Roaming\ff.xml
2012-12-09 15:36 - 2013-01-30 12:01 - 0000194 _____ () C:\Users\ich\AppData\Roaming\opera.xml
2014-09-27 07:54 - 2014-09-27 07:54 - 0007859 _____ () C:\Users\ich\AppData\Roaming\pcouffin.cat
2014-09-27 07:54 - 2014-09-27 07:54 - 0001167 _____ () C:\Users\ich\AppData\Roaming\pcouffin.inf
2014-09-27 07:54 - 2014-09-27 07:54 - 0000055 _____ () C:\Users\ich\AppData\Roaming\pcouffin.log
2014-09-27 07:54 - 2014-09-27 07:54 - 0082816 _____ (VSO Software) C:\Users\ich\AppData\Roaming\pcouffin.sys
2014-01-13 22:51 - 2014-01-13 22:51 - 0118534 _____ () C:\Users\ich\AppData\Local\ars.cache
2014-01-13 22:51 - 2014-01-13 22:51 - 0176943 _____ () C:\Users\ich\AppData\Local\census.cache
2014-01-13 22:34 - 2014-01-13 22:34 - 0000036 _____ () C:\Users\ich\AppData\Local\housecall.guid.cache
2015-02-08 20:45 - 2015-02-08 20:45 - 0000017 _____ () C:\Users\ich\AppData\Local\resmon.resmoncfg
2012-04-27 22:21 - 2015-01-14 20:33 - 0000124 ___SH () C:\ProgramData\.zreglib
2014-04-07 08:46 - 2014-04-07 08:46 - 0000057 _____ () C:\ProgramData\Ament.ini

Some content of TEMP:
====================
C:\Users\ich\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbfjxjw.dll
C:\Users\ich\AppData\Local\Temp\Quarantine.exe
C:\Users\ich\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-24 19:06

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Addition log:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by ich at 2015-02-09 23:44:28
Running from C:\Users\ich\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: COMODO Antivirus (Disabled - Up to date) {F0BC89B2-8937-0933-021B-B17D981F2A71}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Comodo Defense+ (Disabled - Up to date) {4BDD6856-AF0D-06BD-38AB-8A0FE39860CC}
FW: COMODO Firewall (Disabled) {C8870897-C358-086B-2944-184866CC6D0A}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3Dconnexion 3DxWare 10 (64-bit) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 10.0.19 - 3Dconnexion)
ac72 (HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\ac72) (Version:  - )
AC72 A (HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\AC72 A) (Version:  - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Premiere Pro CS6 (HKLM-x32\...\{7176B973-6011-43C1-AEBC-2D73FE7C6982}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.4.0 - SlySoft)
ATI AVIVO64 Codecs (Version: 11.6.0.10524 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{3FD3FC64-DA16-318E-DFD5-57466FF5FEB5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
avi.NET 3.5.1.0 (HKLM-x32\...\avi.NET 3.5.1.0) (Version:  - )
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
ClipGrab 3.4.8 (HKLM-x32\...\{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1) (Version:  - Philipp Schmieder Medien)
CloneCD (HKLM-x32\...\CloneCD) (Version:  - SlySoft)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 36.1.1.21 - Comodo)
COMODO Internet Security (HKLM\...\{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}) (Version: 5.10.31649.2253 - COMODO Security Solutions Inc.)
ConvertXtoDVD 4.1.19.365 (HKLM-x32\...\{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1) (Version: 4.1.19.365 - )
Corel Graphics - Windows Shell Extension (HKLM-x32\...\_{72DB27D3-FE05-4227-AF5A-11CD101ECF09}) (Version: 15.1.0.588 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 15.1.588 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Capture (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Common (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Connect (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Custom Data (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - DE (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Draw (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Filters (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FontNav (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IPM (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - PHOTO-PAINT (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Photozoom Plugin (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Redist (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Setup Files (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VBA (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VideoBrowser (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VSTA (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Windows Shell Extension 64 Bit (Version: 15.1.588 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - WT (x32 Version: 15.1 -  Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 (x32 Version: 15.1 - Corel Corporation) Hidden
CorelDRAW(R) Graphics Suite X5 (HKLM-x32\...\_{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}) (Version: 15.1.0.588 - Corel Corporation)
DATA BECKER - Die große CD-Druckerei (HKLM-x32\...\DATA BECKER - Die große CD-Druckerei) (Version:  - )
Dropbox (HKU\S-1-5-21-711161388-283650032-2311018211-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Elevated Installer (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free Video to DVD Converter version 5.0.24.430 (HKLM-x32\...\Free Video to DVD Converter_is1) (Version: 5.0.24.430 - DVDVideoSoft Ltd.)
Freemake Video Converter Version 4.1.4 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.4 - Ellora Assets Corporation)
Garmin Express (HKLM-x32\...\{b43ffffb-1adc-4bcb-b277-7844ebff94da}) (Version: 3.2.17.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
GeekBuddy (HKLM-x32\...\{79B9250E-3714-4877-A2B0-D6C1E93E471A}) (Version: 4.18.121 - Comodo Security Solutions Inc)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Greenshot 1.1.7.17 (HKLM\...\Greenshot_is1) (Version: 1.1.7.17 - Greenshot)
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM-x32\...\{8E87B944-4815-3C5E-947F-5035C9F64362}.KB947789) (Version: 1 - Microsoft Corporation)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HydraVision (x32 Version: 4.2.206.0 - ATI Technologies Inc.) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
JMicron JMB36X Driver (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.17.62.0 - JMicron Technology Corp.)
K-Lite Codec Pack 7.0.0 (Standard) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.0.0 - )
KONICA MINOLTA magicolor 1690MF (HKLM\...\KONICA MINOLTA magicolor 1690MF) (Version:  - )
LiveUpdate 3.2 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.2.0.68 - Symantec Corporation)
MAGIX Screenshare (HKLM-x32\...\MAGIX_{EE79A8D3-6676-41FF-967C-242017CEC0F2}) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG) Hidden
MAGIX Speed burnR (MSI) (HKLM-x32\...\MAGIX_{838A0DDB-239D-4668-94E7-7E8AC329D1C4}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6 - MAGIX AG) Hidden
MetaTrader - ActivTrades (HKLM-x32\...\MetaTrader - ActivTrades) (Version: 4.00 - MetaQuotes Software Corp.)
MetaTrader 4 at FOREX.com (HKLM-x32\...\MetaTrader 4 at FOREX.com) (Version: 4.00 - MetaQuotes Software Corp.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM-x32\...\{8E87B944-4815-3C5E-947F-5035C9F64362}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM-x32\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (HKLM-x32\...\{76DAEC83-AF7B-333C-8A53-83D7C7D39199}) (Version: 9.0.30729 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
n52te Editor (HKLM-x32\...\{0AC8162B-5175-41D7-B963-8307A40BD456}) (Version: 1.2 - Razer USA Ltd.)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.19.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation) Hidden
Nero 7 Ultra Edition (HKLM-x32\...\{98EFD8F0-08DE-48DB-B922-A2EBAB711031}) (Version: 7.03.1151 - Nero AG)
Norton Ghost (HKLM-x32\...\{B0255743-165B-4BD5-8DA8-37DFB9930015}) (Version: 15.0.1.36526 - Symantec Corporation)
NVIDIA 3D Vision Video Player (HKLM-x32\...\{244FB715-13C4-4C85-BEB6-6C1ABB29D8B1}) (Version: 1.7.5 - NVIDIA Corporation)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Pololu Jrk USB Motor Controller with Feedback (HKLM-x32\...\{1BA94413-B303-4506-B55D-0638208A4DAE}) (Version: 1.3.0 - Pololu)
QNAP Qfinder (HKLM-x32\...\QNAP_FINDER) (Version: 4.2.5.0108 - QNAP Systems, Inc.)
Rhinoceros 5 (64-bit) (HKLM\...\{DB503481-D302-48C1-9ABD-387158EA98A2}) (Version: 5.7.31213.18395 - Robert McNeel & Associates)
Rhinoceros 5 (HKLM-x32\...\{FB0B05E2-E0F4-4E6E-A7FD-C10AFF4DB61D}) (Version: 5.8.40305.11495 - Robert McNeel & Associates)
Rhinoceros 5 Help Media (HKLM-x32\...\{60CEB140-F864-4994-8506-904A517A3310}) (Version: 5.2.30222.18095 - Robert McNeel & Associates)
Rhinoceros 5 Language Pack Installer (de-DE) (HKLM-x32\...\{1EAAC8A6-66B7-44C4-97AB-31936CCC2831}) (Version: 5.2.30227.18515 - Robert McNeel & Associates)
Rhinoceros 5 Language Pack Installer (en-US) (HKLM-x32\...\{1C08E7B1-D5A8-4BED-ACEB-0219C36C4CAF}) (Version: 5.5.30717.16015 - Robert McNeel & Associates)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.5.1 - Samsung Electronics)
Scientific WorkPlace 5.0 (HKLM-x32\...\{DA6B13CF-A177-42DF-B416-A1EFDD8E7693}) (Version:  - )
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartFTP Client (HKLM\...\{08C100ED-2D39-4B6E-8821-3F06B99C477C}) (Version: 6.0.2068.0 - SmartSoft Ltd.)
SmartFTP Client German (Germany) MUI (HKLM\...\{4A29ACD2-84DE-4A6D-9F17-6373AA7BBFA2}) (Version: 6.0.2068.0 - SmartSoft Ltd.)
Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)
Update 4.0.3 for Microsoft .NET Framework 4 Client Profile (KB2600211) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600211) (Version: 1 - Microsoft Corporation)
Update 4.0.3 for Microsoft .NET Framework 4 Extended (KB2600211) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600211) (Version: 1 - Microsoft Corporation)
USB PnP Sound Device (HKLM\...\C-Media CM108 Like Sound Driver) (Version:  - )
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Vsk5 - patch1 (HKLM-x32\...\Vsk5_is1) (Version:  - Nadeo)
VSO ConvertXToDVD (HKLM-x32\...\{CE1F93C0-4353-4C9D-84DA-AB4E7C63ED32}_is1) (Version: 5.2.0.22 - VSO Software)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WinRAR Archivierer (HKLM-x32\...\WinRAR archiver) (Version:  - )
WinX DVD Ripper 5.5.12 (HKLM-x32\...\WinX DVD Ripper_is1) (Version:  - Digiarty Software, Inc.)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: 5.0.5.16057 - Blizzard Entertainment)
World of Warcraft Beta (HKLM-x32\...\World of Warcraft Beta) (Version:  - Blizzard Entertainment)
WorldUnlock Codes Calculator (HKLM-x32\...\WorldUnlock Codes Calculator) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-711161388-283650032-2311018211-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ich\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

10-12-2014 08:25:54 Windows Update
17-12-2014 16:54:33 Geplanter Prüfpunkt
26-12-2014 18:11:42 Geplanter Prüfpunkt
07-01-2015 14:52:44 Geplanter Prüfpunkt
14-01-2015 16:32:52 Windows Update
24-01-2015 19:13:48 Geplanter Prüfpunkt
09-02-2015 18:55:12 ComboFix created restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-02-09 19:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {16AD27A3-A8B9-429F-80CD-7ADAE599CF7C} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe [2014-09-28] (Samsung Electronics.)
Task: {181DDCC2-A67F-47ED-B462-65AD0590C3EA} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-06] (COMODO)
Task: {7AA9D4FA-45B1-48CF-938A-F1AE69025F0E} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-06] (COMODO)
Task: {7C17F369-5475-43DA-BAD3-467DEF744D32} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-06] (COMODO)
Task: {823F4E8D-FF6A-4704-B7DE-4743E5F24C01} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-15] (Google Inc.)
Task: {A14655A7-441B-47A6-AAEF-DFDDB08CF84B} - System32\Tasks\AdobeAAMUpdater-1.0-ich-PC-ich => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {A15C8AF1-6244-44B5-BFDD-7D38D4DD3EF2} - System32\Tasks\iSCSIAgentAutoStartup => C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe [2015-01-14] ()
Task: {AE9078D0-EAEB-4248-8B3E-DFB5AAAFA5AB} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-08-07] ()
Task: {B69D380A-810E-49B2-80D5-CECB49892678} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-15] (Google Inc.)
Task: {EBE85128-5FBC-474B-90C2-48E3FB5363D1} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-06] (COMODO)
Task: {EDB1C06F-9488-4A18-BE43-5F6D2E0CED3B} - System32\Tasks\{40B90F7A-871D-46F7-9781-642C6E2A1982} => pcalua.exe -a C:\Users\ich\AppData\Local\Temp\Temp1_VIA_Audio_DriverV6018100_XPvista7.zip\Audio\AsusSetup.exe
Task: {F8EB744D-6DD0-4538-B87E-B791EBDB09AC} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-06] (COMODO)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-07-11 18:48 - 2015-01-14 21:10 - 01739952 _____ () C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe
2011-05-24 22:18 - 2011-05-24 22:18 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-03-14 13:20 - 2011-03-14 13:20 - 00430080 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-03-14 13:20 - 2011-03-14 13:20 - 00032768 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResources.dll
2011-05-24 22:50 - 2011-05-24 22:50 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-09-30 01:51 - 2014-12-17 16:10 - 00074664 _____ () C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
2011-12-19 17:59 - 2013-04-15 18:39 - 00073424 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\ich\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-02-09 23:42 - 2015-02-09 23:42 - 00043008 _____ () c:\users\ich\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuprr1h.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\ich\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\ich\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\ich\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-09-25 06:04 - 2014-09-25 06:04 - 00976080 _____ () C:\Program Files (x86)\Comodo\GeekBuddy\QtNetwork4.dll
2014-09-25 06:04 - 2014-09-25 06:04 - 02254544 _____ () C:\Program Files (x86)\Comodo\GeekBuddy\QtCore4.dll
2014-09-25 06:04 - 2014-09-25 06:04 - 08024784 _____ () C:\Program Files (x86)\Comodo\GeekBuddy\QtGui4.dll
2014-09-25 06:04 - 2014-09-25 06:04 - 00032976 _____ () C:\Program Files (x86)\Comodo\GeekBuddy\imageformats\qgif4.dll
2014-09-25 06:04 - 2014-09-25 06:04 - 01299664 _____ () C:\Program Files (x86)\Comodo\GeekBuddy\QtScript4.dll
2014-09-14 18:00 - 2014-09-28 17:59 - 00019872 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAMSUNG_SSD.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows\grep.exe:$CmdTcID
AlternateDataStreams: C:\Windows\MBR.exe:$CmdTcID
AlternateDataStreams: C:\Windows\NIRCMD.exe:$CmdTcID
AlternateDataStreams: C:\Windows\PEV.exe:$CmdTcID
AlternateDataStreams: C:\Windows\sed.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SWREG.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SWSC.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SWXCACLS.exe:$CmdTcID
AlternateDataStreams: C:\Windows\zip.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncsi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlaapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlasvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ntoskrnl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\profsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rstrui.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\srclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\srcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TSWbPrxy.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ncsi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\nlaapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ntkrnlpa.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ntoskrnl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\srclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\mrxdav.sys:$CmdTcID
AlternateDataStreams: C:\Program Files\Common Files\System:tCPMPaly2ApBJsJQpTebTuZA
AlternateDataStreams: C:\ProgramData\Microsoft:hrBn6kAGDs0KqiCN0hFBOeRTpM46
AlternateDataStreams: C:\ProgramData\Microsoft:Y5qYE5j2HE9BvdnochLyKhxzfs
AlternateDataStreams: C:\Users\ich\Desktop\ComboFix.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Desktop\FRST64.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Desktop\FRST64.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\300-4525-wwtopo_install.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\AS5048A,B.pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Austriamicrosystems-AS5048A-AB-1.0-datasheet.pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\AÖSMV-Urkunde-Allg2014.cdr:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Bibi & Tina - Der Film - Cover.jpg:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\clipgrab-3.4.8.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\clipgrab-3.4.8.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\GarminExpress (1).exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\GarminExpress (1).exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Instalador Mapear V11.4 - GPS.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\Instalador Mapear V11.4 - GPS.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\InstallMyDriveConnect.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\InstallMyDriveConnect.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Kontoauszug_easybank_AT251420020001968395_2015_007.pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Kontoauszug_easybank_AT331420020010121974_2014_006.pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\MULTIFlight_setup.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\MULTIFlight_setup.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\NEuralNetworks in Forex.pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\OhRACLE03.zip:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\osm_generic_gmapsupp (1).zip:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\QNAPQfinderWindows-4.2.5.0108.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\QNAPQfinderWindows-4.2.5.0108.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Schaltplan Ardufoiler4 (1).pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Schaltplan Ardufoiler4.pdf:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\SetupAnyDVD7540.exe:$CmdTcID
AlternateDataStreams: C:\Users\ich\Downloads\SetupAnyDVD7540.exe:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Sicherungskopie_von_AÖSMV-UrkundeEhren2015Pichling.cdr:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\SuperEMA_CrossNoStop.mq4:$CmdZnID
AlternateDataStreams: C:\Users\ich\Downloads\Wiring diagram Ardufoiler Rev01.pdf:$CmdZnID

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-711161388-283650032-2311018211-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ich\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-711161388-283650032-2311018211-500 - Administrator - Disabled)
Gast (S-1-5-21-711161388-283650032-2311018211-501 - Limited - Disabled)
ich (S-1-5-21-711161388-283650032-2311018211-1000 - Administrator - Enabled) => C:\Users\ich

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/09/2015 07:09:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.99, Zeitstempel: 0x54aef409
Name des fehlerhaften Moduls: chrome.dll, Version: 39.0.2171.99, Zeitstempel: 0x54aef01a
Ausnahmecode: 0x80000003
Fehleroffset: 0x0051f7f8
ID des fehlerhaften Prozesses: 0xa60
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/09/2015 06:18:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.99, Zeitstempel: 0x54aef409
Name des fehlerhaften Moduls: chrome.dll, Version: 39.0.2171.99, Zeitstempel: 0x54aef01a
Ausnahmecode: 0x80000003
Fehleroffset: 0x0051f7f8
ID des fehlerhaften Prozesses: 0xb70
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/09/2015 08:40:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cmdagent.exe, Version: 8.1.0.4426, Zeitstempel: 0x54cb71c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000057c30
ID des fehlerhaften Prozesses: 0x3e0
Startzeit der fehlerhaften Anwendung: 0xcmdagent.exe0
Pfad der fehlerhaften Anwendung: cmdagent.exe1
Pfad des fehlerhaften Moduls: cmdagent.exe2
Berichtskennung: cmdagent.exe3

Error: (02/09/2015 07:53:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.99, Zeitstempel: 0x54aef409
Name des fehlerhaften Moduls: chrome.dll, Version: 39.0.2171.99, Zeitstempel: 0x54aef01a
Ausnahmecode: 0x80000003
Fehleroffset: 0x0051f7f8
ID des fehlerhaften Prozesses: 0x1300
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/08/2015 08:59:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cmdagent.exe, Version: 8.1.0.4426, Zeitstempel: 0x54cb71c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000057d0b
ID des fehlerhaften Prozesses: 0x3f4
Startzeit der fehlerhaften Anwendung: 0xcmdagent.exe0
Pfad der fehlerhaften Anwendung: cmdagent.exe1
Pfad des fehlerhaften Moduls: cmdagent.exe2
Berichtskennung: cmdagent.exe3

Error: (02/08/2015 08:33:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cmdagent.exe, Version: 8.1.0.4426, Zeitstempel: 0x54cb71c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000057b26
ID des fehlerhaften Prozesses: 0x3e4
Startzeit der fehlerhaften Anwendung: 0xcmdagent.exe0
Pfad der fehlerhaften Anwendung: cmdagent.exe1
Pfad des fehlerhaften Moduls: cmdagent.exe2
Berichtskennung: cmdagent.exe3

Error: (02/08/2015 08:23:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.99, Zeitstempel: 0x54aef409
Name des fehlerhaften Moduls: chrome.dll, Version: 39.0.2171.99, Zeitstempel: 0x54aef01a
Ausnahmecode: 0x80000003
Fehleroffset: 0x0051f7f8
ID des fehlerhaften Prozesses: 0x1590
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/08/2015 08:23:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.99, Zeitstempel: 0x54aef409
Name des fehlerhaften Moduls: chrome.dll, Version: 39.0.2171.99, Zeitstempel: 0x54aef01a
Ausnahmecode: 0x80000003
Fehleroffset: 0x0051f7f8
ID des fehlerhaften Prozesses: 0x1274
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/08/2015 09:53:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cmdagent.exe, Version: 8.1.0.4426, Zeitstempel: 0x54cb71c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000057c34
ID des fehlerhaften Prozesses: 0x3e4
Startzeit der fehlerhaften Anwendung: 0xcmdagent.exe0
Pfad der fehlerhaften Anwendung: cmdagent.exe1
Pfad des fehlerhaften Moduls: cmdagent.exe2
Berichtskennung: cmdagent.exe3

Error: (02/08/2015 09:37:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cmdagent.exe, Version: 8.1.0.4426, Zeitstempel: 0x54cb71c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000057c30
ID des fehlerhaften Prozesses: 0x3dc
Startzeit der fehlerhaften Anwendung: 0xcmdagent.exe0
Pfad der fehlerhaften Anwendung: cmdagent.exe1
Pfad des fehlerhaften Moduls: cmdagent.exe2
Berichtskennung: cmdagent.exe3


System errors:
=============
Error: (02/09/2015 11:44:31 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004

Error: (02/09/2015 11:44:30 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004

Error: (02/09/2015 11:44:28 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004

Error: (02/09/2015 11:44:22 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004

Error: (02/09/2015 11:44:15 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004

Error: (02/09/2015 11:43:02 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (02/09/2015 11:42:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
CFRMD

Error: (02/09/2015 11:42:03 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "AMD External Events Utility .NET." wurde mit folgendem Fehler beendet: 
%%126

Error: (02/09/2015 07:26:26 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/09/2015 07:06:42 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004


Microsoft Office Sessions:
=========================
Error: (02/09/2015 07:09:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe39.0.2171.9954aef409chrome.dll39.0.2171.9954aef01a800000030051f7f8a6001d044939136cfeeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\chrome.dlld08b0fbf-b086-11e4-8224-485b395f0df9

Error: (02/09/2015 06:18:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe39.0.2171.9954aef409chrome.dll39.0.2171.9954aef01a800000030051f7f8b7001d0448c7ae38b36C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\chrome.dllbb283602-b07f-11e4-b662-485b395f0df9

Error: (02/09/2015 08:40:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: cmdagent.exe8.1.0.442654cb71c1ntdll.dll6.1.7601.1822951fb164ac00000050000000000057c303e001d0443a4512016eC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\Windows\SYSTEM32\ntdll.dllf03f7afb-b02e-11e4-9819-485b395f0df9

Error: (02/09/2015 07:53:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe39.0.2171.9954aef409chrome.dll39.0.2171.9954aef01a800000030051f7f8130001d044351b102c4bC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\chrome.dll5946c6fb-b028-11e4-a8c5-485b395f0df9

Error: (02/08/2015 08:59:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: cmdagent.exe8.1.0.442654cb71c1ntdll.dll6.1.7601.1822951fb164ac00000050000000000057d0b3f401d043d85e254d54C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\Windows\SYSTEM32\ntdll.dll09b03a05-afcd-11e4-811a-485b395f0df9

Error: (02/08/2015 08:33:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: cmdagent.exe8.1.0.442654cb71c1ntdll.dll6.1.7601.1822951fb164ac00000050000000000057b263e401d043d4b1639f6fC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\Windows\SYSTEM32\ntdll.dll696e3e2b-afc9-11e4-92ff-485b395f0df9

Error: (02/08/2015 08:23:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe39.0.2171.9954aef409chrome.dll39.0.2171.9954aef01a800000030051f7f8159001d043d4c74ddc92C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\chrome.dll060e8712-afc8-11e4-92ff-485b395f0df9

Error: (02/08/2015 08:23:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe39.0.2171.9954aef409chrome.dll39.0.2171.9954aef01a800000030051f7f8127401d043d4c04d7066C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\chrome.dll000a6cc2-afc8-11e4-92ff-485b395f0df9

Error: (02/08/2015 09:53:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: cmdagent.exe8.1.0.442654cb71c1ntdll.dll6.1.7601.1822951fb164ac00000050000000000057c343e401d0437b5511dabeC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\Windows\SYSTEM32\ntdll.dllff7790cc-af6f-11e4-9542-485b395f0df9

Error: (02/08/2015 09:37:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: cmdagent.exe8.1.0.442654cb71c1ntdll.dll6.1.7601.1822951fb164ac00000050000000000057c303dc01d043791055e2a8C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\Windows\SYSTEM32\ntdll.dllbae94467-af6d-11e4-91ff-485b395f0df9


CodeIntegrity Errors:
===================================
  Date: 2015-02-09 19:02:35.513
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-09 19:02:35.341
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: AMD Phenom(tm) II X6 1090T Processor
Percentage of memory in use: 47%
Total physical RAM: 4094.16 MB
Available physical RAM: 2141.39 MB
Total Pagefile: 4292.34 MB
Available Pagefile: 1816.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.37 GB) (Free:124.08 GB) NTFS
Drive d: (2TB) (Fixed) (Total:1863.01 GB) (Free:115.66 GB) NTFS
Drive j: () (Fixed) (Total:465.75 GB) (Free:52.74 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 1F2AFC99)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: C496320C)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 465.8 GB) (Disk ID: AB8DAB8D)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Probleme:
Google Chrome startet wieder, jedoch lese ich die Logs nach meinen Möglichkeiten und der ESET online scan hat doch einiges gefunden, was mich beunruhigt?

Ich danke Dir erneut und hoffe den PC bald wieder vertrauenswürdig verwenden zu können!

lG,
EGI1610

Wundert dich noch irgendwas?

D:\Usenext\alt.binaries.software\Windows7ActivationCrack.zip

Hi Schrauber,
das hatte ich mal testweise runtergeladen und NICHT auf diesem Rechner ausgeführt...
der Rechner hat eine volle Lizenz und ist bis dato sauber gewesen.

Mein Fehler war die folgende Datei zu schnell und ohne Prüfung auszuführen:

sh=584A267E5B640B3F5984C957ABB767B1B10FB69B ft=1 fh=c71c0011991a82c0 vn="Win32/Packed.Autoit.H evtl. unerwünschte Anwendung" ac=I fn="D:\Usenext\wizard\Bibi Tina Voll Verhext Soundtrack Zum Kinofilm 201\Bibi Tina Voll Verhext Soundtrack Zum Kinofilm 2014.exe"
         

ich habe jetzt alle file-funde von ESET manuell gelöscht und hab laut Eset ein cleanes System. Kann ich dem jetzt trauen, oder sollte ich besser doch komplett neu aufsetzen?

Danke für Deinen Rat!

Was ist mit den anderen Cracks und KEygens wie zb für nero?

• Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
• Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
• Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
• Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
• Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
• Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

Hallo Schrauber,
kurzer Zwischenstand:
Windows Repair all in one läuft seid 16hr und ist noch im Schritt: HKEY_LOCAL_MACHINE & Subkeys... running repair und System account.

Der prozess SetACL_64.exe läuft auf einer CPU mit 100% und gesamt rechnerauslastung ist damit bei 18%

dauert das lang ^^

Hoffe mal heute nacht wird es irgendwann weitergehen.

Melde mich dann wieder DANKE

lG,
egi1610

PS: Nero bin ich mir nicht sicher, denke den habe ich mal kurz verwendet vor 1 Jahr, den hab ich damals mit Comodo und mit Spybotsearch&Destroy gescanned und nichts gefunden.

Nero runter wenn es noch drauf is, weil dafür auch ein Crack gefunden wurde.

Hi Schrauber,
Nero ist jetzt runter, repair hat nach 24 stunden fertig. Soll ich ein log posten? wenn ja, wo steckt das?

lG,
Egi1610

Nö, brauch kein Log. WIe läuft der Rechner?

Hallo Schrauber,

sieht alles gut aus, Rechner läuft fehlerfrei, Papierkorb Problem hat sich gelöst, Google Chrome tut auch wieder normal. Rechner läuft gefühlt normal schnell.

Meinst Du alles ist jetzt wieder gut?

Danke für Deine Mühen und Hilfe!!!

lG,
Egi1610

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hi Schrauber,
sorry die späte Rückmeldung! Alles getan, alles erledigt, keine weiteren Fragen, danke danke danke!

Thread kann aus Deinen Abos raus!

so long EGI

Gern Geschehen