Trojaner-Board - Offen Telekom Abuse Team

Hallo Schrauber,
vielen Dank für deine schnelle Antwort, hier die gewünschten .txt Files:
FRST
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-02-2015 01

Ran by Ronny (administrator) on RONNY-PC on 20-02-2015 22:52:07

Running from C:\Users\Ronny\Downloads

Loaded Profiles: Ronny (Available profiles: Ronny)

Platform: Microsoft Windows 8.1 Pro (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvwmi.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\stacsv.exe

(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\AEstSrv.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(NVIDIA) C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvwmi.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(TrueCrypt Foundation) C:\Program Files\TrueCrypt\TrueCrypt.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Bitdefender) C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe

(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

() H:\05_Tools\torchat-windows-0.9.9.553\bin\torchat.exe

() H:\05_Tools\torchat-windows-0.9.9.553\bin\torchat.exe

() H:\05_Tools\torchat-windows-0.9.9.553\bin\Tor\tor.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Windows\System32\ThumbnailExtractionHost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [488816 2011-01-04] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [442467 2008-07-02] (IDT, Inc.)

HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Run: [NVIDIA nTune] => C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe [81920 2007-09-04] (NVIDIA)

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5489944 2014-12-12] (Piriform Ltd)

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Run: [pdiface] => C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe [261984 2013-10-30] (Bitdefender)

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {1d3e3d2c-cd3f-11e3-97b3-002170b871a4} - "H:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {1eb9c41c-b727-11e3-9781-002170b871a4} - "G:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {22b84248-fdb2-11e3-97c9-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {2bc07355-770a-11e3-975a-002170b871a4} - "G:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {3409f44f-4bd0-11e3-971b-0016eae408aa} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {490eee48-4e0d-11e3-971c-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {58c8f203-4885-11e3-971a-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {58c908b1-4885-11e3-971a-002170b871a4} - "I:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {63388ec2-4fbc-11e3-971d-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {65e3ac35-f353-11e3-97c8-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {7b5a52d6-7719-11e3-975b-0016eae408aa} - "I:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {94c98766-431a-11e3-9716-806e6f6e6963} - "E:\Setup.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {9b8a2d68-4332-11e3-9718-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {9b8a2f2a-4332-11e3-9718-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {a9b7a72a-c188-11e3-9797-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {cd9925b5-155c-11e4-97d6-002170b871a4} - "H:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {cd992936-155c-11e4-97d6-002170b871a4} - "H:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {da0b8075-cb2a-11e3-97af-002170b871a4} - "F:\AutoRun.exe" 

Startup: C:\Users\Ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk

ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.wdr.de

SearchScopes: HKLM -> DefaultScope value is missing.

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKU\S-1-5-21-2443804570-283508326-906284146-1000 -> No Name - {41524553-2D53-5000-76A7-7A786E7484D7} -  No File

Toolbar: HKU\S-1-5-21-2443804570-283508326-906284146-1000 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -  No File

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Ronny\AppData\Roaming\Mozilla\Firefox\Profiles\gy1zzbbj.default

FF DefaultSearchEngine: Bing

FF SelectedSearchEngine: Bing

FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Extension: Garmin Communicator - C:\Users\Ronny\AppData\Roaming\Mozilla\Firefox\Profiles\gy1zzbbj.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-10-17]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AESTFilters; C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1679536 2014-11-11] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 nTuneService; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [131072 2007-09-04] (NVIDIA) [File not signed]

R2 NVWMI; C:\WINDOWS\system32\nvwmi.exe [1027872 2013-09-05] (NVIDIA Corporation)

R2 pdserv; C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe [1221384 2013-11-11] (Bitdefender)

S3 ScDeviceEnum; C:\WINDOWS\System32\ScDeviceEnum.dll [105472 2013-08-22] (Microsoft Corporation)

R2 STacSV; C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\STacSV.exe [221273 2008-07-02] (IDT, Inc.)

R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [288128 2014-09-22] (Microsoft Corporation)

S3 WEPHOSTSVC; C:\WINDOWS\system32\wephostsvc.dll [20992 2013-08-22] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [22192 2014-09-22] (Microsoft Corporation)

S3 workfolderssvc; C:\WINDOWS\system32\workfolderssvc.dll [1222144 2014-07-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 acpials; C:\WINDOWS\system32\DRIVERS\acpials.sys [7680 2013-09-30] (Microsoft Corporation)

R1 BasicRender; C:\WINDOWS\System32\drivers\BasicRender.sys [25600 2014-02-22] (Microsoft Corporation)

S3 FTDIBUS; C:\WINDOWS\system32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)

S3 GPIO; C:\WINDOWS\System32\drivers\iaiogpio.sys [22016 2013-07-23] (Intel Corporation)

S3 huawei_cdcacm; C:\WINDOWS\system32\DRIVERS\ew_jucdcacm.sys [90368 2011-02-25] (Huawei Technologies Co., Ltd.)

S3 huawei_cdcecm; C:\WINDOWS\system32\DRIVERS\ew_jucdcecm.sys [64384 2011-01-30] (Huawei Technologies Co., Ltd.)

S3 huawei_ext_ctrl; C:\WINDOWS\System32\drivers\ew_juextctrl.sys [26624 2011-01-30] (Huawei Technologies Co., Ltd.)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-20] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

R3 NETwNs32; C:\WINDOWS\system32\DRIVERS\NETwNs32.sys [7518208 2013-06-18] (Intel Corporation)

R3 NVR0Dev; C:\WINDOWS\nvoclock.sys [29696 2007-09-04] (NVidia Corp.) [File not signed]

R3 SensorsAlsDriver; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation)

S3 silabenm; C:\WINDOWS\system32\DRIVERS\silabenm.sys [47176 2013-03-06] (Silicon Laboratories)

S3 silabser; C:\WINDOWS\system32\DRIVERS\silabser.sys [63104 2013-03-06] (Silicon Laboratories)

S3 SIUSBXP; C:\WINDOWS\system32\drivers\SiUSBXp.sys [14848 2010-04-30] (Silicon Laboratories)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [84800 2014-09-22] (Microsoft Corporation)

R0 Wof; C:\WINDOWS\system32\Drivers\Wof.sys [138584 2014-03-13] (Microsoft Corporation)

R3 WUDFSensorLP; C:\WINDOWS\System32\drivers\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation)

R3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation)

S4 avc3; system32\DRIVERS\avc3.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-20 22:52 - 2015-02-20 22:52 - 00014703 _____ () C:\Users\Ronny\Downloads\FRST.txt

2015-02-20 22:51 - 2015-02-20 22:52 - 00000000 ____D () C:\FRST

2015-02-20 22:51 - 2015-02-20 22:51 - 01126400 _____ (Farbar) C:\Users\Ronny\Downloads\FRST.exe

2015-02-20 18:13 - 2015-02-20 18:13 - 00310897 _____ () C:\ProgramData\1424451964.bdinstall.bin

2015-02-20 18:10 - 2015-02-20 18:10 - 00050051 _____ () C:\ProgramData\1424452189.bdinstall.bin

2015-02-20 18:09 - 2015-02-20 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 60-Second Virus Scanner

2015-02-20 18:01 - 2015-02-20 18:01 - 00074952 _____ (BitDefender) C:\WINDOWS\system32\Drivers\bdvedisk.sys.upd

2015-02-20 17:54 - 2015-02-20 19:45 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-02-20 17:54 - 2015-02-20 17:54 - 00001078 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-02-20 17:54 - 2015-02-20 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-02-20 17:54 - 2015-02-20 17:54 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-02-20 17:54 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-02-20 17:54 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-02-20 17:54 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-02-20 17:53 - 2015-02-20 17:53 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Ronny\Downloads\mbam-setup-2.0.4.1028.exe

2015-02-20 17:32 - 2015-02-20 17:32 - 00000385 _____ () C:\WINDOWS\system32\user_gensett.xml

2015-02-20 17:31 - 2015-02-20 17:31 - 00000299 _____ () C:\WINDOWS\setupact.log

2015-02-20 17:31 - 2015-02-20 17:31 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf

2015-02-20 17:31 - 2015-02-20 17:31 - 00000000 ____D () C:\ProgramData\BDLogging

2015-02-20 17:31 - 2015-02-20 17:31 - 00000000 _____ () C:\WINDOWS\setuperr.log

2015-02-20 17:31 - 2014-12-02 16:37 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuiskin.dll

2015-02-20 17:31 - 2014-12-02 16:37 - 00066832 _____ (BitDefender SRL) C:\WINDOWS\system32\Drivers\bdsandbox.sys

2015-02-20 17:31 - 2014-12-02 13:37 - 00026624 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuh.dll

2015-02-20 17:31 - 2014-10-03 20:09 - 00244480 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avchv.sys

2015-02-20 17:31 - 2013-09-08 20:04 - 00019984 _____ (Bitdefender) C:\WINDOWS\system32\Drivers\bdelam.sys

2015-02-20 17:31 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\capicom.dll

2015-02-20 17:28 - 2015-02-20 18:10 - 00000000 ____D () C:\ProgramData\Bitdefender

2015-02-20 17:28 - 2015-02-20 18:09 - 00000000 ____D () C:\Program Files\Bitdefender

2015-02-20 17:27 - 2015-02-20 17:27 - 00000000 ____D () C:\Users\Ronny\AppData\Roaming\QuickScan

2015-02-20 17:26 - 2015-02-20 18:09 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender

2015-02-20 17:25 - 2015-02-20 17:25 - 02867648 _____ () C:\Users\Ronny\Downloads\bitdefender_antivirus.exe

2015-02-13 15:13 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-02-11 17:20 - 2015-01-19 19:36 - 01192552 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2015-02-11 17:20 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-02-11 17:20 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-02-11 17:20 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-02-11 17:20 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-02-11 17:20 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-02-11 17:20 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-02-11 17:20 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-02-11 17:20 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-02-11 17:20 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-02-11 17:20 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-02-11 17:20 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-02-11 17:20 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-02-11 17:20 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-02-11 17:20 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-02-11 17:20 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-02-11 17:20 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-02-11 17:20 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-02-11 17:20 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-02-11 17:20 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-02-11 17:19 - 2015-02-04 00:43 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll

2015-02-11 17:19 - 2015-02-04 00:08 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2015-02-11 17:19 - 2015-02-04 00:08 - 00325120 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2015-02-11 17:19 - 2015-02-03 00:11 - 00886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2015-02-11 17:19 - 2015-02-03 00:11 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2015-02-11 17:19 - 2015-02-03 00:11 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2015-02-11 17:19 - 2015-01-10 08:38 - 03550720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-02-11 17:19 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-02-11 17:18 - 2015-01-10 09:28 - 05769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-02-11 17:18 - 2015-01-10 09:28 - 01468408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-02-11 17:17 - 2015-01-15 23:37 - 00478776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-02-11 17:17 - 2015-01-15 23:37 - 00148288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-02-11 17:17 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-02-11 17:17 - 2014-12-09 00:11 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2015-02-11 17:17 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll

2015-02-11 17:17 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll

2015-02-11 17:17 - 2014-10-29 02:03 - 01117696 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-02-11 00:06 - 2015-02-11 00:06 - 00030208 _____ () C:\Users\Ronny\Downloads\pcwTreeBuilder.z.exe

2015-02-09 17:51 - 2015-02-20 22:16 - 01559212 _____ () C:\WINDOWS\WindowsUpdate.log

2015-02-08 22:54 - 2015-02-08 22:54 - 00000000 ____D () C:\Program Files\Common Files\Java

2015-01-27 20:58 - 2015-01-27 20:58 - 00001140 _____ () C:\Users\Ronny\Desktop\WinMD5.exe - Verknüpfung.lnk

2015-01-21 19:34 - 2007-04-29 05:12 - 00591872 _____ (www.winmd5.com) C:\Users\Ronny\Downloads\WinMD5.exe

2015-01-21 19:34 - 2007-03-30 06:49 - 00000568 _____ () C:\Users\Ronny\Downloads\Readme.txt

2015-01-21 19:34 - 2007-03-30 06:40 - 00004757 _____ () C:\Users\Ronny\Downloads\License.txt

2015-01-21 19:33 - 2015-01-21 19:33 - 00268376 _____ () C:\Users\Ronny\Downloads\winmd5free.zip

2015-01-21 19:32 - 2015-01-21 19:32 - 01057424 _____ (EFSoftware) C:\Users\Ronny\Downloads\EF_CheckSum_Manager_7.30_CB-DL-Manager [1].exe

2015-01-21 19:29 - 2015-01-21 19:29 - 00823792 _____ ( ) C:\Users\Ronny\Downloads\EF_CheckSum_Manager_7.30_CB-DL-Manager.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-20 22:18 - 2014-10-17 20:03 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-02-20 22:00 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-02-20 17:32 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2015-02-20 17:23 - 2014-10-17 20:03 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-20 17:23 - 2013-08-14 19:01 - 00000000 ___DO () C:\Users\Ronny\SkyDrive

2015-02-20 04:23 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Microsoft.NET

2015-02-19 19:13 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-02-19 00:25 - 2013-11-03 18:41 - 00117760 _____ () C:\Users\Ronny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-02-15 17:19 - 2013-03-29 09:57 - 00001551 _____ () C:\Users\Ronny\Desktop\CUG_deu.pdf - Verknüpfung.lnk

2015-02-15 10:13 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\rescache

2015-02-14 23:53 - 2013-11-02 09:53 - 00000000 ____D () C:\Users\Ronny\AppData\Roaming\vlc

2015-02-13 15:16 - 2013-08-22 09:05 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-02-13 15:04 - 2013-11-01 18:28 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-13 15:04 - 2013-08-22 08:23 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-02-13 15:04 - 2013-08-22 08:22 - 00473936 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-02-13 07:15 - 2013-08-22 07:13 - 01310720 ___SH () C:\WINDOWS\system32\config\BBI

2015-02-13 07:14 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\de-DE

2015-02-12 17:44 - 2013-11-15 17:20 - 00000000 ____D () C:\WINDOWS\system32\MRT

2015-02-12 17:41 - 2013-11-15 17:20 - 113756392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-02-12 17:39 - 2014-12-10 20:30 - 00000000 ____D () C:\WINDOWS\system32\appraiser

2015-02-12 17:39 - 2014-07-12 12:33 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel

2015-02-08 22:54 - 2014-10-25 09:09 - 00000000 ____D () C:\Program Files\Java

2015-02-08 22:54 - 2013-11-26 20:22 - 00000000 ____D () C:\ProgramData\Oracle

2015-02-08 22:53 - 2014-10-25 09:09 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe

2015-02-08 22:53 - 2014-10-25 09:09 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe

2015-02-08 22:53 - 2014-10-25 09:09 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe

2015-02-08 22:53 - 2014-10-25 09:09 - 00096680 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll

2015-02-08 22:53 - 2014-10-25 09:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-02-03 20:31 - 2014-06-13 06:15 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe

2015-02-03 20:31 - 2014-06-13 06:15 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

2015-01-31 22:07 - 2013-09-30 05:08 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-01-29 04:21 - 2013-11-01 18:35 - 00000000 ____D () C:\Users\Ronny
 

==================== Files in the root of some directories =======
 

2013-11-03 18:41 - 2015-02-19 00:25 - 0117760 _____ () C:\Users\Ronny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-04-18 22:20 - 2014-04-18 22:20 - 0007597 _____ () C:\Users\Ronny\AppData\Local\Resmon.ResmonCfg

2014-11-11 17:48 - 2014-11-11 17:53 - 0000000 _____ () C:\Users\Ronny\AppData\Local\{C4DE7E10-A4A8-4175-A632-7EFA7E16A862}

2015-02-20 18:13 - 2015-02-20 18:13 - 0310897 _____ () C:\ProgramData\1424451964.bdinstall.bin

2015-02-20 18:10 - 2015-02-20 18:10 - 0050051 _____ () C:\ProgramData\1424452189.bdinstall.bin

2013-12-03 18:56 - 2013-12-03 18:56 - 0000486 _____ () C:\ProgramData\GRFolder.ini

2013-12-03 18:56 - 2013-12-03 18:56 - 0000028 _____ () C:\ProgramData\GRGames.ini
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-14 02:25
 

==================== End Of Log ============================

--- --- ---

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-02-2015 01

Ran by Ronny at 2015-02-20 22:53:11

Running from C:\Users\Ronny\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

2.0 (HKLM\...\Free Video to GIF Converter_is1) (Version: 2.0 - www.video-gif-converter.com)

3GX (HKLM\...\{D0783152-6826-4FA7-93C3-1F0D53FD5460}) (Version: 3.03.2101 - ALIGN)

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )

Acala 3GP Movies Free 4.2.7 (HKLM\...\Acala 3GP Movies Free_is1) (Version:  - Acala Software)

Artisan (HKLM\...\Artisan) (Version: 0.6.0.0 - The Artisan Team)

Avidemux 2.5 (HKLM\...\Avidemux 2.5) (Version: 2.5.3.0 - )

Bitdefender 60-Second Virus Scanner (HKLM\...\{CCEA2053-D975-4E38-AC09-4D5E6DAC6B6F}) (Version: 1.0.3.76 - Bitdefender)

CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)

ClearView (HKLM\...\{A95AF23D-1875-41E7-B684-ECA583126755}) (Version: 5.3.4 - SVKSystems)

DataExplorer (HKLM\...\DataExplorer) (Version: 3.1.7 - )

Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1207.101.108 - ALPS ELECTRIC CO., LTD.)

FlashGet(Jetcar) 1.81 (HKLM\...\FlashGet(Jetcar) 1.81) (Version:  - )

Garmin City Navigator Europe NT 2008 (HKLM\...\{EEC8205A-E3DE-4C00-B60C-48E3B9B58B13}) (Version: 10.0.0.0 - Garmin Ltd or its subsidiaries)

Garmin Communicator Plugin (HKLM\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)

GOM Player (HKLM\...\GOM Player) (Version: 2.2.64.5211 - Gretech Corporation)

Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden

HELI-X 5.0 Demo (HKLM\...\B0C9899E-7D17-46E6-9496-8333A1F8C441_is1) (Version:  - Michael Schreiner)

Image Grabber II (HKLM\...\Image Grabber II) (Version:  - )

IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan)

Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

JLC 7.0.0.6 (HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\b87250e759877692) (Version: 7.0.0.6 - R2Prototyping)

LogView V2 (HKLM\...\LogView V2) (Version: LogView V2 2 - LogView.info - D.Schmidt / H.Hemmecke)

LogView V2 2 (HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\LogView V2 2) (Version: 2 - LogView.info)

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft Office Professional 2013 - de-de (HKLM\...\ProfessionalRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft SkyDrive (HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

NVIDIA 3D Vision Treiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.02 - NVIDIA Corporation)

NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)

NVIDIA nTune (HKLM\...\InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}) (Version: 1.00.0000 - NVIDIA Corporation)

NVIDIA nView 140.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 140.62 - NVIDIA Corporation)

NVIDIA WMI 2.14.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.14.0 - NVIDIA Corporation)

Office 15 Click-to-Run Extensibility Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Pazera Free MOV to AVI Converter 1.6 (HKLM\...\{770103E9-E1C3-48C9-812B-2982C7070575}_is1) (Version: 1.6 - Pazera Jacek)

pdfsam (HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\pdfsam) (Version: 1.1.1 - )

Recuva (HKLM\...\Recuva) (Version: 1.38 - Piriform)

SDFormatter (HKLM\...\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)

Shape Collage (HKLM\...\ShapeCollage) (Version:  - Shape Collage Inc.)

Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (HKLM\...\SLABCOMM&10C4&EA60) (Version:  - )

Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista (HKLM\...\{1F50FB31-0092-4D78-A85E-F22B2502C40E}) (Version: 5.10 - Silicon Laboratories, Inc.)

SM UniSens-E Tool (HKLM\...\{D35352AE-7C1E-470B-9AAE-A13BAA13841B}) (Version: 1.0.4.1 - SM-Modellbau)

TeamViewer 10 (HKLM\...\TeamViewer) (Version: 10.0.36897 - TeamViewer)

TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)

TSDoctor (HKLM\...\{83CC8459-F239-4409-896C-17034A70EC5F}) (Version: 1.2.104 - Cypheros)

TsRemux 0.23.2 (HKLM\...\TsRemux_is1) (Version:  - )

Video Converter Packages (HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Video Converter Packages) (Version:  - ) <==== ATTENTION

VideoConverter (HKLM\...\VideoConverter) (Version: ${VERSION} - )

VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

VStabi 5.3.4 (HKLM\...\VStabi 5.3_is1) (Version: 5.3.4 - VStabi Support Center)

WinRAR 5.10 Beta 4 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2443804570-283508326-906284146-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Ronny\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\FileSyncApi.dll (Microsoft Corporation)
 

==================== Restore Points  =========================
 

28-01-2015 16:47:40 Windows Update

06-02-2015 20:13:09 Windows Update

12-02-2015 17:39:02 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 07:13 - 2013-08-22 07:13 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {3BA7A4B2-0A3B-4721-AF4B-262B54503210} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX86\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

Task: {8158EF83-886C-46C4-B930-C21A0E8F2416} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-12] (Microsoft Corporation)

Task: {8B14EB57-99F7-4A9C-9092-B0D6BF1A1C2F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)

Task: {B1EA2E5A-E1CB-410C-8589-1273E4203F3F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)

Task: {C3CB5B0B-1EF3-483B-8888-6CCAD53953CE} - System32\Tasks\Microsoft Office 15 Sync Maintenance for RONNY-PC-Ronny Ronny-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-11-04] (Microsoft Corporation)

Task: {F96634F1-9301-49ED-B0F3-FBDF8DE3D92B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2014-03-21 07:29 - 2014-05-20 02:11 - 00080040 _____ () C:\Program Files\Microsoft Office 15\ClientX86\ApiClient.dll

2014-06-10 21:05 - 2014-11-15 10:49 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll

2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-01-06 11:27 - 2012-09-15 16:05 - 06329392 _____ () H:\05_Tools\torchat-windows-0.9.9.553\bin\torchat.exe

2015-02-20 22:46 - 2015-02-20 22:46 - 00033792 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\win32api.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00053248 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\pywintypes27.dll

2015-02-20 22:46 - 2015-02-20 22:46 - 00033280 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\_ctypes.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00160256 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\wx._core_.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00110080 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\wx._gdi_.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00084480 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\wx._windows_.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00117760 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\wx._controls_.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00095744 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\wx._misc_.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00020480 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\_socket.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00270336 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\_ssl.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00107008 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\_hashlib.pyd

2015-02-20 22:46 - 2015-02-20 22:46 - 00182272 _____ () C:\Users\Ronny\AppData\Local\Temp\_MEI46882\unicodedata.pyd

2015-01-06 11:27 - 2012-09-15 16:05 - 03184654 _____ () H:\05_Tools\torchat-windows-0.9.9.553\bin\Tor\tor.exe
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\TEMP:69E87FA2

AlternateDataStreams: C:\ProgramData\TEMP:862BDB1A

AlternateDataStreams: C:\Users\Ronny\SkyDrive:ms-properties

AlternateDataStreams: C:\Users\Ronny\Downloads\mbam-setup-2.0.4.1028.exe:BDU
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg

DNS Servers: 192.168.178.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\StartupApproved\StartupFolder: => "Hardcopy.LNK"

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-2443804570-283508326-906284146-500 - Administrator - Disabled)

Gast (S-1-5-21-2443804570-283508326-906284146-501 - Limited - Disabled)

Ronny (S-1-5-21-2443804570-283508326-906284146-1000 - Administrator - Enabled) => C:\Users\Ronny
 

==================== Faulty Device Manager Devices =============
 

Name: Broadcom USH

Description: Broadcom USH

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/20/2015 04:24:50 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/20/2015 04:24:50 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/20/2015 04:24:50 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/19/2015 10:29:41 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: f40
 

Startzeit: 01d04c8a511414f8
 

Endzeit: 4294967295
 

Anwendungspfad: C:\WINDOWS\system32\backgroundTaskHost.exe
 

Berichts-ID: 48ea367e-b87e-11e4-98e4-002170b871a4
 

Vollständiger Name des fehlerhaften Pakets: 12199Asparion.AsparionClock_3.5.1.53_neutral__f89vgcf3qm37t
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
 

Error: (02/19/2015 06:49:11 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/19/2015 06:49:11 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/19/2015 06:49:11 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/19/2015 06:46:30 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/19/2015 06:46:30 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (02/19/2015 06:46:30 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
 

System errors:

=============

Error: (02/20/2015 06:06:48 PM) (Source: Service Control Manager) (EventID: 7006) (User: )

Description: Der Aufruf "ScRegSetValueExW" ist für "DeleteFlag" aufgrund folgenden Fehlers fehlgeschlagen: 

%%5
 

Error: (02/20/2015 05:03:51 PM) (Source: WudfUsbccidDriver) (EventID: 11) (User: NT-AUTORITÄT)

Description: 0x810x10x10xfb0x00x0
 

Error: (02/20/2015 06:14:10 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.
 

Error: (02/20/2015 05:12:59 AM) (Source: disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 

Error: (02/20/2015 03:32:19 AM) (Source: disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 

Error: (02/19/2015 07:18:07 PM) (Source: disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 

Error: (02/19/2015 05:54:07 PM) (Source: WudfUsbccidDriver) (EventID: 11) (User: NT-AUTORITÄT)

Description: 0x810x10x10xfb0x00x0
 

Error: (02/19/2015 06:10:52 AM) (Source: WudfUsbccidDriver) (EventID: 11) (User: NT-AUTORITÄT)

Description: 0x810x10x10xfb0x00x0
 

Error: (02/18/2015 05:15:46 PM) (Source: WudfUsbccidDriver) (EventID: 11) (User: NT-AUTORITÄT)

Description: 0x810x10x10xfb0x00x0
 

Error: (02/18/2015 05:14:30 AM) (Source: disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (02/20/2015 04:24:50 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvcplUIR.dll
 

Error: (02/20/2015 04:24:50 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvExpBar.dll
 

Error: (02/20/2015 04:24:50 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvCplUI.exe
 

Error: (02/19/2015 10:29:41 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: backgroundTaskHost.exe6.3.9600.16384f4001d04c8a511414f84294967295C:\WINDOWS\system32\backgroundTaskHost.exe48ea367e-b87e-11e4-98e4-002170b871a412199Asparion.AsparionClock_3.5.1.53_neutral__f89vgcf3qm37tApp
 

Error: (02/19/2015 06:49:11 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvcplUIR.dll
 

Error: (02/19/2015 06:49:11 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvExpBar.dll
 

Error: (02/19/2015 06:49:11 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvCplUI.exe
 

Error: (02/19/2015 06:46:30 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvcplUIR.dll
 

Error: (02/19/2015 06:46:30 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvExpBar.dll
 

Error: (02/19/2015 06:46:30 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="AMD64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\NVIDIA nTune Performance Application\Win64\nvCplUI.exe
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz

Percentage of memory in use: 37%

Total physical RAM: 3571.9 MB

Available physical RAM: 2220.82 MB

Total Pagefile: 4211.9 MB

Available Pagefile: 2592.91 MB

Total Virtual: 2047.88 MB

Available Virtual: 1862.3 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:61.03 GB) (Free:17.13 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Daten) (Fixed) (Total:87.89 GB) (Free:55.4 GB) NTFS

Drive h: () (Fixed) (Total:1397.23 GB) (Free:350.8 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149.1 GB) (Disk ID: D8000000)

Partition 1: (Not Active) - (Size=133 MB) - (Type=DE)

Partition 2: (Active) - (Size=61 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=87.9 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 1397.2 GB) (Disk ID: A25D172F)

Partition 1: (Not Active) - (Size=1397.2 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

log.txt

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=dfa5b87e204f7042aaeb67744ca07a61

# engine=22587

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-02-22 09:57:01

# local_time=2015-02-22 10:57:01 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.2.9200 NT 

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 29449 14903331 0 0

# scanned=184730

# found=51

# cleaned=0

# scan_time=4612

sh=6F3A3B433459E6773C9FBE8CFB154DB6534EFA86 ft=1 fh=60bff0ff01dbe663 vn="Variante von Win32/InstallCore.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\VideoConverter.exe.vir"

sh=ED65C41C73ACB12239FD4D68F84057F6B0CBB9B6 ft=1 fh=a6514df833bf49fb vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\lrrot.dll.vir"

sh=ACBE58D6D92A2CA08436016FC557AE8A624D5348 ft=1 fh=5a75b1409dbb2f5a vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyService.dll.vir"

sh=8CE050971B99FA7810D9B01B72062C522E10505C ft=1 fh=9c2b38b4d477e173 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll.vir"

sh=49B44A57605BB86188BC4462AD5C2F7475917639 ft=1 fh=05ee54c9c3173dea vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\sppsm.dll.vir"

sh=80CAFBFBE2CA34EBDD2315EFE7429179B0C6AD35 ft=1 fh=90543bd945ae265b vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\spusm.dll.vir"

sh=4BF384E514CA7D79B9B45D9F406B80C35D6EB9A0 ft=1 fh=59da264755303e03 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\srbs.dll.vir"

sh=CB59DFB167BFCCFFB83183FD3FA898034E1AB63A ft=1 fh=96385afa5fe0d75b vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\srbu.dll.vir"

sh=A32D62E892843C05A0E1A36D978A9F3DD48846F5 ft=1 fh=c1a83d881ca4488b vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\srpt.dll.vir"

sh=D93B42CCC57AE1859A4685A809D411EEE26BE0C6 ft=1 fh=75f2c7ee1c9b32f1 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\srptc.dll.vir"

sh=8B5AA8AC3D8FC9F99B7BF83D6DCEFDD2BFF089BE ft=1 fh=e3345957ccca0c87 vn="Variante von Win32/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\Resources\ntdis_32.dll.vir"

sh=104B1C8C21DC480E1D0C7BC010F76FB635FF85AA ft=1 fh=924eccf4bdcb3f50 vn="Variante von Win64/Toolbar.Linkury.A.gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\LPT\Resources\ntdis_64.dll.vir"

sh=ED65C41C73ACB12239FD4D68F84057F6B0CBB9B6 ft=1 fh=a6514df833bf49fb vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\lrrot.dll.vir"

sh=391D034C6EF23E9C15706CEE2245169F53B0B660 ft=1 fh=873707a588ca8511 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll.vir"

sh=5AB8DBD05DE709B9FFB25056C2734F02E37B27A8 ft=1 fh=7c4fbf427ba381f6 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll.vir"

sh=DF8FF9DE611EF7B2ADB82BCA8556C03CECDA8453 ft=1 fh=a28e7dac480f5332 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll.vir"

sh=6C56507F34C71F12A7F92D91760BC9F140480830 ft=1 fh=7e361336dcc7e3c9 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll.vir"

sh=D712B73602CC489616FAC4ECD8DA8EC2B9CF9496 ft=1 fh=dd4cedfed51f1d18 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll.vir"

sh=ACBE58D6D92A2CA08436016FC557AE8A624D5348 ft=1 fh=5a75b1409dbb2f5a vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.Monetization.Proxy.ProxyService.dll.vir"

sh=8CE050971B99FA7810D9B01B72062C522E10505C ft=1 fh=9c2b38b4d477e173 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll.vir"

sh=06E4DFA138D6522C404B5AB0ECDCC2E21703B92C ft=1 fh=cfd402a2bd0317b0 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll.vir"

sh=06E4DFA138D6522C404B5AB0ECDCC2E21703B92C ft=1 fh=cfd402a2bd0317b0 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll.vir"

sh=998764836CBC3560F793ADE9A7C3C1405D00BEC6 ft=1 fh=bbe0ad0db99c4fb6 vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"

sh=998764836CBC3560F793ADE9A7C3C1405D00BEC6 ft=1 fh=bbe0ad0db99c4fb6 vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"

sh=20FCD65403A550E6A185927FEA34B4ECC434D9F6 ft=1 fh=e800e4f6819a5c0a vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\smta.dll.vir"

sh=E2AD662A4073D06733B8E0C72F8DDCCF5C1562D4 ft=1 fh=58e3eb413d4c6de1 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\smtu.dll.vir"

sh=A39508C8AC3135702D10F7A7E0953F5EF163288B ft=1 fh=fceedcdafd969011 vn="Variante von MSIL/Toolbar.Linkury.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\SnapDo.exe.vir"

sh=D854B083293E9B50B6375FA7FCBD124A3CDC7A59 ft=1 fh=eeaec87c62b5c22d vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\spbe.dll.vir"

sh=FDF6D15982D2747CE3D8EDBEC8F04C61E5524EF1 ft=1 fh=d803b32229b0bebd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\spbl.dll.vir"

sh=49B44A57605BB86188BC4462AD5C2F7475917639 ft=1 fh=05ee54c9c3173dea vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\sppsm.dll.vir"

sh=80CAFBFBE2CA34EBDD2315EFE7429179B0C6AD35 ft=1 fh=90543bd945ae265b vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\spusm.dll.vir"

sh=C95073A2BB4BF29801DA47772D50F4EC110FB9F7 ft=1 fh=fce07d86c47f786e vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\srau.dll.vir"

sh=4BF384E514CA7D79B9B45D9F406B80C35D6EB9A0 ft=1 fh=59da264755303e03 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\srbs.dll.vir"

sh=CB59DFB167BFCCFFB83183FD3FA898034E1AB63A ft=1 fh=96385afa5fe0d75b vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\srbu.dll.vir"

sh=C79099DE5503D08CA1C5E6A0309172487C5A5D6A ft=1 fh=ca48d55b7c1876a9 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\srpu.dll.vir"

sh=D8526969FF65DF7B7BF3276BE3DFF9E62B68AF49 ft=1 fh=db26de03d3a27910 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"

sh=561249B34D97B2B2BC46BCD6123F67137BE6E30F ft=1 fh=958ee95189059e15 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"

sh=C4572103452CB2E459912D1C5F12F59066A50FA9 ft=1 fh=d0c221068451f4c6 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"

sh=8AF0B8395CA2B561C93D4704838FD4549F6D59DB ft=1 fh=7c4e70a6fcfc43b7 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"

sh=2B6CFCD7C81463D2544FDE96AD85BF6AA873379D ft=1 fh=6950e4890066eaa5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"

sh=6EB1CCC67427C21F93B928D2FFDFD38C13637D68 ft=1 fh=34833efd3fe0ff41 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"

sh=C9A7CA3C06A8BD159C76E82BE3C0129DFAF370E2 ft=1 fh=c647e824ec6e2f74 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_30.dll.vir"

sh=31CE21FE36C11E107A6E315EFE1875743809B4CC ft=1 fh=48abcfa6ce4a4014 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"

sh=2DAAB83B0439BC76845E58F3F7DDB84EE8E210C4 ft=1 fh=855a37aa5dbeb36f vn="Win32/InstallCore.PC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Roaming\1H1Q\Video Converter Packages\uninstaller.exe.vir"

sh=B563BEC7EC0608AB8EBC51C5E228C9270DAC0A09 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ronny\AppData\Roaming\Mozilla\Firefox\Profiles\gy1zzbbj.default\Extensions\39ed7c16-185d-4f88-b976-666d4928ba01@fe4550c1-7a4f-4a62-ad1c-45e0afdf81a4.com\extensionData\plugins\91.js.vir"

sh=CBCC1E6CB927BD3952159335198197F8F67536B6 ft=1 fh=bb7c8298b4ec4cef vn="Variante von Win32/MaxPCsecure evtl. unerwünschte Anwendung" ac=I fn="C:\Desktop\20130110\Maxspywaredetector.exe"

sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{DDF029A7-698C-4969-AB82-21AE06130B51}\Custom.dll"

sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{DDF029A7-698C-4969-AB82-21AE06130B51}\Custom.dll"

sh=C06F101D9B9F237C6AB6CDAECC7C7B604EAADE39 ft=1 fh=de54c1317f028c4f vn="Variante von Win32/InstallCore.UF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ronny\Downloads\EF_CheckSum_Manager_7.30_CB-DL-Manager.exe"

sh=CBCC1E6CB927BD3952159335198197F8F67536B6 ft=1 fh=bb7c8298b4ec4cef vn="Variante von Win32/MaxPCsecure evtl. unerwünschte Anwendung" ac=I fn="D:\Eigene Dateien\Privat\PC\Desktop\20130110\Maxspywaredetector.exe"

sh=CBCC1E6CB927BD3952159335198197F8F67536B6 ft=1 fh=bb7c8298b4ec4cef vn="Variante von Win32/MaxPCsecure evtl. unerwünschte Anwendung" ac=I fn="D:\Eigene Dateien\Privat\PC\Desktop\20130119\Maxspywaredetector.exe"

checkup.txt

Code:

 Results of screen317's Security Check version 0.99.96  

   x86 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Windows Defender   

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 Spybot - Search & Destroy 

 CCleaner     

 Java 8 Update 31  

 Java version 32-bit out of Date! 

  Java 64-bit 8 Update 31  
 ````````Process Check: objlist.exe by Laurent````````  

 Windows Defender MSMpEng.exe 

 Spybot Teatimer.exe is disabled! 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C::  
 ````````````````````End of Log``````````````````````

FRST.txt

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-02-2015 01

Ran by Ronny (administrator) on RONNY-PC on 22-02-2015 11:04:02

Running from C:\Users\Ronny\Downloads

Loaded Profiles: Ronny (Available profiles: Ronny)

Platform: Microsoft Windows 8.1 Pro (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvwmi.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\stacsv.exe

(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\AEstSrv.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(NVIDIA) C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvwmi.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

() C:\Users\Ronny\Desktop\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x86__8wekyb3d8bbwe\livecomm.exe

(Microsoft Corporation) C:\Windows\System32\RuntimeBroker.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\ThumbnailExtractionHost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [488816 2011-01-04] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [442467 2008-07-02] (IDT, Inc.)

HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).

HKLM\...\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Run: [NVIDIA nTune] => C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe [81920 2007-09-04] (NVIDIA)

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5489944 2014-12-12] (Piriform Ltd)

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\Run: [pdiface] => C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe -noshow

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {1d3e3d2c-cd3f-11e3-97b3-002170b871a4} - "H:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {1eb9c41c-b727-11e3-9781-002170b871a4} - "G:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {22b84248-fdb2-11e3-97c9-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {2bc07355-770a-11e3-975a-002170b871a4} - "G:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {3409f44f-4bd0-11e3-971b-0016eae408aa} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {490eee48-4e0d-11e3-971c-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {58c8f203-4885-11e3-971a-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {58c908b1-4885-11e3-971a-002170b871a4} - "I:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {63388ec2-4fbc-11e3-971d-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {65e3ac35-f353-11e3-97c8-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {7b5a52d6-7719-11e3-975b-0016eae408aa} - "I:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {94c98766-431a-11e3-9716-806e6f6e6963} - "E:\Setup.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {9b8a2d68-4332-11e3-9718-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {9b8a2f2a-4332-11e3-9718-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {a9b7a72a-c188-11e3-9797-002170b871a4} - "F:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {cd9925b5-155c-11e4-97d6-002170b871a4} - "H:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {cd992936-155c-11e4-97d6-002170b871a4} - "H:\AutoRun.exe" 

HKU\S-1-5-21-2443804570-283508326-906284146-1000\...\MountPoints2: {da0b8075-cb2a-11e3-97af-002170b871a4} - "F:\AutoRun.exe" 

Startup: C:\Users\Ronny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk

ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

BootExecute: autocheck autochk * sdnclean.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/

HKU\S-1-5-21-2443804570-283508326-906284146-1000\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.wdr.de

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKU\S-1-5-21-2443804570-283508326-906284146-1000 -> No Name - {41524553-2D53-5000-76A7-7A786E7484D7} -  No File

Toolbar: HKU\S-1-5-21-2443804570-283508326-906284146-1000 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -  No File

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Ronny\AppData\Roaming\Mozilla\Firefox\Profiles\gy1zzbbj.default

FF DefaultSearchEngine: Bing

FF SelectedSearchEngine: Bing

FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Extension: Garmin Communicator - C:\Users\Ronny\AppData\Roaming\Mozilla\Firefox\Profiles\gy1zzbbj.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-10-17]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AESTFilters; C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1840304 2015-01-13] (Microsoft Corporation)

S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 nTuneService; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [131072 2007-09-04] (NVIDIA) [File not signed]

R2 NVWMI; C:\WINDOWS\system32\nvwmi.exe [1027872 2013-09-05] (NVIDIA Corporation)

S3 ScDeviceEnum; C:\WINDOWS\System32\ScDeviceEnum.dll [105472 2013-08-22] (Microsoft Corporation)

R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

R2 STacSV; C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_x86_41e41214c1c8e236\STacSV.exe [221273 2008-07-02] (IDT, Inc.)

R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [288128 2014-09-22] (Microsoft Corporation)

S3 WEPHOSTSVC; C:\WINDOWS\system32\wephostsvc.dll [20992 2013-08-22] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [22192 2014-09-22] (Microsoft Corporation)

S3 workfolderssvc; C:\WINDOWS\system32\workfolderssvc.dll [1222144 2014-07-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 acpials; C:\WINDOWS\system32\DRIVERS\acpials.sys [7680 2013-09-30] (Microsoft Corporation)

R1 BasicRender; C:\WINDOWS\System32\drivers\BasicRender.sys [25600 2014-02-22] (Microsoft Corporation)

S3 FTDIBUS; C:\WINDOWS\system32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)

S3 GPIO; C:\WINDOWS\System32\drivers\iaiogpio.sys [22016 2013-07-23] (Intel Corporation)

S3 huawei_cdcacm; C:\WINDOWS\system32\DRIVERS\ew_jucdcacm.sys [90368 2011-02-25] (Huawei Technologies Co., Ltd.)

S3 huawei_cdcecm; C:\WINDOWS\system32\DRIVERS\ew_jucdcecm.sys [64384 2011-01-30] (Huawei Technologies Co., Ltd.)

S3 huawei_ext_ctrl; C:\WINDOWS\System32\drivers\ew_juextctrl.sys [26624 2011-01-30] (Huawei Technologies Co., Ltd.)

S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

R3 NETwNs32; C:\WINDOWS\system32\DRIVERS\NETwNs32.sys [7518208 2013-06-18] (Intel Corporation)

R3 NVR0Dev; C:\WINDOWS\nvoclock.sys [29696 2007-09-04] (NVidia Corp.) [File not signed]

R3 SensorsAlsDriver; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation)

S3 silabenm; C:\WINDOWS\system32\DRIVERS\silabenm.sys [47176 2013-03-06] (Silicon Laboratories)

S3 silabser; C:\WINDOWS\system32\DRIVERS\silabser.sys [63104 2013-03-06] (Silicon Laboratories)

S3 SIUSBXP; C:\WINDOWS\system32\drivers\SiUSBXp.sys [14848 2010-04-30] (Silicon Laboratories)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [84800 2014-09-22] (Microsoft Corporation)

R0 Wof; C:\WINDOWS\system32\Drivers\Wof.sys [138584 2014-03-13] (Microsoft Corporation)

R3 WUDFSensorLP; C:\WINDOWS\System32\drivers\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation)

R3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-22 11:00 - 2015-02-22 11:00 - 00852594 _____ () C:\Users\Ronny\Desktop\SecurityCheck.exe

2015-02-22 09:37 - 2015-02-22 09:37 - 02347384 _____ (ESET) C:\Users\Ronny\Desktop\esetsmartinstaller_deu.exe

2015-02-22 09:37 - 2015-02-22 09:37 - 00000000 ____D () C:\Program Files\ESET

2015-02-21 21:38 - 2015-02-21 21:38 - 00005342 _____ () C:\WINDOWS\system32\PerfStringBackup.TMP

2015-02-21 17:57 - 2015-02-21 17:57 - 00029051 _____ () C:\Users\Ronny\Downloads\FRST_20150221_1757.txt

2015-02-21 17:51 - 2015-02-21 17:51 - 00000833 _____ () C:\Users\Ronny\Desktop\JRT.txt

2015-02-21 17:49 - 2015-02-21 17:49 - 01388274 _____ (Thisisu) C:\Users\Ronny\Downloads\JRT (1).exe

2015-02-21 17:31 - 2015-02-21 17:31 - 02126848 _____ () C:\Users\Ronny\Downloads\AdwCleaner_4.111.exe

2015-02-21 14:31 - 2015-02-21 14:31 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ronny\Downloads\revosetup95.exe

2015-02-21 14:31 - 2015-02-21 14:31 - 00001244 _____ () C:\Users\Ronny\Desktop\Revo Uninstaller.lnk

2015-02-21 14:31 - 2015-02-21 14:31 - 00000000 ____D () C:\Program Files\VS Revo Group

2015-02-21 13:46 - 2015-02-21 14:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2015-02-21 13:46 - 2015-02-21 13:47 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2

2015-02-21 13:46 - 2015-02-21 13:46 - 00002149 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2015-02-21 13:46 - 2015-02-21 13:46 - 00002137 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2015-02-21 13:46 - 2015-02-21 13:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2015-02-21 13:46 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean.exe

2015-02-21 13:44 - 2015-02-21 13:45 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Ronny\Downloads\spybot-2.4.exe

2015-02-21 12:06 - 2015-02-21 12:06 - 00381752 _____ () C:\WINDOWS\Minidump\022115-40031-01.dmp

2015-02-21 12:06 - 2015-02-21 12:06 - 00017500 _____ () C:\WINDOWS\PFRO.log

2015-02-21 11:15 - 2015-02-21 11:15 - 00032616 _____ () C:\ProgramData\1424513664.bdinstall.bin

2015-02-20 22:53 - 2015-02-20 22:54 - 00026860 _____ () C:\Users\Ronny\Downloads\Addition.txt

2015-02-20 22:52 - 2015-02-22 11:04 - 00015151 _____ () C:\Users\Ronny\Downloads\FRST.txt

2015-02-20 22:51 - 2015-02-22 11:04 - 00000000 ____D () C:\FRST

2015-02-20 22:51 - 2015-02-20 22:51 - 01126400 _____ (Farbar) C:\Users\Ronny\Downloads\FRST.exe

2015-02-20 18:13 - 2015-02-20 18:13 - 00310897 _____ () C:\ProgramData\1424451964.bdinstall.bin

2015-02-20 18:10 - 2015-02-20 18:10 - 00050051 _____ () C:\ProgramData\1424452189.bdinstall.bin

2015-02-20 17:54 - 2015-02-21 17:46 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-02-20 17:54 - 2015-02-20 17:54 - 00001078 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-02-20 17:54 - 2015-02-20 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-02-20 17:54 - 2015-02-20 17:54 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-02-20 17:54 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-02-20 17:54 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-02-20 17:54 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-02-20 17:53 - 2015-02-20 17:53 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Ronny\Downloads\mbam-setup-2.0.4.1028.exe

2015-02-20 17:32 - 2015-02-20 17:32 - 00000385 _____ () C:\WINDOWS\system32\user_gensett.xml

2015-02-20 17:31 - 2015-02-21 17:39 - 00001326 _____ () C:\WINDOWS\setupact.log

2015-02-20 17:31 - 2015-02-20 17:31 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf

2015-02-20 17:31 - 2015-02-20 17:31 - 00000000 ____D () C:\ProgramData\BDLogging

2015-02-20 17:31 - 2015-02-20 17:31 - 00000000 _____ () C:\WINDOWS\setuperr.log

2015-02-20 17:31 - 2014-12-02 16:37 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuiskin.dll

2015-02-20 17:31 - 2014-12-02 13:37 - 00026624 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuh.dll

2015-02-20 17:31 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\capicom.dll

2015-02-20 17:28 - 2015-02-21 12:06 - 00000000 ____D () C:\Program Files\Bitdefender

2015-02-20 17:28 - 2015-02-20 18:10 - 00000000 ____D () C:\ProgramData\Bitdefender

2015-02-20 17:27 - 2015-02-20 17:27 - 00000000 ____D () C:\Users\Ronny\AppData\Roaming\QuickScan

2015-02-20 17:26 - 2015-02-20 18:09 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender

2015-02-20 17:25 - 2015-02-20 17:25 - 02867648 _____ () C:\Users\Ronny\Downloads\bitdefender_antivirus.exe

2015-02-13 15:13 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-02-11 17:20 - 2015-01-19 19:36 - 01192552 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2015-02-11 17:20 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-02-11 17:20 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-02-11 17:20 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-02-11 17:20 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-02-11 17:20 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-02-11 17:20 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-02-11 17:20 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-02-11 17:20 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-02-11 17:20 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-02-11 17:20 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-02-11 17:20 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-02-11 17:20 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-02-11 17:20 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-02-11 17:20 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-02-11 17:20 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-02-11 17:20 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-02-11 17:20 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-02-11 17:20 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-02-11 17:20 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-02-11 17:19 - 2015-02-04 00:43 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll

2015-02-11 17:19 - 2015-02-04 00:08 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2015-02-11 17:19 - 2015-02-04 00:08 - 00325120 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2015-02-11 17:19 - 2015-02-03 00:11 - 00886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2015-02-11 17:19 - 2015-02-03 00:11 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2015-02-11 17:19 - 2015-02-03 00:11 - 00482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2015-02-11 17:19 - 2015-01-10 08:38 - 03550720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-02-11 17:19 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-02-11 17:18 - 2015-01-10 09:28 - 05769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-02-11 17:18 - 2015-01-10 09:28 - 01468408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-02-11 17:17 - 2015-01-15 23:37 - 00478776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-02-11 17:17 - 2015-01-15 23:37 - 00148288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-02-11 17:17 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-02-11 17:17 - 2014-12-09 00:11 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2015-02-11 17:17 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll

2015-02-11 17:17 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll

2015-02-11 17:17 - 2014-10-29 02:03 - 01117696 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-02-11 00:06 - 2015-02-11 00:06 - 00030208 _____ () C:\Users\Ronny\Downloads\pcwTreeBuilder.z.exe

2015-02-09 17:51 - 2015-02-22 10:03 - 01960706 _____ () C:\WINDOWS\WindowsUpdate.log

2015-02-08 22:54 - 2015-02-08 22:54 - 00000000 ____D () C:\Program Files\Common Files\Java

2015-01-27 20:58 - 2015-01-27 20:58 - 00001140 _____ () C:\Users\Ronny\Desktop\WinMD5.exe - Verknüpfung.lnk
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-22 10:18 - 2014-10-17 20:03 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-02-22 10:00 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-02-22 09:30 - 2013-08-14 19:01 - 00000000 __RDO () C:\Users\Ronny\SkyDrive

2015-02-22 09:29 - 2014-10-17 20:03 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-22 09:29 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Microsoft.NET

2015-02-21 21:06 - 2013-09-30 05:08 - 01806364 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-02-21 17:40 - 2013-08-22 08:23 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-02-21 17:39 - 2013-11-01 18:28 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-21 17:39 - 2013-08-22 07:13 - 01310720 ___SH () C:\WINDOWS\system32\config\BBI

2015-02-21 17:38 - 2014-05-23 21:08 - 00000000 ____D () C:\AdwCleaner

2015-02-21 12:06 - 2014-02-13 18:43 - 00000000 ____D () C:\WINDOWS\Minidump

2015-02-21 12:06 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\ELAMBKUP

2015-02-21 11:16 - 2013-12-25 03:49 - 00000000 ____D () C:\Program Files\Image Grabber II

2015-02-21 09:01 - 2013-11-01 21:28 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2015-02-20 17:32 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2015-02-19 19:13 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-02-19 00:25 - 2013-11-03 18:41 - 00117760 _____ () C:\Users\Ronny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-02-15 17:19 - 2013-03-29 09:57 - 00001551 _____ () C:\Users\Ronny\Desktop\CUG_deu.pdf - Verknüpfung.lnk

2015-02-15 10:13 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\rescache

2015-02-14 23:53 - 2013-11-02 09:53 - 00000000 ____D () C:\Users\Ronny\AppData\Roaming\vlc

2015-02-13 15:16 - 2013-08-22 09:05 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-02-13 15:04 - 2013-08-22 08:22 - 00473936 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-02-13 07:14 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\de-DE

2015-02-12 17:44 - 2013-11-15 17:20 - 00000000 ____D () C:\WINDOWS\system32\MRT

2015-02-12 17:41 - 2013-11-15 17:20 - 113756392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-02-12 17:39 - 2014-12-10 20:30 - 00000000 ____D () C:\WINDOWS\system32\appraiser

2015-02-12 17:39 - 2014-07-12 12:33 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel

2015-02-08 22:54 - 2014-10-25 09:09 - 00000000 ____D () C:\Program Files\Java

2015-02-08 22:54 - 2013-11-26 20:22 - 00000000 ____D () C:\ProgramData\Oracle

2015-02-08 22:53 - 2014-10-25 09:09 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe

2015-02-08 22:53 - 2014-10-25 09:09 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe

2015-02-08 22:53 - 2014-10-25 09:09 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe

2015-02-08 22:53 - 2014-10-25 09:09 - 00096680 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll

2015-02-08 22:53 - 2014-10-25 09:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-02-03 20:31 - 2014-06-13 06:15 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe

2015-02-03 20:31 - 2014-06-13 06:15 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

2015-01-29 04:21 - 2013-11-01 18:35 - 00000000 ____D () C:\Users\Ronny
 

==================== Files in the root of some directories =======
 

2013-11-03 18:41 - 2015-02-19 00:25 - 0117760 _____ () C:\Users\Ronny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-04-18 22:20 - 2014-04-18 22:20 - 0007597 _____ () C:\Users\Ronny\AppData\Local\Resmon.ResmonCfg

2014-11-11 17:48 - 2014-11-11 17:53 - 0000000 _____ () C:\Users\Ronny\AppData\Local\{C4DE7E10-A4A8-4175-A632-7EFA7E16A862}

2015-02-20 18:13 - 2015-02-20 18:13 - 0310897 _____ () C:\ProgramData\1424451964.bdinstall.bin

2015-02-20 18:10 - 2015-02-20 18:10 - 0050051 _____ () C:\ProgramData\1424452189.bdinstall.bin

2015-02-21 11:15 - 2015-02-21 11:15 - 0032616 _____ () C:\ProgramData\1424513664.bdinstall.bin

2013-12-03 18:56 - 2013-12-03 18:56 - 0000486 _____ () C:\ProgramData\GRFolder.ini

2013-12-03 18:56 - 2013-12-03 18:56 - 0000028 _____ () C:\ProgramData\GRGames.ini
 

Some content of TEMP:

====================

C:\Users\Ronny\AppData\Local\Temp\Quarantine.exe

C:\Users\Ronny\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-14 02:25
 

==================== End Of Log ============================

--- --- ---

Wenn ich hier schon kompetente Hilfe bekomme, dann sollte ich mich natürlich auch an die Spielregeln halten, also Entschuldigung für das Posten der .txt Dateien als Anhang an Stelle der oben beschriebenen Zitate im Text. Ja, Probleme: die hatte ich bis auf die langsame Internetgeschwindigkeit und einen tw. trägen Rechner (Win 8.1 Notebook) nie, die Geschwindigkeit hat sich durch ein gestern durchgeführtes Router-Firmwareupdate auf .24 von .20 deutlich verbessert (Surfverhalten mit Internet Explorer). Was mir noch etwas Sorge bereitet ist, dass der Mitarbeiter der Telekom-Abuse-Hotline mir am Freitag mitgeteilt hat, dass mein Rechner von einem "Generic" befallen sei, einer Art Werkzeugkasten und der Inverkehrbringer jederzeit "losschlagen" und mein System beschädigen und ausspähen könne. Der Brieftext enhält hierzu die folgende Formulierung: "uns liegen Hinweise von Sicherheitsexperten vor, dass mindestens ein Rechner, der sich über Ihren Internetzugang mit dem Internet verbindet, mit einem Virus/ Trojaner infiziert ist." Dann folgen Empfehlungen in Form von Passwörter ändern, Überprüfung Aktualität OS etc. Hier im Forum sowie auf anderen Webseiten habe ich gelesen, dass sich Systeme durchaus versuchen, automatisch in ein WLAN einzuwählen, diese Versuche jedoch nicht zwingenderweise erfolgreich gewesen sein müssen. Ich denke da an die Smartphones (SAMSUNG und IPHONE 4/ 5) der Mitbewohner. Leider habe keinen Screenshot von diesem Status, danach jedoch in der Fitz!Box wie oben beschrieben die unbekannten Rechnereinträge PC ##.##.##... entfernt sowie die Einstellung "Nur bekannte Geräte im WLAN zulassen" aktiviert. Wenn ich nun davon ausgehen kann, dass mein Win 8.1. Notebook frei von jeglicher Art Schadsoftware ist, muss ich dann auch per ESET mein IPhone 5/ IPad 3 prüfen? Müssen jetzt eigentlich die Gäste meines WLAN (Mitbewohner mit div. Smartphones Android und iOS, Apple Macbook, Win 8.1. Notebook ihre Rechner scannen und wenn ja, sollte ich als Betreiber des Routers ein Procedere vorschreiben, z.B. wöchentliches Scannen mit ESET Onlinescanner und Malwarebytes? Klar, der einfachste Weg wäre vermutlich, dass ich den Gastzugang mit Wirkung 01.03.15 einfach "kappe". Danke für Deine/ Eure wertvolle Hilfe & Geduld.