G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nicht

Steffen 70 · 04.04.2015, 16:35

Hallo Jürgen,

ja wird immer besser.

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015
Ran by Steffen at 2015-04-04 15:33:35 Run:1
Running from C:\Users\Steffen\Downloads
Loaded Profiles: Steffen (Available profiles: Steffen & UpdatusUser)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
CloseProcesses:
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {15A29993-9DCD-469B-8AB5-678C5F72FF3E} URL = 
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://tbsearch.ask.com/redirect?client=ie&tb=WBG&o=15132&src=crm&q={searchTerms}&locale=de_DE
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
Toolbar: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe}
C:\ProgramData\00etadpu.pad
C:\ProgramData\8odwoemq.fee
C:\ProgramData\8odwoemq.odd
C:\ProgramData\8zwwlhrq.bxx
C:\ProgramData\8zwwlhrq.fvv
C:\ProgramData\9oj69hf.bxx
C:\ProgramData\9oj69hf.fvv
C:\ProgramData\c_0_lpt.pad
C:\ProgramData\ism_0_llatsni.pad
C:\ProgramData\lzjb8av.bxx
C:\ProgramData\lzjb8av.fvv
C:\ProgramData\nud0repor.pad
C:\ProgramData\rat_0ybba.pad
C:\ProgramData\z7_0ytr.pad
AlternateDataStreams: C:\Windows\$NtUninstallKB27797$:SummaryInformation
AlternateDataStreams: C:\Users\Steffen\Downloads\Datenblatt für SMC 4100-T2 Schrittmotorcontroller.eml:OECustomProperty
AlternateDataStreams: C:\Users\Steffen\Documents\Angebot.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Angebot.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\depot.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\depot.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Grundsteuer2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Rente3.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Rente3.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
         
*****************

Processes closed successfully.
"HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{15A29993-9DCD-469B-8AB5-678C5F72FF3E}" => Key deleted successfully.
HKCR\CLSID\{15A29993-9DCD-469B-8AB5-678C5F72FF3E} => Key not found. 
"HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}" => Key deleted successfully.
HKCR\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found. 
"HKU\S-1-5-21-3764681053-1311214435-963443542-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found. 
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found. 
C:\Users\Steffen\AppData\Local\{b3143e40-0149-157c-ba8a-29adcc6cabbe} => Moved successfully.
C:\ProgramData\00etadpu.pad => Moved successfully.
C:\ProgramData\8odwoemq.fee => Moved successfully.
C:\ProgramData\8odwoemq.odd => Moved successfully.
C:\ProgramData\8zwwlhrq.bxx => Moved successfully.
C:\ProgramData\8zwwlhrq.fvv => Moved successfully.
C:\ProgramData\9oj69hf.bxx => Moved successfully.
C:\ProgramData\9oj69hf.fvv => Moved successfully.
C:\ProgramData\c_0_lpt.pad => Moved successfully.
C:\ProgramData\ism_0_llatsni.pad => Moved successfully.
C:\ProgramData\lzjb8av.bxx => Moved successfully.
C:\ProgramData\lzjb8av.fvv => Moved successfully.
C:\ProgramData\nud0repor.pad => Moved successfully.
C:\ProgramData\rat_0ybba.pad => Moved successfully.
C:\ProgramData\z7_0ytr.pad => Moved successfully.
C:\Windows\$NtUninstallKB27797$ => ":SummaryInformation" ADS removed successfully.
C:\Users\Steffen\Downloads\Datenblatt für SMC 4100-T2 Schrittmotorcontroller.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Steffen\Documents\Angebot.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Angebot.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Centerplatte bemaßt.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\depot.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\depot.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Grundsteuer1.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Grundsteuer1.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Grundsteuer2.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Grundsteuer2.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Rente1.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Rente1.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Rente2.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Rente2.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Rente3.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Rente3.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Vertrag Sandra.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Vertrag Sandra.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.
C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg => ":3or4kl4x13tuuug3Byamue2s4b" ADS removed successfully.
C:\Users\Steffen\Documents\Vertrag Sandra1.jpeg => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS removed successfully.


The system needed a reboot. 

==== End of Fixlog 15:33:37 ====

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Steffen (administrator) on STEFFEN-PC on 04-04-2015 17:31:37
Running from C:\Users\Steffen\Downloads
Loaded Profiles: Steffen (Available profiles: Steffen & UpdatusUser)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe
() C:\Program Files\AntiBrowserSpy\BrowserMask.exe
() C:\Program Files\AntiBrowserSpy\SocialBlock_ProxyCheck.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\AntiBrowserSpy\AntiBrowserSpy-IE-SocialBlock.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Akamai Technologies, Inc.) C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_17_0_0_134_ActiveX.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files\g data\internetsecurity\avkkid\avkcks.exe,
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Steffen\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: G - G:\pushinst.exe
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: {27a82824-2466-11df-ad1a-003067031c7a} - G:\pushinst.exe
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\MountPoints2: {e245abf6-f955-11e3-ab17-003067031c7a} - F:\pushinst.exe
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2616320 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3764681053-1311214435-963443542-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3764681053-1311214435-963443542-1000 -> {81CE708B-5104-4C62-B333-94B417473B29} URL = hxxp://go.mail.com/br/ie9_search_web/?su={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18] (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-11-23] (Sun Microsystems, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-11-23] (Sun Microsystems, Inc.)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=1.6.0_37 -> C:\Windows\system32\npdeployJava1.dll [2012-11-23] (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll [2012-11-23] (Sun Microsystems, Inc.)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-02-15] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3764681053-1311214435-963443542-1000: @autodesk.com/DWF -> C:\Program Files\Autodesk\Autodesk Design Review Browser Add-on v1.2\npADRdwf.dll [2011-01-24] (Autodesk)

Chrome: 
=======
CHR Profile: C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-04]
CHR Extension: (Google Search) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-04]
CHR Extension: (avast! WebRep) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda [2012-03-04]
CHR Extension: (Gmail) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-04]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG)
R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2015-03-27] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2015-03-27] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2015-03-27] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-03-27] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-04-01] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2015-03-27] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-04] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-04 17:31 - 2015-04-04 17:31 - 00011588 _____ () C:\Users\Steffen\Downloads\FRST.txt
2015-04-04 17:30 - 2015-04-04 17:30 - 00002355 _____ () C:\Users\Steffen\Desktop\FSS.txt
2015-04-04 17:29 - 2015-04-04 17:30 - 00415232 _____ (Farbar) C:\Users\Steffen\Downloads\FSS.exe
2015-04-04 17:22 - 2015-04-04 17:30 - 00000000 ____D () C:\Users\Steffen\Documents\Trojaner
2015-04-04 17:01 - 2015-04-04 17:01 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-04 15:38 - 2015-04-04 15:38 - 02347384 _____ (ESET) C:\Users\Steffen\Downloads\esetsmartinstaller_deu.exe
2015-04-02 16:32 - 2015-04-03 09:33 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-04-02 16:30 - 2015-04-02 17:38 - 00000000 ____D () C:\Users\Steffen\Desktop\mbar
2015-04-02 16:28 - 2015-04-02 16:30 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Steffen\Downloads\mbar-1.09.1.1004.exe
2015-04-01 18:54 - 2015-04-01 18:59 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-01 18:25 - 2015-04-01 18:25 - 00001164 _____ () C:\Users\Steffen\Desktop\tdsskiller - Verknüpfung.lnk
2015-04-01 17:08 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-04-01 17:08 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-04-01 17:08 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-01 17:07 - 2015-02-26 05:11 - 02381312 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-04-01 17:07 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-01 17:07 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-01 17:07 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-01 17:07 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-01 17:07 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-01 17:07 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-01 17:07 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-01 17:07 - 2015-02-20 04:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-01 17:07 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-01 17:07 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-01 17:07 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-01 17:07 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-01 17:07 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-01 17:07 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-01 17:07 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-01 17:07 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-01 17:07 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-01 17:07 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-01 17:07 - 2015-02-20 03:56 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-01 17:07 - 2015-02-20 03:50 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-01 17:07 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-01 17:07 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-01 17:07 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-01 17:07 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-01 17:07 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-01 17:07 - 2015-02-20 03:24 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-01 17:07 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-01 17:07 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-01 17:07 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-01 17:07 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-01 17:06 - 2015-03-06 07:15 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-01 17:06 - 2015-03-06 07:15 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-01 17:06 - 2015-03-06 07:10 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-01 17:06 - 2015-03-06 07:10 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-01 17:06 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-01 17:06 - 2015-03-06 07:09 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-01 17:06 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-01 17:06 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-01 17:06 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-01 17:06 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-04-01 17:05 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-04-01 17:05 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-04-01 17:05 - 2015-02-20 06:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-04-01 17:05 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-04-01 17:05 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-04-01 17:05 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-04-01 17:04 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-01 17:04 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-01 17:04 - 2015-02-03 05:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-04-01 17:04 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-01 17:04 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-04-01 17:04 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-04-01 17:04 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-04-01 17:04 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-04-01 17:04 - 2015-02-03 05:11 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-04-01 17:04 - 2015-02-03 05:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-04-01 17:04 - 2015-02-03 05:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-04-01 17:04 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-04-01 17:04 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-01 17:04 - 2015-02-03 05:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-04-01 17:04 - 2015-02-03 04:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-04-01 17:04 - 2015-01-31 01:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-04-01 17:04 - 2014-11-01 00:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-04-01 17:04 - 2014-06-28 02:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-04-01 17:04 - 2014-06-28 02:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-04-01 17:03 - 2015-04-01 17:03 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2015-04-01 17:02 - 2015-04-01 17:02 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2015-04-01 16:55 - 2015-01-09 04:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-04-01 16:55 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-04-01 16:55 - 2015-01-09 04:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-04-01 16:46 - 2015-04-01 16:46 - 00000000 ____D () C:\TDSSKiller_Quarantine
2015-04-01 16:31 - 2015-04-01 16:31 - 00048445 _____ () C:\Users\Steffen\Downloads\Shortcut.txt
2015-03-31 12:29 - 2015-03-31 12:30 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Steffen\Downloads\tdsskiller (1).exe
2015-03-31 12:26 - 2015-03-31 12:27 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Steffen\Downloads\tdsskiller.exe
2015-03-31 12:24 - 2015-03-31 12:24 - 00443784 _____ () C:\Users\Steffen\Downloads\Allin1Convert.exe
2015-03-30 13:28 - 2015-04-02 17:31 - 00028955 _____ () C:\Users\Steffen\Downloads\Addition.txt
2015-03-30 13:27 - 2015-03-30 13:27 - 00001106 _____ () C:\Users\Steffen\Desktop\FRST - Verknüpfung.lnk
2015-03-30 13:26 - 2015-04-04 17:31 - 00000000 ____D () C:\FRST
2015-03-30 13:26 - 2015-03-30 13:26 - 01135104 _____ (Farbar) C:\Users\Steffen\Downloads\FRST.exe
2015-03-27 23:42 - 2015-03-27 23:45 - 00000050 _____ () C:\Windows\system32\bridf08b.dat
2015-03-27 23:41 - 2015-03-27 23:41 - 00000000 ____D () C:\ProgramData\Brother
2015-03-27 22:11 - 2015-03-27 22:11 - 311218386 _____ () C:\Windows\MEMORY.DMP
2015-03-27 22:11 - 2015-03-27 22:11 - 00143800 _____ () C:\Windows\Minidump\032715-18798-01.dmp
2015-03-27 21:00 - 2015-04-04 16:04 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-27 21:00 - 2015-04-02 17:38 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-27 21:00 - 2015-03-27 21:10 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-03-27 21:00 - 2015-03-27 21:00 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-27 21:00 - 2015-03-27 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-27 21:00 - 2015-03-27 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-27 21:00 - 2015-03-17 07:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-27 21:00 - 2015-03-17 07:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-27 20:57 - 2015-03-27 21:00 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Steffen\Downloads\mbam-setup-2.1.4.1018 (1).exe
2015-03-27 20:47 - 2015-04-04 15:35 - 00001288 _____ () C:\Windows\setupact.log
2015-03-27 20:47 - 2015-04-03 09:33 - 00014862 _____ () C:\Windows\PFRO.log
2015-03-27 20:47 - 2015-03-27 20:47 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-27 20:03 - 2015-04-04 17:01 - 01176503 _____ () C:\Windows\WindowsUpdate.log
2015-03-27 20:00 - 2015-03-27 20:00 - 00003520 _____ () C:\Users\Steffen\Documents\cc_20150327_190017.reg
2015-03-27 19:36 - 2015-03-27 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2015-03-27 19:28 - 2015-03-27 19:28 - 00002008 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk
2015-03-27 19:25 - 2015-03-27 19:25 - 00056832 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2015-03-27 19:22 - 2015-03-27 19:22 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys
2015-03-27 19:21 - 2015-03-27 19:21 - 00101504 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2015-03-27 19:21 - 2015-03-27 19:21 - 00050176 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2015-03-27 19:21 - 2015-03-27 19:21 - 00044544 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2015-03-27 19:19 - 2015-03-27 19:19 - 00000000 ____D () C:\Program Files\Common Files\G Data
2015-03-27 18:38 - 2015-03-27 18:38 - 00001037 _____ () C:\Users\Public\Desktop\AntiBrowserSpy.lnk
2015-03-27 18:38 - 2015-03-27 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiBrowserSpy
2015-03-19 13:43 - 2015-03-19 13:43 - 00000000 ____D () C:\Users\Steffen\AppData\Local\Solid Concepts Inc
2015-03-19 13:42 - 2015-03-19 13:42 - 00002171 _____ () C:\Users\Public\Desktop\SolidView Lite 2014.lnk
2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\ProgramData\Solid Concepts Inc
2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solid Concepts Inc
2015-03-19 13:42 - 2015-03-19 13:42 - 00000000 ____D () C:\Program Files\Solid Concepts Inc
2015-03-19 12:55 - 2015-03-19 13:41 - 163663800 _____ (Solid Concepts Inc) C:\Users\Steffen\Downloads\svlite_2014v0_x86.exe
2015-03-09 17:44 - 2015-03-09 17:48 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-03-09 17:35 - 2015-03-09 17:35 - 00057337 _____ () C:\Users\Steffen\Downloads\Drehteile (2).zip

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-04 17:13 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-04 15:42 - 2009-07-14 06:34 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-04 15:42 - 2009-07-14 06:34 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-04 15:39 - 2014-02-17 13:50 - 01014206 _____ () C:\Users\Steffen\Downloads\Datenblatt für SMC 4100-T2 Schrittmotorcontroller.eml
2015-04-04 15:35 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-04 15:34 - 2012-11-18 17:18 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-04-04 15:22 - 2010-02-28 14:47 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-03 09:38 - 2010-05-08 17:18 - 00000000 ____D () C:\Users\Steffen\Documents\Quadrocopter
2015-04-02 16:56 - 2009-07-14 04:37 - 00000000 _SHDC () C:\Windows\$NtUninstallKB27797$
2015-04-02 16:21 - 2009-07-14 06:33 - 00457344 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-01 18:59 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\tracing
2015-04-01 18:59 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-04-01 18:54 - 2010-03-08 18:14 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-01 17:29 - 2014-06-20 18:40 - 00000000 ____D () C:\Users\Steffen\AppData\Local\Adobe
2015-04-01 17:27 - 2012-07-27 16:04 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-01 17:27 - 2011-06-08 12:30 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-01 16:50 - 2014-05-08 19:09 - 00000000 ____D () C:\ProgramData\G Data
2015-03-31 10:48 - 2013-07-20 09:16 - 00000000 ____D () C:\Users\Steffen\AppData\Local\CrashDumps
2015-03-28 16:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2015-03-27 23:45 - 2013-03-08 13:01 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-03-27 23:45 - 2010-08-07 16:25 - 00000000 ____D () C:\Program Files\Brother
2015-03-27 23:21 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Globalization
2015-03-27 22:33 - 2014-07-22 18:17 - 00000000 ____D () C:\Users\Steffen\Downloads\Neuer Ordner
2015-03-27 22:18 - 2010-11-07 13:25 - 00498176 ___SH () C:\Users\Steffen\Documents\Thumbs.db
2015-03-27 22:11 - 2010-04-07 12:10 - 00000000 ____D () C:\Windows\Minidump
2015-03-27 21:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Web
2015-03-27 19:55 - 2012-09-03 08:32 - 00000000 ____D () C:\Program Files\AntiBrowserSpy
2015-03-27 19:21 - 2014-05-08 20:11 - 00001558 _____ () C:\Users\Steffen\AppData\Roaming\gdscan.log
2015-03-27 19:19 - 2014-05-08 20:10 - 00000000 ____D () C:\Program Files\G Data
2015-03-27 18:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\spool
2015-03-27 18:34 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns
2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\winevt
2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\SMI
2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\MUI
2015-03-27 18:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\com
2015-03-27 18:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\wfp
2015-03-27 18:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\registration
2015-03-09 22:23 - 2012-12-17 18:51 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-03-09 17:48 - 2015-01-20 13:28 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird.bak
2015-03-09 16:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache

==================== Files in the root of some directories =======

2012-05-23 17:35 - 2012-09-03 09:24 - 0000048 _____ () C:\Users\Steffen\AppData\Roaming\AcroIEHelpe.txt
2012-08-26 13:44 - 2012-09-03 10:06 - 0000017 _____ () C:\Users\Steffen\AppData\Roaming\blckdom.res
2014-05-08 20:11 - 2014-05-08 20:11 - 0000000 _____ () C:\Users\Steffen\AppData\Roaming\gdfw.log
2014-05-08 20:11 - 2015-03-27 19:21 - 0001558 _____ () C:\Users\Steffen\AppData\Roaming\gdscan.log
2012-05-23 17:35 - 2012-05-23 17:35 - 0000264 _____ () C:\Users\Steffen\AppData\Roaming\srvblck5.tmp
2014-10-20 17:22 - 2014-10-20 17:22 - 0004096 ____H () C:\Users\Steffen\AppData\Local\keyfile3.drm
2014-05-08 19:55 - 2014-09-13 15:31 - 0007597 _____ () C:\Users\Steffen\AppData\Local\Resmon.ResmonCfg
2012-09-03 08:55 - 2012-09-03 08:55 - 0017408 _____ () C:\Users\Steffen\AppData\Local\WebpageIcons.db
2012-01-03 18:00 - 2012-01-03 18:04 - 0000440 ____H () C:\ProgramData\UeBUrRTJiwSDHt
2012-01-03 18:09 - 2012-01-03 18:09 - 0000296 _____ () C:\ProgramData\~UeBUrRTJiwSDHt
2012-01-03 18:09 - 2012-01-03 18:09 - 0000200 _____ () C:\ProgramData\~UeBUrRTJiwSDHtr

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-19 11:19

==================== End Of Log ============================

--- --- ---

--- --- ---

[CODEFarbar Service Scanner Version: 17-01-2015
Ran by Steffen (administrator) on 04-04-2015 at 17:30:23
Running from "C:\Users\Steffen\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcore.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\system32\ipnathlp.dll => File is digitally signed
C:\Windows\system32\iphlpsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed

**** End of log ****][/CODE]

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c2c376178da9f446a553472203bee5ea
# engine=23232
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-04 03:25:06
# local_time=2015-04-04 05:25:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 7334 179792297 0 0
# scanned=154843
# found=15
# cleaned=0
# scan_time=5939
sh=4D1C2C7492C0440E48AE0FDBB063D3B8EF56833B ft=0 fh=0000000000000000 vn="Variante von Win32/SlowPCfighter evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\ReviverSoft\RegistryReviver\InstallCache\{E31E4E05-4B6B-42A5-8623-EB530F8147F5}\RegistryReviver.msi"
sh=EE3949825A01A1096B62D2E86C5681DCD30645AA ft=1 fh=c51a35c4d9d4afe9 vn="Variante von Win32/Rootkit.Kryptik.ZQ Trojaner" ac=I fn="C:\TDSSKiller_Quarantine\01.04.2015_16.34.59\necurs0000\svc0000\tsk0000.dta"
sh=4D1C2C7492C0440E48AE0FDBB063D3B8EF56833B ft=0 fh=0000000000000000 vn="Variante von Win32/SlowPCfighter evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\ReviverSoft\RegistryReviver\InstallCache\{E31E4E05-4B6B-42A5-8623-EB530F8147F5}\RegistryReviver.msi"
sh=FCBD7F701CE20F0636D4869F2F4BE10EF8015A57 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2012-0507.BN Trojaner" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\4f3c6100-2d1de6ed"
sh=B1DC9B3C8B778E2DB550EF962074D448CFC49203 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\42f0820f-2d98d74d"
sh=09760B2CC3FF87170AECEBADF313B11A617E168C ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\4807de8f-5877fdfe"
sh=2FEF80AF9BF14984D213AC86830AFE623B8F6BC7 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.PMN Trojaner" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\79a621a3-20d085d0"
sh=09AD3A232F5F012E1D5A490E7FCE11322BF39463 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\754badab-720ac908"
sh=446B3E0631522AACAA319E458E82B7F26A637732 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2012-1723.AU Trojaner" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\544d7ad-77fa544c"
sh=09AD3A232F5F012E1D5A490E7FCE11322BF39463 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\6b55ee6f-497e47be"
sh=5EB3DCEE7DECA4E5C72210E70182571B268333AF ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\5755f831-6f4ae229"
sh=09AD3A232F5F012E1D5A490E7FCE11322BF39463 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\78b4bac5-1d716fab"
sh=5EB3DCEE7DECA4E5C72210E70182571B268333AF ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\308d3875-521c1338"
sh=D791CA0BD55B6E1BA018899D4E77EDDCB6C724D6 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2012-0507.F Trojaner" ac=I fn="C:\Users\Steffen\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\4bb5e9f8-1af91101"
sh=C931DC55F83C4CE59AE3521654C2E496EEC2FB6C ft=1 fh=28e00014f0a1b5ae vn="Variante von Win32/AdInstaller evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Steffen\Downloads\Allin1Convert.exe"

deeprybka · 04.04.2015, 16:44

Gut!

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

ATTFilter

EmptyTemp:

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Gibts noch irgendwelche Probleme?

Steffen 70 · 04.04.2015, 17:13

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015
Ran by Steffen at 2015-04-04 18:06:27 Run:2
Running from C:\Users\Steffen\Downloads
Loaded Profiles: Steffen (Available profiles: Steffen & UpdatusUser)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
EmptyTemp:
         
*****************

EmptyTemp: => Removed 426.8 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 18:07:05 ====

Hallo Jürgen,

läuft wieder alles normal,sind wir jetzt durch?

Viele Grüße

Steffen

deeprybka · 04.04.2015, 17:18

Ja!

Bitte Java(TM) 6 Update 37 deinstallieren und mit der aktuellen Version ersetzen.

Cleanup:

Alle Logs gepostet? Ja! Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

>>clean<<
Wir haben es geschafft!

Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.

Wie kann ich mich in Zukunft besser schützen?

Tipps, Dos & Don'ts

Updates & Software

Beim Betriebsystem Windows die automatischen Updates aktivieren.

Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:
Browser
Java
Flash-Player & PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.

Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Firewall, Antivirus & Co.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. (Updatefunktion aktivieren!)
Meine Empfehlungen:
Kaspersky Antivirus
Emsisoft Anti-Malware
avast Free Antivirus
Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Cracks, Downloads & Co.

Neben unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.
Der Besuch dubioser Websites kann bereits Risiken bergen. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher und beliebter Weg um Malware zu verbreiten.
Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kann man nie sicher sein, ob auch wirklich drin ist, was drauf steht. (Trojanisches Pferd^^)

Auch virustotal.com ist Dein Freund! Lade dubiose oder unbekannte Dateien hoch, bevor Du diese startest oder installierst.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden zu verleiten, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).

Surfe daher mit Vorsicht und klicke mit Verstand.
Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von Dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo Deine Daten eingeben.
Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst Du von einem Deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und Du solltest nicht denselben Fehler machen.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.

Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:

Erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nicht

Plagegeister aller Art und deren Bekämpfung: G data blockiert , keine Systemwiederherstellung möglich , Taskmanager funktioniert nicht