Laptop seit Windows Update am krepieren

schrauber · 18.03.2015, 08:20

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Littlx · 18.03.2015, 15:54

Laptop läuft übrigens wieder einwandfrei seit ich den Adwarecleaner drüber laufen ließ.

ESET

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=781b8b04afff4949a903f25176217c6c
# engine=22965
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-18 02:34:32
# local_time=2015-03-18 03:34:32 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 255248 51570565 0 0
# scanned=273955
# found=4
# cleaned=0
# scan_time=5202
sh=08131ADF7C15E801A902E72ADA9DBA8EF81AD101 ft=1 fh=0e19461b6ef503f8 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\AppData\Local\Temp\DMR\dmr_72.exe"
sh=92C41574810314EA7E3856136F582E1677F6DEC0 ft=1 fh=70d55988646c95ba vn="Win32/SoftonicDownloader.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\Desktop\USBStick\SoftonicDownloader_for_eufloria.exe"
sh=DFEF8F0CF623955EB46123A2DC45CC8C4ABEFFC3 ft=1 fh=4032e99729120fd3 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\Downloads\FRAPS - CHIP-Installer.exe"
sh=BDD8494D038CDC993C208643F2651A891CBC3FBA ft=1 fh=407b98f71e6edfc1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\Downloads\Paint NET - CHIP-Installer.exe"

Der Security Check gibt mir nach dem Starten nur eine Fehlermeldung aus: "UNSUPPORTED OPERATING SYSTEM! Aborting now!". Ebenso öffnet sich Notepad++ mit fast der selben Nachricht, nur lautet hier der zweite Satz "ABORTED!"

FRST (hab mir erlaubt die ewig lange Datenliste vom 11.03.2015 rauszuschneiden)

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Dominik (administrator) on DOMINIK on 18-03-2015 15:40:56
Running from C:\Users\Dominik\Desktop
Loaded Profiles: Dominik (Available profiles: Dominik)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel(R) Corporation) C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Tablet Driver) C:\Windows\System32\drivers\WTSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Spotify Ltd) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\Dominik\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Gajim Development Team) C:\Program Files (x86)\Gajim\bin\gajim.exe
(Tablet Driver) C:\Windows\SysWOW64\WTClient.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QuickAccess.exe
(TODO: <Company name>) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\McChHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Dominik\Desktop\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13671640 2014-04-10] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-02] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WTClient] => C:\Windows\SysWOW64\WTClient.exe [41304 2014-01-13] (Tablet Driver)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704248 2015-03-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2014-02-25] ( (Atheros Communications))
HKU\S-1-5-21-2625188411-2669799795-3077422296-1001\...\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-07-09] (Spotify Ltd)
HKU\S-1-5-21-2625188411-2669799795-3077422296-1001\...\RunOnce: [Application Restart #1] => C:\Users\Dominik\AppData\Local\Pokki\Engine\HostAppService.exe [7848264 2015-03-12] (Pokki)
HKU\S-1-5-21-2625188411-2669799795-3077422296-1001\...\RunOnce: [Application Restart #0] => C:\Users\Dominik\AppData\Local\Pokki\Engine\HostAppService.exe [7848264 2015-03-12] (Pokki)
Startup: C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Dominik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gajim.lnk
ShortcutTarget: Gajim.lnk -> C:\Program Files (x86)\Gajim\bin\gajim.exe (Gajim Development Team)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dominik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2625188411-2669799795-3077422296-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage-web.com/?s=acer&m=start
HKU\S-1-5-21-2625188411-2669799795-3077422296-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2625188411-2669799795-3077422296-1001 -> {288681F1-4DA6-4473-9276-6EB020B75961} URL = 
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-17] (Oracle Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-17] (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Dominik\AppData\Roaming\Mozilla\Firefox\Profiles\BpgPWA0C.default
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-17] (Oracle Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-07-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2625188411-2669799795-3077422296-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Dominik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-10-08] (Unity Technologies ApS)
FF Extension: Avira Browser Safety - C:\Users\Dominik\AppData\Roaming\Mozilla\Firefox\Profiles\BpgPWA0C.default\Extensions\abs@avira.com [2014-10-14]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2014-05-27]

Chrome: 
=======
CHR HomePage: Default -> hxxp://homepage-web.com/?s=acer&m=home
CHR StartupUrls: Default -> "hxxp://homepage-web.com/?s=acer&m=start"
CHR DefaultSearchKeyword: Default -> homepage-web.com
CHR DefaultSearchURL: Default -> hxxp://search.homepage-web.com/?src=omnibox&partner=acer&q={searchTerms}
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-16]
CHR Extension: (Google Docs) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-16]
CHR Extension: (Google Drive) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-16]
CHR Extension: (YouTube) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-16]
CHR Extension: (Adblock Plus) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-10-21]
CHR Extension: (Google Search) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-16]
CHR Extension: (Google Sheets) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-16]
CHR Extension: (SiteAdvisor) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-11-19]
CHR Extension: (Avira Browser Safety) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-16]
CHR Extension: (Gmail) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-16]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-14]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-14]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [806192 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992048 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [319104 2014-02-25] (Windows (R) Win 7 DDK provider) [File not signed]
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe [2797312 2014-01-16] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573544 2014-03-06] (Acer Incorporated)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [235008 2013-07-16] (TODO: <Company name>) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-21] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) TechnologyAccessService; C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe [93408 2015-02-08] (Intel(R) Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-06-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-12-10] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [459496 2014-03-17] (Acer Incorporate)
R2 McAfee SiteAdvisor Service; c:\Program Files (x86)\McAfee\siteadvisor\mcsacore.exe [155368 2015-02-19] (McAfee, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617352 2014-04-02] (NVIDIA Corporation)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [457960 2014-03-21] (Acer Incorporate)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-03-21] (Acer Incorporate)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [222952 2014-01-24] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3888640 2014-02-14] (Qualcomm Atheros Communications, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-02-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-02-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-09-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-02-25] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
R1 ndisrd; C:\Windows\system32\DRIVERS\ndisrfl.sys [41688 2014-10-30] (Intel Corporation)
R3 NetTap630; C:\Windows\system32\DRIVERS\nettap630.sys [67800 2014-10-30] (Intel Corporation)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [476888 2014-04-02] (Realsil Semiconductor Corporation)
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [42224 2014-02-19] (Synaptics Incorporated)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [116296 2014-10-11] (Oracle Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 Tablet2k; "%SystemRoot%\System32\Drivers\Tablet2k.sys" [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 15:37 - 2015-03-18 15:37 - 00852604 _____ () C:\Users\Dominik\Downloads\SecurityCheck (1).exe
2015-03-18 15:37 - 2015-03-18 15:37 - 00852604 _____ () C:\Users\Dominik\Desktop\SecurityCheck.exe
2015-03-18 14:05 - 2015-03-18 14:05 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-18 14:04 - 2015-03-18 14:04 - 02347384 _____ (ESET) C:\Users\Dominik\Downloads\esetsmartinstaller_deu (1).exe
2015-03-17 17:17 - 2015-03-17 17:17 - 00000833 _____ () C:\Users\Dominik\Desktop\JRT.txt
2015-03-17 17:14 - 2015-03-17 17:14 - 01388672 _____ (Thisisu) C:\Users\Dominik\Downloads\JRT (1).exe
2015-03-17 17:10 - 2015-03-17 17:10 - 00002439 _____ () C:\Users\Dominik\Desktop\AdwCleaner[S0].txt
2015-03-17 17:08 - 2015-03-17 17:13 - 00000000 ____D () C:\AdwCleaner
2015-03-17 17:07 - 2015-03-17 17:07 - 02171392 _____ () C:\Users\Dominik\Desktop\AdwCleaner_4.112.exe
2015-03-17 17:06 - 2015-03-17 17:06 - 00001192 _____ () C:\Users\Dominik\Desktop\MBAM.txt
2015-03-16 21:30 - 2015-03-16 21:30 - 00049518 _____ () C:\Users\Dominik\Downloads\FRST (2).7z
2015-03-16 21:28 - 2015-03-16 21:28 - 00049518 _____ () C:\Users\Dominik\Downloads\FRST (1).7z
2015-03-16 21:25 - 2015-03-16 21:25 - 00049518 _____ () C:\Users\Dominik\Downloads\FRST.7z
2015-03-16 21:25 - 2015-03-16 21:25 - 00049518 _____ () C:\Users\Dominik\Desktop\FRST.7z
2015-03-16 21:15 - 2015-03-16 21:16 - 00060681 _____ () C:\Users\Dominik\Desktop\Addition.txt
2015-03-16 21:13 - 2015-03-18 15:41 - 00000000 ____D () C:\FRST
2015-03-16 21:13 - 2015-03-18 15:40 - 00022094 _____ () C:\Users\Dominik\Desktop\FRST.txt
2015-03-16 21:11 - 2015-03-16 21:11 - 02095616 _____ (Farbar) C:\Users\Dominik\Desktop\FRST64 (1).exe
2015-03-15 22:31 - 2015-03-15 22:31 - 00000000 ____D () C:\Windows\softwaredistribution.bak
2015-03-15 22:30 - 2015-03-15 22:30 - 00302011 _____ () C:\Users\Dominik\Downloads\WindowsUpdateDiagnostic.diagcab
2015-03-15 09:11 - 2015-03-17 16:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-15 09:11 - 2015-03-15 09:11 - 00001122 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-15 09:11 - 2015-03-15 09:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-15 09:11 - 2015-03-15 09:11 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-15 09:11 - 2015-03-15 09:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-15 09:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-15 09:11 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-15 09:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-15 09:09 - 2015-03-15 09:10 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Dominik\Downloads\mbam-setup-2.0.4.1028 (1).exe
2015-03-11 20:15 - 2014-10-31 05:50 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\BulkOperationHost.exe
[...]
2015-03-11 10:08 - 2015-01-21 06:15 - 01123848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-02-25 07:18 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 07:18 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-25 07:18 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-02-25 07:18 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-02-25 07:18 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-02-25 07:18 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-02-24 13:24 - 2015-02-24 13:24 - 00103126 _____ () C:\Users\Dominik\Downloads\view.htm
2015-02-24 11:20 - 2015-02-24 11:20 - 00121069 _____ () C:\Users\Dominik\Downloads\memtest86+-5.01.usb.installer.zip
2015-02-24 11:13 - 2015-02-24 11:23 - 00000000 ____D () C:\Users\Dominik\Desktop\USBStick
2015-02-24 11:02 - 2015-02-24 11:02 - 00261270 _____ () C:\Users\Dominik\Downloads\Minidump.zip
2015-02-24 11:01 - 2015-02-24 11:38 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2015-02-24 11:01 - 2015-02-24 11:01 - 00003476 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon
2015-02-24 11:00 - 2015-02-24 11:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2015-02-24 11:00 - 2015-02-24 11:00 - 00000000 ____D () C:\ProgramData\Intel(R) Update Manager
2015-02-24 11:00 - 2015-02-24 11:00 - 00000000 ____D () C:\Program Files\Intel Corporation
2015-02-24 10:58 - 2015-02-24 10:58 - 00302240 _____ () C:\Windows\Minidump\022415-18859-01.dmp
2015-02-22 13:34 - 2015-02-22 13:34 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Steam

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 15:39 - 2015-01-04 09:52 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\Notepad++
2015-03-18 15:32 - 2014-12-04 16:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-18 15:11 - 2014-09-16 19:27 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1A58311D-978B-4757-9BD0-3C72CF7B0E22}
2015-03-18 15:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-18 15:00 - 2014-09-16 19:39 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-18 14:55 - 2014-07-09 03:40 - 01780630 _____ () C:\Windows\WindowsUpdate.log
2015-03-18 10:10 - 2014-12-04 16:50 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-17 20:59 - 2014-11-08 20:14 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\Gajim
2015-03-17 17:16 - 2014-07-09 13:08 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-03-17 17:16 - 2014-07-09 13:08 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-03-17 17:16 - 2014-03-18 11:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-17 17:12 - 2014-11-08 20:14 - 00000000 ____D () C:\Users\Dominik\.gstreamer-0.10
2015-03-17 17:12 - 2014-10-15 06:23 - 00000000 ___RD () C:\Users\Dominik\Dropbox
2015-03-17 17:12 - 2014-10-14 20:01 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\Dropbox
2015-03-17 17:11 - 2014-09-16 19:39 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-17 17:11 - 2014-09-16 19:26 - 00000000 __RDO () C:\Users\Dominik\OneDrive
2015-03-17 17:11 - 2013-08-22 15:46 - 00024040 _____ () C:\Windows\setupact.log
2015-03-17 17:11 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-17 17:10 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-03-17 15:35 - 2014-09-16 19:24 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Pokki
2015-03-17 13:49 - 2014-09-16 19:43 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\.minecraft
2015-03-16 22:47 - 2014-09-16 19:24 - 00000000 ____D () C:\Users\Dominik
2015-03-16 21:10 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-03-15 23:13 - 2014-09-16 19:31 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2625188411-2669799795-3077422296-1001
2015-03-15 22:58 - 2014-03-18 10:54 - 00173188 _____ () C:\Windows\PFRO.log
2015-03-15 17:49 - 2013-08-22 16:37 - 00004167 _____ () C:\Windows\DtcInstall.log
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-15 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-03-15 17:39 - 2014-03-18 10:45 - 00000000 ____D () C:\Program Files\Windows Journal
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sppui
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\setup
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\Com
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\IME
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Multimedia Platform
2015-03-15 17:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\System
2015-03-15 17:39 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2015-03-15 17:39 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-15 17:39 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\servicing
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ___SD () C:\Windows\system32\dsc
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sppui
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\setup
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\migwiz
2015-03-15 17:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\Com
2015-03-15 17:38 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\Sysprep
2015-03-15 17:38 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\oobe
2015-03-15 17:38 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-15 17:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\WindowsPowerShell
2015-03-15 17:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2015-03-15 17:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2015-03-15 17:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Multimedia Platform
2015-03-15 13:32 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-03-15 10:34 - 2013-08-22 16:36 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2015-03-15 10:34 - 2013-08-22 16:36 - 00195072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2015-03-15 01:39 - 2014-09-16 19:27 - 00002337 _____ () C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-03-14 22:17 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-14 22:06 - 2014-10-14 19:54 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-14 22:06 - 2014-10-14 19:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-14 22:06 - 2014-10-14 19:54 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-03-14 22:02 - 2014-05-27 07:24 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-03-14 22:02 - 2013-08-22 15:44 - 00346960 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-14 21:56 - 2014-09-17 00:09 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-14 21:53 - 2014-09-17 00:09 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-14 09:13 - 2014-12-25 13:43 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-13 11:03 - 2014-09-16 19:40 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-11 10:06 - 2014-10-15 06:23 - 00001076 _____ () C:\Users\Dominik\Desktop\Dropbox.lnk
2015-03-11 10:06 - 2014-10-14 20:02 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-10 13:29 - 2014-09-16 19:25 - 00000000 ____D () C:\Users\Dominik\AppData\Local\VirtualStore
2015-03-07 21:46 - 2014-09-16 21:01 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Battle.net
2015-03-07 10:33 - 2014-09-16 21:02 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2015-03-07 10:30 - 2014-09-16 21:01 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-03-05 14:09 - 2014-12-01 22:24 - 00000000 ____D () C:\Users\Dominik\Documents\TmForever
2015-03-04 22:24 - 2014-09-17 09:23 - 00792032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-04 22:24 - 2014-09-17 09:23 - 00178144 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-25 23:04 - 2014-10-16 11:37 - 00000000 ____D () C:\Users\Dominik\.VirtualBox
2015-02-24 11:00 - 2014-07-09 03:43 - 00000000 ____D () C:\ProgramData\Intel
2015-02-24 11:00 - 2014-05-27 07:09 - 00000000 ____D () C:\Program Files (x86)\Intel
2015-02-24 10:58 - 2014-11-01 00:00 - 595894320 _____ () C:\Windows\MEMORY.DMP
2015-02-24 10:58 - 2014-11-01 00:00 - 00000000 ____D () C:\Windows\Minidump
2015-02-23 01:09 - 2014-10-24 08:18 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\Skype

==================== Files in the root of some directories =======

2014-11-09 00:42 - 2014-11-09 00:42 - 0000218 _____ () C:\Users\Dominik\AppData\Local\recently-used.xbel
2014-07-09 03:37 - 2014-07-09 03:37 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-01-15 20:59 - 2014-11-16 20:59 - 0000032 ____R () C:\ProgramData\hash.dat

Files to move or delete:
====================
C:\ProgramData\hash.dat


Some content of TEMP:
====================
C:\Users\Dominik\AppData\Local\Temp\avgnt.exe
C:\Users\Dominik\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvaikhf.dll
C:\Users\Dominik\AppData\Local\Temp\Intel_Technology_Access_Software.exe
C:\Users\Dominik\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Dominik\AppData\Local\Temp\npp.6.7.5.Installer.exe
C:\Users\Dominik\AppData\Local\Temp\oct4539.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct5BEE.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct5C5.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct6793.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct693.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct6B1E.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct6E3A.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\oct8397.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\octD659.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\octD948.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\octEBB7.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\pyl5DD8.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\pyl6622.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\pyl69B4.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\pylA371.tmp.exe
C:\Users\Dominik\AppData\Local\Temp\Quarantine.exe
C:\Users\Dominik\AppData\Local\Temp\sqlite3.dll
C:\Users\Dominik\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Dominik\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-16 19:02

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 19.03.2015, 09:20

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Dominik\AppData\Local\Temp\DMR\dmr_72.exe

C:\Users\Dominik\Desktop\USBStick\SoftonicDownloader_for_eufloria.exe

C:\Users\Dominik\Downloads\FRAPS - CHIP-Installer.exe

C:\Users\Dominik\Downloads\Paint NET - CHIP-Installer.exe
CHR HomePage: Default -> hxxp://homepage-web.com/?s=acer&m=home
CHR StartupUrls: Default -> "hxxp://homepage-web.com/?s=acer&m=start"
CHR DefaultSearchKeyword: Default -> homepage-web.com
CHR DefaultSearchURL: Default -> hxxp://search.homepage-web.com/?src=omnibox&partner=acer&q={searchTerms}
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Zum Lesen:
CHIP-Installer - was ist das? - Anleitungen

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Littlx · 19.03.2015, 17:02

Fixlog.txt

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Dominik at 2015-03-19 16:41:44 Run:1
Running from C:\Users\Dominik\Desktop
Loaded Profiles: Dominik (Available profiles: Dominik)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Dominik\AppData\Local\Temp\DMR\dmr_72.exe

C:\Users\Dominik\Desktop\USBStick\SoftonicDownloader_for_eufloria.exe

C:\Users\Dominik\Downloads\FRAPS - CHIP-Installer.exe

C:\Users\Dominik\Downloads\Paint NET - CHIP-Installer.exe
CHR HomePage: Default -> hxxp://homepage-web.com/?s=acer&m=home
CHR StartupUrls: Default -> "hxxp://homepage-web.com/?s=acer&m=start"
CHR DefaultSearchKeyword: Default -> homepage-web.com
CHR DefaultSearchURL: Default -> hxxp://search.homepage-web.com/?src=omnibox&partner=acer&q={searchTerms}
Emptytemp:
*****************

C:\Users\Dominik\AppData\Local\Temp\DMR\dmr_72.exe => Moved successfully.
C:\Users\Dominik\Desktop\USBStick\SoftonicDownloader_for_eufloria.exe => Moved successfully.
C:\Users\Dominik\Downloads\FRAPS - CHIP-Installer.exe => Moved successfully.
C:\Users\Dominik\Downloads\Paint NET - CHIP-Installer.exe => Moved successfully.
Chrome HomePage deleted successfully.
Chrome StartupUrls deleted successfully.
Chrome DefaultSearchKeyword deleted successfully.
Chrome DefaultSearchURL deleted successfully.
EmptyTemp: => Removed 3.4 GB temporary data.


The system needed a reboot. 

==== End of Fixlog 16:41:56 ====

Besten Dank für den Lesestoff zum CHIP-Installer, war sehr hilfreich!

War es das dann?

schrauber · 19.03.2015, 21:29

jup, fertig

19.03.2015, 21:29	#20
schrauber /// the machine /// TB-Ausbilder	Laptop seit Windows Update am krepieren [gelöst] jup, fertig __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Laptop seit Windows Update am krepieren

Alles rund um Windows: Laptop seit Windows Update am krepieren

Laptop seit Windows Update am krepieren [gelöst]

Laptop seit Windows Update am krepieren [gelöst]

Laptop seit Windows Update am krepieren [gelöst]

Laptop seit Windows Update am krepieren [gelöst]

Laptop seit Windows Update am krepieren [gelöst]

Ähnliche Themen: Laptop seit Windows Update am krepieren