Trojaner-Board - Trojaner TR/Dldr.Dofoil.R.638 und (Virus?) JAVA/Agent.XB

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojaner TR/Dldr.Dofoil.R.638 und (Virus?) JAVA/Agent.XB (https://www.trojaner-board.de/137330-trojaner-tr-dldr-dofoil-r-638-virus-java-agent-xb.html)

Trojaner TR/Dldr.Dofoil.R.638 und (Virus?) JAVA/Agent.XB

Hallo liebes Team,

gestern habe ich aufgrund von ständigem Netzwerkadapter Fehler und blockieren einer Website mit schädlichem Inhalt mein Virenprogramm (Antivir) durchlaufen lassen. Daraufhin wurden folgende Trojaner/Viren gefunden:
TR/Dldr.Dofoil.R.638
JAVA/Agent.XB
Diese habe ich in die Quarantäne geschoben. Da meine Mama meinte, das avast besser ist, habe ich mir das auch noch runter geladen. Avast hat nichts weiter gefunden.
Hier habe ich gelesen das es sich mit der Quarantäne nicht unbedingt erledigt hat und mein PC weiter schaden nehmen kann. Jetzt bin ich unsicher und hoffe das ihr mir helfen könnt.

Schritt 1-3 habe ich durchgeführt und die Logs etc. sind beigefügt.
Schritt 3 wurde nicht komplett ausgeführt und es kam folgendes:

gmer.exe funktioniert nicht mehr
Das Programm wurde aufgrund eines Problems nicht richtig ausgeführt. Das Programm wird geschlossen und Sie werden benachrichtigt, wenn eine Lösung verfügbar ist.

Ich hoffe auf eine schnelle Nachricht und Danke im voraus :)

Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Das hat funktioniert, hier nun die Frst.txt und die Addition.txt
Jetzt bin ich auf weiteres gespannt. :)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-06-2013

Ran by Tinchen (administrator) on 28-06-2013 10:43:18

Running from C:\Users\Tinchen\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

(Microsoft Corporation) C:\Windows\System32\alg.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Dropbox, Inc.) C:\Users\Tinchen\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe

(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Deutsche Telekom AG) C:\Program Files\Netzmanager\netzmanager.exe

(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE

(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_7_700_224_ActiveX.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11464296 2010-09-03] (Realtek Semiconductor)

HKLM\...\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe" [163552 2011-08-05] (Microsoft Corporation)

HKCU\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)

HKLM-x32\...\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [340336 2010-09-28] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"                                                                                                                                                                                                                        [407920 2010-09-18] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d                                                                                                                                                                                                                    [201584 2010-09-18] (Egis Technology Inc.)

HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)

HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)

HKLM-x32\...\Run: [RoccatKova+] "C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE" [536576 2010-06-23] (Roccat GmbH)

HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2010-01-22] (NEC Electronics Corporation)

HKLM-x32\...\Run: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [177448 2011-02-18] (CyberLink Corp.)

HKLM-x32\...\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [620136 2011-01-19] ()

HKLM-x32\...\Run: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe [665424 2008-12-04] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()

HKLM-x32\...\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: []  [x]

HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1648264 2013-04-30] (Ask)

HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-25] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)

HKU\Default\...\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} [x]

HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

HKU\Default User\...\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} [x]

HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

AppInit_DLLs:      [0 ] ()

AppInit_DLLs-x32:      [0 ] ()

Startup: C:\Users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Tinchen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk

ShortcutTarget: Netzmanager.lnk -> C:\Program Files\Netzmanager\netzmanager.exe (Deutsche Telekom AG)

Startup: C:\Users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com

URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File

HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=2185250512334134&q={searchTerms}

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=2185250512334134&q={searchTerms}

HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=2185250512334134&q={searchTerms}

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=2185250512334134&q={searchTerms}

HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=2185250512334134&q={searchTerms}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {5B941B34-48F6-4449-B320-D47BC707CBAF} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=5b1a3569-ecb7-4606-aec9-6c8177dc054c&apn_sauid=52741090-EACB-47E8-9D89-5209C4E9D9E6

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=2185250512334134&q={searchTerms}

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default

FF user.js: detected! => C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\user.js

FF SelectedSearchEngine: Ask.com

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\Extensions\toolbar@ask.com

FF Extension: No Name - C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF HKLM-x32\...\Mozilla Firefox 21.0\Extensions: [Components] C:\Program Files (x86)\Mozilla Firefox\components

FF HKLM-x32\...\Mozilla Firefox 21.0\Extensions: [Plugins] C:\Program Files (x86)\Mozilla Firefox\plugins

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\plugins

FF HKCU\...\Mozilla Firefox 21.0\Extensions: [Components] C:\Program Files (x86)\Mozilla Firefox\components

FF HKCU\...\Mozilla Firefox 21.0\Extensions: [Plugins] C:\Program Files (x86)\Mozilla Firefox\plugins

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\plugins
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}

CHR Extension: (Docs) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0

CHR Extension: (Gmail) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [9728 2010-11-04] (Deutsche Telekom AG)

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2401632 2012-11-29] (TuneUp Software)

R2 XTUService; C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe [21768 2010-11-24] (Intel Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R3 ArvoFltr; C:\Windows\System32\drivers\ArvoFltr.sys [15872 2009-05-06] (ROCCAT Development, Inc.)

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-05-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-05-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-27] (Avira Operations GmbH & Co. KG)

R2 IOCBIOS; C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys [34304 2010-09-15] (Intel Corporation)

R2 IOCBIOS; C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys [34304 2010-09-15] (Intel Corporation)

S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-06-28 10:43 - 2013-06-28 10:43 - 00000000 ____D C:\FRST

2013-06-28 10:42 - 2013-06-28 10:42 - 01933484 ____A (Farbar) C:\Users\Tinchen\Desktop\FRST64.exe

2013-06-28 09:46 - 2013-06-28 09:46 - 01110476 ____A C:\Users\Tinchen\Desktop\7z920.exe

2013-06-28 09:46 - 2013-06-28 09:46 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-06-28 09:22 - 2013-06-28 09:22 - 00472200 ____A C:\Windows\Minidump\062813-29421-01.dmp

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Downloads\gmer_2.1.19163.exe

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Desktop\gmer_2.1.19163.exe

2013-06-28 08:40 - 2013-06-28 08:40 - 00123258 ____A C:\Users\Tinchen\Desktop\OTL.Txt otl1.txt

2013-06-28 08:40 - 2013-06-28 08:40 - 00117522 ____A C:\Users\Tinchen\Desktop\Extras.Txt otl.txt

2013-06-28 08:38 - 2013-06-28 08:38 - 00117522 ____A C:\Users\Tinchen\Desktop\Extras.Txt

2013-06-28 08:37 - 2013-06-28 08:37 - 00123258 ____A C:\Users\Tinchen\Desktop\OTL.Txt

2013-06-28 08:33 - 2013-06-28 08:33 - 00602112 ____A (OldTimer Tools) C:\Users\Tinchen\Desktop\OTL.exe

2013-06-28 08:32 - 2013-06-28 08:32 - 00000476 ____A C:\Users\Tinchen\Desktop\defogger_disable.log

2013-06-28 08:32 - 2013-06-28 08:32 - 00000000 ____A C:\Users\Tinchen\defogger_reenable

2013-06-28 08:20 - 2013-06-28 08:20 - 00050477 ____A C:\Users\Tinchen\Downloads\Defogger.exe

2013-06-28 08:10 - 2013-06-28 08:10 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-06-28 08:09 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswVmm.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSP.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSnx.sys.sum

2013-06-27 19:15 - 2013-06-28 07:57 - 00002263 ____A C:\Users\Tinchen\Desktop\Google Chrome.lnk

2013-06-27 19:11 - 2013-06-28 10:28 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-06-27 19:11 - 2013-06-28 09:23 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-06-27 19:11 - 2013-06-28 08:00 - 01030952 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys

2013-06-27 19:11 - 2013-06-28 08:00 - 00378944 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys

2013-06-27 19:11 - 2013-06-28 08:00 - 00189936 ____A C:\Windows\System32\Drivers\aswVmm.sys

2013-06-27 19:11 - 2013-06-27 19:15 - 00000000 ____D C:\Users\Tinchen\AppData\Local\Google

2013-06-27 19:11 - 2013-06-27 19:12 - 00000000 ____D C:\Program Files (x86)\Google

2013-06-27 19:11 - 2013-06-27 19:11 - 00001926 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-06-27 19:11 - 2013-06-27 19:11 - 00000000 ____A C:\Windows\SysWOW64\config.nt

2013-06-27 19:11 - 2013-05-09 10:59 - 00080816 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00072016 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00065336 ____A C:\Windows\System32\Drivers\aswRvrt.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00064288 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00033400 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys

2013-06-27 19:11 - 2013-05-09 10:58 - 00287840 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe

2013-06-27 19:11 - 2013-05-09 10:58 - 00041664 ____A (AVAST Software) C:\Windows\avastSS.scr

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\ProgramData\AVAST Software

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\Program Files\AVAST Software

2013-06-27 18:31 - 2013-06-27 19:10 - 117478104 ____A C:\Users\Tinchen\Desktop\avast_free_antivirus_setup.exe

2013-06-26 10:34 - 2013-06-26 10:34 - 13034934 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-004.bmp

2013-06-26 10:34 - 2013-06-26 10:34 - 06517494 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-003.bmp

2013-06-26 10:34 - 2013-06-26 10:34 - 06517494 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-002.bmp

2013-06-26 10:34 - 2013-06-26 10:34 - 06517494 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-001.bmp

2013-06-24 10:00 - 2013-06-24 10:00 - 00127488 ____A C:\Users\Tinchen\Desktop\Ertragsvorschau_3_Jahre-data.xls

2013-06-24 09:59 - 2013-06-24 17:47 - 00105984 ____A C:\Users\Tinchen\Desktop\Kopie von ertragsvorschau-data.xls

2013-06-24 09:59 - 2013-06-24 09:59 - 00117248 ____A C:\Users\Tinchen\Downloads\Ertragsvorschau_3_Jahre-data.xls

2013-06-22 21:29 - 2013-06-22 21:29 - 00010931 ____A C:\Users\Tinchen\Desktop\Kosten pro Monat.ods

2013-06-22 21:18 - 2013-06-22 21:19 - 00000000 ____D C:\Users\Tinchen\Desktop\HERNEL

2013-06-22 21:17 - 2013-06-26 13:32 - 00000000 ____D C:\Users\Tinchen\Desktop\Businessplan

2013-06-22 21:17 - 2013-06-22 21:17 - 00000000 ____D C:\Users\Tinchen\Desktop\Eigene Firma

2013-06-19 06:48 - 2013-06-19 06:52 - 00014233 ____A C:\Users\Tinchen\Desktop\Anschreiben Arbeitsbescheinigung.odt

2013-06-17 15:15 - 2013-06-17 15:15 - 00000000 ____D C:\Users\Tinchen\AppData\Local\{7E8CDE2F-74E4-46EF-8192-708ECA672FDC}

2013-06-17 15:05 - 2013-06-17 18:42 - 00000000 ____D C:\Users\Tinchen\Desktop\Versicherungen

2013-06-17 12:58 - 2013-06-18 11:38 - 00014838 ____A C:\Users\Tinchen\Desktop\Diagramm Liquiditätsplan mit Förderung.odt

2013-06-15 22:46 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-06-15 22:46 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-06-15 22:46 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-06-15 22:46 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-06-15 22:46 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-06-15 22:46 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-06-15 22:46 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-06-15 22:46 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-06-15 21:25 - 2013-06-15 21:25 - 00001787 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-06-15 21:24 - 2013-06-15 21:25 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-15 21:24 - 2013-06-15 21:25 - 00000000 ____D C:\Program Files\iTunes

2013-06-15 21:24 - 2013-06-15 21:25 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-06-15 21:24 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files\iPod

2013-06-12 12:44 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-06-12 12:44 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-06-12 12:44 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-06-12 12:44 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-06-12 12:44 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-06-12 12:44 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-06-12 10:27 - 2013-06-12 10:27 - 00002215 ____A C:\Users\Tinchen\Desktop\Internet-Software.lnk

2013-06-12 10:27 - 2013-06-12 10:27 - 00002169 ____A C:\Users\Tinchen\Desktop\E-Mail einrichten.lnk

2013-06-12 10:27 - 2013-06-12 10:27 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Schnellstart-DVD

2013-06-12 10:20 - 2013-06-12 10:20 - 00000000 ____D C:\ProgramData\mquadr.at

2013-06-12 10:20 - 2012-09-28 13:52 - 02475456 ____A (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll

2013-06-12 08:09 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2013-06-12 08:09 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2013-06-12 08:09 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2013-06-12 08:09 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll

2013-06-12 08:09 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-06-12 08:09 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-06-12 08:09 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-06-12 08:09 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe

2013-06-12 08:09 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe

2013-06-12 08:09 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll

2013-06-12 08:09 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll

2013-06-12 08:09 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll

2013-06-12 08:09 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

2013-06-12 08:09 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll

2013-06-12 08:09 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2013-06-12 08:09 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

2013-06-12 08:09 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2013-06-12 08:09 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll

2013-06-12 08:09 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll

2013-06-07 11:56 - 2013-06-07 11:56 - 00033280 ____A C:\Users\Tinchen\Desktop\Dienstleistungsvertrag.wiz

2013-06-06 14:14 - 2013-06-22 21:26 - 00014832 ____A C:\Users\Tinchen\Desktop\130606 Kontostände aktuell.ods

2013-06-05 10:56 - 2013-06-05 11:01 - 00014001 ____A C:\Users\Tinchen\Desktop\Eigenebeleg Finanzamt.odt

2013-06-04 21:08 - 2013-06-04 21:08 - 00012450 ____A C:\Users\Tinchen\Desktop\Unbenannt 1.odt

2013-05-30 16:12 - 2013-05-30 16:12 - 00000000 ____D C:\Users\Tinchen\Desktop\Timo Steuer
 

==================== One Month Modified Files and Folders =======
 

2013-06-28 10:43 - 2013-06-28 10:43 - 00000000 ____D C:\FRST

2013-06-28 10:42 - 2013-06-28 10:42 - 01933484 ____A (Farbar) C:\Users\Tinchen\Desktop\FRST64.exe

2013-06-28 10:28 - 2013-06-27 19:11 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-06-28 10:05 - 2012-07-04 23:19 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-06-28 09:46 - 2013-06-28 09:46 - 01110476 ____A C:\Users\Tinchen\Desktop\7z920.exe

2013-06-28 09:46 - 2013-06-28 09:46 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-06-28 09:31 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-06-28 09:31 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-06-28 09:27 - 2011-04-22 13:33 - 00654594 ____A C:\Windows\System32\perfh007.dat

2013-06-28 09:27 - 2011-04-22 13:33 - 00130208 ____A C:\Windows\System32\perfc007.dat

2013-06-28 09:27 - 2009-07-14 07:13 - 01500254 ____A C:\Windows\System32\PerfStringBackup.INI

2013-06-28 09:25 - 2013-01-21 10:30 - 00000000 ___RD C:\Users\Tinchen\Dropbox

2013-06-28 09:25 - 2013-01-21 10:28 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Dropbox

2013-06-28 09:24 - 2011-05-13 21:37 - 00000000 ____D C:\ProgramData\clear.fi

2013-06-28 09:23 - 2013-06-27 19:11 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-06-28 09:23 - 2011-06-27 16:28 - 00000374 ____A C:\Windows\System32\Drivers\etc\hosts.ics

2013-06-28 09:22 - 2013-06-28 09:22 - 00472200 ____A C:\Windows\Minidump\062813-29421-01.dmp

2013-06-28 09:22 - 2012-01-16 22:47 - 848030936 ____A C:\Windows\MEMORY.DMP

2013-06-28 09:22 - 2012-01-16 22:47 - 00000000 ____D C:\Windows\Minidump

2013-06-28 09:22 - 2011-04-22 03:47 - 00000000 ____D C:\ProgramData\NVIDIA

2013-06-28 09:22 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-06-28 09:22 - 2009-07-14 06:51 - 00107535 ____A C:\Windows\setupact.log

2013-06-28 09:10 - 2011-04-22 03:39 - 01752367 ____A C:\Windows\WindowsUpdate.log

2013-06-28 09:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Downloads\gmer_2.1.19163.exe

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Desktop\gmer_2.1.19163.exe

2013-06-28 08:40 - 2013-06-28 08:40 - 00123258 ____A C:\Users\Tinchen\Desktop\OTL.Txt otl1.txt

2013-06-28 08:40 - 2013-06-28 08:40 - 00117522 ____A C:\Users\Tinchen\Desktop\Extras.Txt otl.txt

2013-06-28 08:38 - 2013-06-28 08:38 - 00117522 ____A C:\Users\Tinchen\Desktop\Extras.Txt

2013-06-28 08:37 - 2013-06-28 08:37 - 00123258 ____A C:\Users\Tinchen\Desktop\OTL.Txt

2013-06-28 08:33 - 2013-06-28 08:33 - 00602112 ____A (OldTimer Tools) C:\Users\Tinchen\Desktop\OTL.exe

2013-06-28 08:32 - 2013-06-28 08:32 - 00000476 ____A C:\Users\Tinchen\Desktop\defogger_disable.log

2013-06-28 08:32 - 2013-06-28 08:32 - 00000000 ____A C:\Users\Tinchen\defogger_reenable

2013-06-28 08:32 - 2011-05-13 21:30 - 00000000 ____D C:\users\Tinchen

2013-06-28 08:20 - 2013-06-28 08:20 - 00050477 ____A C:\Users\Tinchen\Downloads\Defogger.exe

2013-06-28 08:10 - 2013-06-28 08:10 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswVmm.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSP.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSnx.sys.sum

2013-06-28 08:00 - 2013-06-27 19:11 - 01030952 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys

2013-06-28 08:00 - 2013-06-27 19:11 - 00378944 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys

2013-06-28 08:00 - 2013-06-27 19:11 - 00189936 ____A C:\Windows\System32\Drivers\aswVmm.sys

2013-06-28 07:57 - 2013-06-27 19:15 - 00002263 ____A C:\Users\Tinchen\Desktop\Google Chrome.lnk

2013-06-28 07:57 - 2010-11-21 05:47 - 00841064 ____A C:\Windows\PFRO.log

2013-06-27 19:15 - 2013-06-27 19:11 - 00000000 ____D C:\Users\Tinchen\AppData\Local\Google

2013-06-27 19:12 - 2013-06-27 19:11 - 00000000 ____D C:\Program Files (x86)\Google

2013-06-27 19:11 - 2013-06-27 19:11 - 00001926 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-06-27 19:11 - 2013-06-27 19:11 - 00000000 ____A C:\Windows\SysWOW64\config.nt

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\ProgramData\AVAST Software

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\Program Files\AVAST Software

2013-06-27 19:10 - 2013-06-27 18:31 - 117478104 ____A C:\Users\Tinchen\Desktop\avast_free_antivirus_setup.exe

2013-06-26 13:32 - 2013-06-22 21:17 - 00000000 ____D C:\Users\Tinchen\Desktop\Businessplan

2013-06-26 10:34 - 2013-06-26 10:34 - 13034934 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-004.bmp

2013-06-26 10:34 - 2013-06-26 10:34 - 06517494 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-003.bmp

2013-06-26 10:34 - 2013-06-26 10:34 - 06517494 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-002.bmp

2013-06-26 10:34 - 2013-06-26 10:34 - 06517494 ____A C:\Users\Tinchen\Desktop\DW13_Platzierungsvorschlag_HERNEL-001.bmp

2013-06-25 13:17 - 2013-05-20 11:35 - 00000000 ____D C:\Users\Tinchen\Desktop\Quest Coaching

2013-06-25 11:18 - 2013-05-27 18:47 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys

2013-06-24 20:39 - 2011-05-20 10:41 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\SoftGrid Client

2013-06-24 17:47 - 2013-06-24 09:59 - 00105984 ____A C:\Users\Tinchen\Desktop\Kopie von ertragsvorschau-data.xls

2013-06-24 10:00 - 2013-06-24 10:00 - 00127488 ____A C:\Users\Tinchen\Desktop\Ertragsvorschau_3_Jahre-data.xls

2013-06-24 09:59 - 2013-06-24 09:59 - 00117248 ____A C:\Users\Tinchen\Downloads\Ertragsvorschau_3_Jahre-data.xls

2013-06-22 21:29 - 2013-06-22 21:29 - 00010931 ____A C:\Users\Tinchen\Desktop\Kosten pro Monat.ods

2013-06-22 21:26 - 2013-06-06 14:14 - 00014832 ____A C:\Users\Tinchen\Desktop\130606 Kontostände aktuell.ods

2013-06-22 21:19 - 2013-06-22 21:18 - 00000000 ____D C:\Users\Tinchen\Desktop\HERNEL

2013-06-22 21:17 - 2013-06-22 21:17 - 00000000 ____D C:\Users\Tinchen\Desktop\Eigene Firma

2013-06-19 06:52 - 2013-06-19 06:48 - 00014233 ____A C:\Users\Tinchen\Desktop\Anschreiben Arbeitsbescheinigung.odt

2013-06-18 11:38 - 2013-06-17 12:58 - 00014838 ____A C:\Users\Tinchen\Desktop\Diagramm Liquiditätsplan mit Förderung.odt

2013-06-17 18:42 - 2013-06-17 15:05 - 00000000 ____D C:\Users\Tinchen\Desktop\Versicherungen

2013-06-17 15:15 - 2013-06-17 15:15 - 00000000 ____D C:\Users\Tinchen\AppData\Local\{7E8CDE2F-74E4-46EF-8192-708ECA672FDC}

2013-06-15 21:25 - 2013-06-15 21:25 - 00001787 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-06-15 21:25 - 2013-06-15 21:24 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-15 21:25 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files\iTunes

2013-06-15 21:25 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-06-15 21:24 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files\iPod

2013-06-14 10:56 - 2011-06-07 22:20 - 00000000 ____D C:\Users\Tinchen\Desktop\Bewerbung

2013-06-13 12:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-06-13 11:05 - 2012-07-04 23:19 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-06-13 11:05 - 2011-05-14 16:16 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-06-12 12:44 - 2011-05-17 07:34 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-06-12 10:27 - 2013-06-12 10:27 - 00002215 ____A C:\Users\Tinchen\Desktop\Internet-Software.lnk

2013-06-12 10:27 - 2013-06-12 10:27 - 00002169 ____A C:\Users\Tinchen\Desktop\E-Mail einrichten.lnk

2013-06-12 10:27 - 2013-06-12 10:27 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Schnellstart-DVD

2013-06-12 10:20 - 2013-06-12 10:20 - 00000000 ____D C:\ProgramData\mquadr.at

2013-06-12 10:19 - 2011-05-14 10:52 - 00000000 ____D C:\Users\Tinchen\AppData\Local\Dtag

2013-06-08 16:08 - 2013-06-15 22:46 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-06-08 16:07 - 2013-06-15 22:46 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-06-08 16:06 - 2013-06-15 22:46 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-06-08 16:06 - 2013-06-15 22:46 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-06-08 16:06 - 2013-06-15 22:46 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-06-08 14:28 - 2013-06-15 22:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-06-08 13:42 - 2013-06-15 22:46 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-06-08 13:13 - 2013-06-15 22:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-06-07 11:56 - 2013-06-07 11:56 - 00033280 ____A C:\Users\Tinchen\Desktop\Dienstleistungsvertrag.wiz

2013-06-05 11:01 - 2013-06-05 10:56 - 00014001 ____A C:\Users\Tinchen\Desktop\Eigenebeleg Finanzamt.odt

2013-06-04 21:08 - 2013-06-04 21:08 - 00012450 ____A C:\Users\Tinchen\Desktop\Unbenannt 1.odt

2013-06-04 06:26 - 2013-04-17 08:44 - 00000000 ____D C:\Users\Tinchen\Desktop\Timo

2013-06-04 06:14 - 2012-07-15 20:01 - 00001152 ____A C:\Windows\wininit.ini

2013-05-30 16:12 - 2013-05-30 16:12 - 00000000 ____D C:\Users\Tinchen\Desktop\Timo Steuer

2013-05-30 13:52 - 2012-09-26 21:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-05-29 08:53 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
 

Files to move or delete:

====================

C:\ProgramData\FullRemove.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-06-24 18:51
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-06-2013

Ran by Tinchen at 2013-06-28 10:45:21

Running from C:\Users\Tinchen\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

???? ??? Windows Live (x32 Version: 15.4.3502.0922)

???? Windows Live (x32 Version: 15.4.3502.0922)

?????? ??????? ?? Windows Live (x32 Version: 15.4.3502.0922)

???????? ?????????? Windows Live (x32 Version: 15.4.3502.0922)

?????????? Windows Live (x32 Version: 15.4.3502.0922)

??????????? ?? Windows Live (x32 Version: 15.4.3502.0922)

1912 Titanic Mystery (x32)

64 Bit HP CIO Components Installer (Version: 6.2.2)

7-Zip 9.20 (x32)

ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.1395.4512)

Acer eRecovery Management (x32 Version: 5.00.3002)

Acer GameZone Console (x32 Version: 6.1.0.40497)

Acer Registration (x32 Version: 1.03.3003)

Acer ScreenSaver (x32 Version: 1.1.0825.2010)

Acer Updater (x32 Version: 1.02.3005)

Acrobat.com (x32 Version: 1.6.65)

Adobe AIR (x32 Version: 1.5.0.7220)

Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)

Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)

Adobe Reader X (10.1.5) - Deutsch (x32 Version: 10.1.5)

Apple Application Support (x32 Version: 2.3.4)

Apple Mobile Device Support (Version: 6.1.0.13)

Apple Software Update (x32 Version: 2.1.3.127)

Arvo (x32 Version: 1.0)

Ask Toolbar (x32 Version: 1.15.26.0)

avast! Free Antivirus (x32 Version: 8.0.1489.0)

Avira Free Antivirus (x32 Version: 13.0.0.3736)

Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.6.45268)

Bejeweled 2 Deluxe (x32)

Belkin USB Wireless Adaptor (x32 Version: 1.0.0.10)

Belles Beauty Boutique (x32)

Bing Bar (x32 Version: 7.0.610.0)

Bonjour (Version: 3.0.0.10)

Chicken Invaders 3 (x32)

clear.fi (x32 Version: 1.0.1422.15)

clear.fi (x32 Version: 9.0.7418)

clear.fi Client (x32 Version: 1.00.3009)

D3DX10 (x32 Version: 15.4.2368.0902)

DivX-Setup (x32 Version: 2.6.1.22)

Drakensang Online (x32)

Dream Day First Home (x32)

Dropbox (HKCU Version: 2.0.22)

Druckerdeinstallation für EPSON SX110 Series

eBay Worldwide (x32 Version: 2.1.0901)

Epson Easy Photo Print 2 (x32 Version: 2.1.0.0)

Epson Event Manager (x32 Version: 2.20.00)

EPSON Scan (x32)

Epson Stylus SX110_TX110 Handbuch (x32)

EverQuest II (2) (HKCU)

EverQuest II (3) (HKCU)

EverQuest II (4) (HKCU)

EverQuest II (HKCU)

Farm Frenzy 3 Ice Age (x32)

Flip Words (x32)

Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)

Galapago (x32)

Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)

Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)

Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922)

Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)

Galerie foto Windows Live (x32 Version: 15.4.3502.0922)

GIMP 2.8.0 (Version: 2.8.0)

Google Chrome (x32 Version: 27.0.1453.116)

Google Update Helper (x32 Version: 1.3.21.145)

Hotkey Utility (x32 Version: 2.05.3014)

HP Photosmart B109a-m All-in-One Driver 14.0 Rel. 6 (Version: 14.0)

iCloud (Version: 2.1.2.8)

Identity Card (x32 Version: 1.00.3006)

Intel Extreme Tuning Utility 2.1.408.41 (x32 Version: 2.1.408.41)

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)

Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)

Intel(R) SMBus

Intel® Watchdog Timer Driver (Intel® WDT) (x32)

iTunes (Version: 11.0.4.4)

Java 7 Update 9 (x32 Version: 7.0.90)

Java Auto Updater (x32 Version: 2.1.9.0)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

MediaEspresso (x32 Version: 1.0.1423_35858)

Mesh Runtime (x32 Version: 15.4.5722.2)

MFC RunTime files (x32 Version: 1.0.0)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)

Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5128.5002)

Microsoft Silverlight (Version: 5.1.20125.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)

Mozilla Firefox 21.0 (x86 de) (x32 Version: 21.0)

Mozilla Maintenance Service (x32 Version: 21.0)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

MyWinLocker (Version: 4.0.14.11)

MyWinLocker 4 (x32 Version: 4.0.14.11)

MyWinLocker Suite (x32 Version: 4.0.14.11)

NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0)

Nero Control Center 10 (x32 Version: 10.2.11100.1.1)

Nero ControlCenter 10 Help (CHM) (x32 Version: 10.5.10000)

Nero Core Components 10 (x32 Version: 2.0.18100.8.8)

Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100)

Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000)

Nero Express 10 (x32 Version: 10.2.12000.21.100)

Nero Express 10 Help (CHM) (x32 Version: 10.5.10200)

Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300)

Nero StartSmart 10 (x32 Version: 10.2.11600.14.100)

Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000)

Nero Update (x32 Version: 1.0.0018)

Netzmanager (Version: 1.05)

newsXpresso (x32 Version: 1.0.0.40)

Norton Online Backup (x32 Version: 2.1.17869)

NVIDIA 3D Vision Controller-Treiber 310.70 (Version: 310.70)

NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)

NVIDIA Display Control Panel (Version: 6.14.12.5933)

NVIDIA Grafiktreiber 311.06 (Version: 311.06)

NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)

NVIDIA Install Application (Version: 2.1002.108.688)

NVIDIA PhysX (x32 Version: 9.12.1031)

NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)

NVIDIA Systemsteuerung 311.06 (Version: 311.06)

NVIDIA Update 1.11.3 (Version: 1.11.3)

NVIDIA Update Components (Version: 1.11.3)

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)

PDF24 Creator 5.2.0 (x32)

Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922)

Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)

Pošta Windows Live (x32 Version: 15.4.3502.0922)

PS_AIO_06_B109a-m_SW_Min (x32 Version: 140.0.690.000)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6194)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.20.0)

ROCCAT Kova[+] Mouse Driver (x32 Version: 1.10)

S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922)

Scan (x32 Version: 140.0.80.000)

Shredder (Version: 2.0.8.7)

Shredder (x32 Version: 2.0.8.7)

Software Informer 1.1 (x32)

Sprill and Ritchie (x32)

Toolbox (x32 Version: 140.0.428.000)

TuneUp Utilities 2013 (x32 Version: 13.0.3000.132)

TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.3000.132)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)

Welcome Center (x32 Version: 1.02.3102)

Windows Live ??? (x32 Version: 15.4.3502.0922)

Windows Live ???? (x32 Version: 15.4.3502.0922)

Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3508.1109)

Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)

Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922)

Windows Live Fotótár (x32 Version: 15.4.3502.0922)

Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)

Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3508.1109)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Mesh (x32 Version: 15.4.3502.0922)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)

Windows Liven sähköposti (x32 Version: 15.4.3502.0922)

Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)

Windows Mobile Device Updater Component (Version: 04.08.2345.00)

World of Goo (x32)

World of Warcraft (x32 Version: 5.0.5.16135)

Zune (Version: 04.08.2345.00)

Zune Language Pack (CHS) (Version: 04.08.2345.00)

Zune Language Pack (CHT) (Version: 04.08.2345.00)

Zune Language Pack (CSY) (Version: 04.08.2345.00)

Zune Language Pack (DAN) (Version: 04.08.2345.00)

Zune Language Pack (DEU) (Version: 04.08.2345.00)

Zune Language Pack (ELL) (Version: 04.08.2345.00)

Zune Language Pack (ESP) (Version: 04.08.2345.00)

Zune Language Pack (FIN) (Version: 04.08.2345.00)

Zune Language Pack (FRA) (Version: 04.08.2345.00)

Zune Language Pack (HUN) (Version: 04.08.2345.00)

Zune Language Pack (IND) (Version: 04.08.2345.00)

Zune Language Pack (ITA) (Version: 04.08.2345.00)

Zune Language Pack (JPN) (Version: 04.08.2345.00)

Zune Language Pack (KOR) (Version: 04.08.2345.00)

Zune Language Pack (MSL) (Version: 04.08.2345.00)

Zune Language Pack (NLD) (Version: 04.08.2345.00)

Zune Language Pack (NOR) (Version: 04.08.2345.00)

Zune Language Pack (PLK) (Version: 04.08.2345.00)

Zune Language Pack (PTB) (Version: 04.08.2345.00)

Zune Language Pack (PTG) (Version: 04.08.2345.00)

Zune Language Pack (RUS) (Version: 04.08.2345.00)

Zune Language Pack (SVE) (Version: 04.08.2345.00)
 

==================== Restore Points  =========================
 

02-06-2013 15:03:02 Geplanter Prüfpunkt

11-06-2013 17:44:22 Geplanter Prüfpunkt

12-06-2013 10:43:27 Windows Update

15-06-2013 20:45:44 Windows Update

24-06-2013 16:58:32 Geplanter Prüfpunkt

27-06-2013 17:10:38 avast! Free Antivirus Setup

27-06-2013 20:22:24 Windows Update
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {18A94469-0636-4232-8A81-CA5B2FDB9D43} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2012-11-29] (TuneUp Software)

Task: {23BF4D3F-FF00-4FAE-9EF2-BB321FB1BA9D} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {28F4825B-6EE0-46EE-B81E-E4D7EB6B0AA3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-27] (Google Inc.)

Task: {450C474D-5F57-4F9B-8B48-3B2BEB780469} - System32\Tasks\{DBB9CBCA-4765-47DC-BF13-10C12962C21F} => C:\Windows\System32\java.exe No File

Task: {554EAB10-E3DB-4BFA-B115-C0347BEC5695} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-30] ()

Task: {57007F80-44F7-4AEB-B875-1AB4B211F9F8} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03] (Adobe Systems Incorporated)

Task: {66FB52AB-942E-4F75-BCAE-6EE955CB84A3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-13] (Adobe Systems Incorporated)

Task: {72724A19-D0C1-463F-83B4-172D839907DB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-27] (Google Inc.)

Task: {737A846B-5E23-4266-BE9D-CF71AFC13835} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-02-22] (CyberLink Corp.)

Task: {7B8616CA-F975-4B28-AA97-00C21C65A7C5} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-02-22] (CyberLink)

Task: {A6E4BD68-8BFA-4682-9A7F-EF5B60141DA9} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)

Task: {B3A1D834-FDBB-415A-9AB2-8FDB33556E23} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

Task: {B630142D-95AB-4051-835A-22435D981043} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-02-22] (Acer Incorporated)

Task: {BA929FFC-CCD3-40F0-9093-B51C1ED96B00} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2012-11-30] ()

Task: {E8F6662E-DE44-4591-80C3-8F3071E1ECD2} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Intel(R) 82579V Gigabit Network Connection

Description: Intel(R) 82579V Gigabit Network Connection

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Intel

Service: e1cexpress

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/28/2013 09:24:04 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/28/2013 09:02:20 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Name des fehlerhaften Moduls: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000218a

ID des fehlerhaften Prozesses: 0x1bc8

Startzeit der fehlerhaften Anwendung: 0xgmer_2.1.19163.exe0

Pfad der fehlerhaften Anwendung: gmer_2.1.19163.exe1

Pfad des fehlerhaften Moduls: gmer_2.1.19163.exe2

Berichtskennung: gmer_2.1.19163.exe3
 

Error: (06/28/2013 08:47:38 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Name des fehlerhaften Moduls: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000218a

ID des fehlerhaften Prozesses: 0x1db4

Startzeit der fehlerhaften Anwendung: 0xgmer_2.1.19163.exe0

Pfad der fehlerhaften Anwendung: gmer_2.1.19163.exe1

Pfad des fehlerhaften Moduls: gmer_2.1.19163.exe2

Berichtskennung: gmer_2.1.19163.exe3
 

Error: (06/28/2013 07:59:03 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/27/2013 10:21:13 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2529228
 

Error: (06/27/2013 10:21:13 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 2529228
 

Error: (06/27/2013 10:21:12 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/27/2013 01:19:35 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/27/2013 00:18:21 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/27/2013 08:07:22 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (06/28/2013 10:39:29 AM) (Source: ipnathlp) (User: )

Description: 0
 

Error: (06/28/2013 09:25:57 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (06/28/2013 09:25:57 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%1330
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 

Error: (06/28/2013 09:22:40 AM) (Source: BugCheck) (User: )

Description: 0x0000009f (0x0000000000000004, 0x0000000000000258, 0xfffffa8006d55b50, 0xfffff80000b9c3d0)C:\Windows\MEMORY.DMP062813-29421-01
 

Error: (06/28/2013 08:01:25 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (06/28/2013 08:01:25 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%1330
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 

Error: (06/28/2013 07:58:02 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Netzmanager Infrastruktur Informationssystem Dienst erreicht.
 

Error: (06/27/2013 05:02:40 PM) (Source: Schannel) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung empfangen: 20.
 

Error: (06/27/2013 03:13:23 PM) (Source: ipnathlp) (User: )

Description: 0
 

Error: (06/27/2013 03:13:22 PM) (Source: ipnathlp) (User: )

Description: 0
 
 

Microsoft Office Sessions:

=========================

Error: (06/28/2013 09:24:04 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/28/2013 09:02:20 AM) (Source: Application Error)(User: )

Description: gmer_2.1.19163.exe2.1.19163.0515d31f0gmer_2.1.19163.exe2.1.19163.0515d31f0c00000050000218a1bc801ce73cd295e297eC:\Users\Tinchen\Desktop\gmer_2.1.19163.exeC:\Users\Tinchen\Desktop\gmer_2.1.19163.exeac4eca9d-dfc0-11e2-91c7-f80f4112273c
 

Error: (06/28/2013 08:47:38 AM) (Source: Application Error)(User: )

Description: gmer_2.1.19163.exe2.1.19163.0515d31f0gmer_2.1.19163.exe2.1.19163.0515d31f0c00000050000218a1db401ce73cb1ccdd71bC:\Users\Tinchen\Desktop\gmer_2.1.19163.exeC:\Users\Tinchen\Desktop\gmer_2.1.19163.exe9ea79976-dfbe-11e2-91c7-f80f4112273c
 

Error: (06/28/2013 07:59:03 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/27/2013 10:21:13 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2529228
 

Error: (06/27/2013 10:21:13 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledEvent 2529228
 

Error: (06/27/2013 10:21:12 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/27/2013 01:19:35 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/27/2013 00:18:21 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/27/2013 08:07:22 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 21%

Total physical RAM: 8173.97 MB

Available physical RAM: 6428.99 MB

Total Pagefile: 16346.12 MB

Available Pagefile: 13527.74 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Acer) (Fixed) (Total:689.45 GB) (Free:64.39 GB) NTFS (Disk=0 Partition=3)

Drive d: (DATA) (Fixed) (Total:689.71 GB) (Free:688.74 GB) NTFS (Disk=0 Partition=4)
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: F667ED3B)

Partition 1: (Not Active) - (Size=18 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=689 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=690 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hier der Combofix log...
Was sagst du dazu?

Code:

ComboFix 13-06-28.01 - Tinchen 28.06.2013  18:19:42.1.8 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8174.6114 [GMT 2:00]

ausgeführt von:: c:\users\Tinchen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AH5WR70E\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\FullRemove.exe

c:\windows\SysWow64\SSDPDiscovery.dll.0

c:\windows\SysWow64\WiFiMan.dll.0

c:\windows\wininit.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-05-28 bis 2013-06-28  ))))))))))))))))))))))))))))))

.

.

2013-06-28 16:24 . 2013-06-28 16:24        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-06-28 16:24 . 2013-06-28 16:24        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-06-28 08:43 . 2013-06-28 08:43        --------        d-----w-        C:\FRST

2013-06-28 07:46 . 2013-06-28 07:46        --------        d-----w-        c:\program files (x86)\7-Zip

2013-06-28 06:10 . 2013-06-28 06:10        --------        d-----w-        c:\users\Tinchen\AppData\Roaming\Malwarebytes

2013-06-28 06:09 . 2013-06-28 06:09        --------        d-----w-        c:\programdata\Malwarebytes

2013-06-28 06:09 . 2013-06-28 06:09        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2013-06-28 06:09 . 2013-04-04 12:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-06-28 06:09 . 2013-06-28 06:09        --------        d-----w-        c:\users\Tinchen\AppData\Local\Programs

2013-06-27 17:11 . 2013-06-27 17:15        --------        d-----w-        c:\users\Tinchen\AppData\Local\Google

2013-06-27 17:11 . 2013-06-27 17:12        --------        d-----w-        c:\program files (x86)\Google

2013-06-27 17:11 . 2013-05-09 08:59        33400        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2013-06-27 17:11 . 2013-06-28 06:00        378944        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2013-06-27 17:11 . 2013-05-09 08:59        72016        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys

2013-06-27 17:11 . 2013-06-28 06:00        1030952        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2013-06-27 17:11 . 2013-05-09 08:59        64288        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2013-06-27 17:11 . 2013-06-28 06:00        189936        ----a-w-        c:\windows\system32\drivers\aswVmm.sys

2013-06-27 17:11 . 2013-05-09 08:59        65336        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys

2013-06-27 17:11 . 2013-05-09 08:59        80816        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2013-06-27 17:11 . 2013-05-09 08:58        287840        ----a-w-        c:\windows\system32\aswBoot.exe

2013-06-27 17:11 . 2013-05-09 08:58        41664        ----a-w-        c:\windows\avastSS.scr

2013-06-27 17:10 . 2013-06-27 17:10        --------        d-----w-        c:\program files\AVAST Software

2013-06-27 17:10 . 2013-06-27 17:10        --------        d-----w-        c:\programdata\AVAST Software

2013-06-15 19:24 . 2013-06-15 19:24        --------        d-----w-        c:\program files\iPod

2013-06-15 19:24 . 2013-06-15 19:25        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-15 19:24 . 2013-06-15 19:25        --------        d-----w-        c:\program files\iTunes

2013-06-15 19:24 . 2013-06-15 19:25        --------        d-----w-        c:\program files (x86)\iTunes

2013-06-12 08:27 . 2013-06-12 08:27        --------        d-----w-        c:\users\Tinchen\AppData\Roaming\Schnellstart-DVD

2013-06-12 08:20 . 2013-06-12 08:20        --------        d-----w-        c:\programdata\mquadr.at

2013-06-12 08:20 . 2012-09-28 11:52        2475456        ----a-w-        c:\windows\SysWow64\M2ElevatedCalls.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-06-25 09:18 . 2013-05-27 16:47        83672        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-06-13 09:05 . 2012-07-04 21:19        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-06-13 09:05 . 2011-05-14 14:16        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-12 10:44 . 2011-05-17 05:34        75825640        ----a-w-        c:\windows\system32\MRT.exe

2013-05-27 10:41 . 2013-05-27 10:41        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2013-05-27 10:41 . 2013-05-27 10:41        130016        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-05-27 10:41 . 2013-05-27 10:41        100712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-05-15 07:15 . 2010-06-24 18:33        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-05-13 06:37 . 2013-05-24 08:38        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{43E2256E-A620-474C-A506-0494074489DC}\mpengine.dll

2013-05-07 21:24 . 2013-05-07 21:24        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-05-07 21:24 . 2013-05-07 21:24        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-05-07 21:24 . 2013-05-07 21:24        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-05-07 21:24 . 2013-05-07 21:24        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-05-07 21:24 . 2013-05-07 21:24        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-05-07 21:24 . 2013-05-07 21:24        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-05-07 21:24 . 2013-05-07 21:24        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-05-07 21:24 . 2013-05-07 21:24        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-05-07 21:24 . 2013-05-07 21:24        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-05-07 21:24 . 2013-05-07 21:24        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-05-07 21:24 . 2013-05-07 21:24        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-05-07 21:24 . 2013-05-07 21:24        441856        ----a-w-        c:\windows\system32\html.iec

2013-05-07 21:24 . 2013-05-07 21:24        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-05-07 21:24 . 2013-05-07 21:24        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-05-07 21:24 . 2013-05-07 21:24        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-05-07 21:24 . 2013-05-07 21:24        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-05-07 21:24 . 2013-05-07 21:24        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-05-07 21:24 . 2013-05-07 21:24        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-05-07 21:24 . 2013-05-07 21:24        235008        ----a-w-        c:\windows\system32\url.dll

2013-05-07 21:24 . 2013-05-07 21:24        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-05-07 21:24 . 2013-05-07 21:24        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-05-07 21:24 . 2013-05-07 21:24        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-05-07 21:24 . 2013-05-07 21:24        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-05-07 21:24 . 2013-05-07 21:24        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-05-07 21:24 . 2013-05-07 21:24        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-05-07 21:24 . 2013-05-07 21:24        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-05-07 21:24 . 2013-05-07 21:24        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-05-07 21:24 . 2013-05-07 21:24        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-05-07 21:24 . 2013-05-07 21:24        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-05-07 21:24 . 2013-05-07 21:24        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-05-07 21:24 . 2013-05-07 21:24        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-05-07 21:24 . 2013-05-07 21:24        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-05-07 21:24 . 2013-05-07 21:24        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-05-07 21:24 . 2013-05-07 21:24        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-05-07 21:24 . 2013-05-07 21:24        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-05-07 21:24 . 2013-05-07 21:24        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-05-07 21:24 . 2013-05-07 21:24        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-05-07 21:24 . 2013-05-07 21:24        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-05-07 21:24 . 2013-05-07 21:24        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-05-07 21:24 . 2013-05-07 21:24        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-05-07 21:24 . 2013-05-07 21:24        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-05-07 21:24 . 2013-05-07 21:24        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-05-07 21:24 . 2013-05-07 21:24        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-05-07 21:24 . 2013-05-07 21:24        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-05-07 21:24 . 2013-05-07 21:24        149504        ----a-w-        c:\windows\system32\occache.dll

2013-05-07 21:24 . 2013-05-07 21:24        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-05-07 21:24 . 2013-05-07 21:24        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-05-07 21:24 . 2013-05-07 21:24        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-05-07 21:24 . 2013-05-07 21:24        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-05-02 00:06 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-13 05:49 . 2013-05-15 09:52        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-15 09:52        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-15 09:52        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-15 09:52        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-15 09:52        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-15 09:52        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-12 14:45 . 2013-04-24 06:31        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-04-10 06:01 . 2013-05-15 09:52        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2013-04-10 06:01 . 2013-05-15 09:52        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-04-10 03:30 . 2013-05-15 09:52        3153920        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2013-04-30 10:02        1521800        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-04-05 59720]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-09-28 340336]

"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-09-17 407920]

"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-09-17 201584]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-13 283160]

"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-01-22 106496]

"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-02-18 177448]

"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2011-01-19 620136]

"EEventManager"="c:\progra~2\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-12-04 665424]

"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]

"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-04-30 1648264]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-25 345144]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Arvo"="c:\program files (x86)\ROCCAT\Arvo Keyboard\ArvoHID.EXE" [2010-04-01 582144]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]

.

c:\users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Tinchen\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

Netzmanager.lnk - c:\program files\Netzmanager\netzmanager.exe /Autostart [2010-11-10 1619968]

OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer3"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]

R3 KovaPlusFltr;ROCCAT Kova[+] Mouse;c:\windows\system32\drivers\KovaPlusFltr.sys;c:\windows\SYSNATIVE\drivers\KovaPlusFltr.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R4 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 aswRvrt;aswRvrt; [x]

S0 aswVmm;aswVmm; [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 IOCBIOS;IOCBIOS;c:\programdata\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys;c:\programdata\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys [x]

S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]

S2 Netzmanager Service;Netzmanager Infrastruktur Informationssystem Dienst;c:\program files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe ;c:\program files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe  [x]

S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [x]

S2 XTUService;Intel(R) Extreme Tuning Utility;c:\program files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe;c:\program files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe [x]

S3 ArvoFltr;ROCCAT Arvo;c:\windows\system32\drivers\ArvoFltr.sys;c:\windows\SYSNATIVE\drivers\ArvoFltr.sys [x]

S3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);c:\windows\system32\DRIVERS\ICCWDT.sys;c:\windows\SYSNATIVE\DRIVERS\ICCWDT.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

S3 TelekomNM6;Telekom Netzmanager Packet Filter Driver;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [x]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-06-27 17:12        1165776        ----a-w-        c:\program files (x86)\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-06-28 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-04 09:05]

.

2013-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-27 17:11]

.

2013-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-27 17:11]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-05-09 08:58        133840        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Tinchen\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-03 11464296]

"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - ExtSQL: 2013-06-27 19:11; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-06-28  18:25:58

ComboFix-quarantined-files.txt  2013-06-28 16:25

.

Vor Suchlauf: 7 Verzeichnis(se), 68.770.267.136 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 69.194.821.632 Bytes frei

.

- - End Of File - - D33B0F56F141E0BB7CDEB783A8BD8EE4

D41D8CD98F00B204E9800998ECF8427E

Noch jede Menge Adware drauf :)

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Hier die weiteren Daten.
Erst vom ADW Cleaner...

Code:

# AdwCleaner v2.303 - Datei am 28/06/2013 um 21:28:57 erstellt

# Aktualisiert am 08/06/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Tinchen - TINCHEN´S-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Tinchen\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml

Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk

Datei Gelöscht : C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\searchplugins\Askcom.xml

Datei Gelöscht : C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\searchplugins\Search_Results.xml

Ordner Gelöscht : C:\Program Files (x86)\Ask.com

Ordner Gelöscht : C:\ProgramData\boost_interprocess

Ordner Gelöscht : C:\Users\Tinchen\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\Tinchen\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\extensions\toolbar@ask.com

Ordner Gelöscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\APN

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar

Schlüssel Gelöscht : HKCU\Software\Ask.com

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}

Schlüssel Gelöscht : HKLM\Software\APN

Schlüssel Gelöscht : HKLM\Software\AskToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

Schlüssel Gelöscht : HKLM\Software\SearchquSRTB

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16611
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v21.0 (de)
 

Datei : C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\prefs.js
 

C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\user.js ... Gelöscht !
 

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");

Gelöscht : user_pref("browser.search.defaultenginename", "Ask.com");

Gelöscht : user_pref("browser.search.order.1", "Ask.com");

Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");

Gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
 

-\\ Google Chrome v27.0.1453.116
 

Datei : C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [9117 octets] - [28/06/2013 21:28:57]
 

########## EOF - C:\AdwCleaner[S1].txt - [9177 octets] ##########

Und JRT...

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Home Premium x64

Ran by Tinchen on 28.06.2013 at 21:41:59,74

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\torch

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\torch

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5B941B34-48F6-4449-B320-D47BC707CBAF}
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Users\Tinchen\AppData\Roaming\software informer"

Successfully deleted: [Folder] "C:\Users\Tinchen\appdata\local\software"

Successfully deleted: [Folder] "C:\Program Files (x86)\software informer"

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{067B7954-A640-467D-8E27-BA5C51FA8758}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{1212982D-B6EB-457A-B834-A3DE306BD41E}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{359B4C51-5B90-4A2D-A0B4-ABD66A07EACB}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{45D03FC6-0479-4DB7-9239-65E822C00618}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{4A39F553-7948-44DA-9A55-49BE63ADEE6C}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{75AA42E4-81C6-4446-8953-E5CEF327E173}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{7E8CDE2F-74E4-46EF-8192-708ECA672FDC}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{8F14BBE5-6E92-45B2-B1EB-A9E257EB7507}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{A2A8DC8E-CF5B-4726-BC07-70C03567680C}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{ABFD136A-2E05-4B81-BDC5-64FB21BFE9A1}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{B53D8721-856F-4255-969B-55A33E7DF038}

Successfully deleted: [Empty Folder] C:\Users\Tinchen\appdata\local\{C6230218-ABFF-4FA3-B50A-84D009BB26A9}
 
 
 

~~~ FireFox
 

Successfully deleted: [File] C:\Users\Tinchen\AppData\Roaming\mozilla\firefox\profiles\vc46egcy.default\invalidprefs.js

Emptied folder: C:\Users\Tinchen\AppData\Roaming\mozilla\firefox\profiles\vc46egcy.default\minidumps [93 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 28.06.2013 at 21:45:12,51

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und schon besser?

Supi :)

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST Log bitte. Noch Probleme mit dem Rechner?

Hier die Logs. Es hat bis jetzt alles gut funktioniert :)
Was sagst du dazu?

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=f642265798c97843a31738e3ab50cbfe

# engine=14209

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-06-30 01:40:13

# local_time=2013-06-30 03:40:13 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=774 16777213 85 91 200392 149309485 0 0

# compatibility_mode=1799 16775165 100 96 13668 2948438 6459 0

# compatibility_mode=5893 16776574 100 94 3122486 124229463 0 0

# scanned=261214

# found=0

# cleaned=0

# scan_time=13324

Code:

 Results of screen317's Security Check version 0.99.68  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

avast! Antivirus   

Avira Desktop      

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 TuneUp Utilities 2013   

 TuneUp Utilities Language Pack (de-DE) 

 Java 7 Update 9  

 Java version out of Date! 

 Adobe Flash Player 11.7.700.224  

 Adobe Reader 10.1.5 Adobe Reader out of Date!  

 Mozilla Firefox 21.0 Firefox out of Date!  

 Google Chrome 27.0.1453.116  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   

 Symantec Norton Online Backup NOBuAgent.exe  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2013 01

Ran by Tinchen (administrator) on 30-06-2013 18:00:15

Running from C:\Users\Tinchen\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Dropbox, Inc.) C:\Users\Tinchen\AppData\Roaming\Dropbox\bin\Dropbox.exe

(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe

(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\alg.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE

(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_7_700_224_ActiveX.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11464296 2010-09-03] (Realtek Semiconductor)

HKLM\...\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe" [163552 2011-08-05] (Microsoft Corporation)

HKCU\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)

HKCU\...\Policies\system: [DisableRegistryTools] 0

HKCU\...\Policies\system: [DisableTaskMgr] 0

HKLM-x32\...\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [340336 2010-09-28] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"                                                                                                                                                                                                                        [407920 2010-09-18] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d                                                                                                                                                                                                                    [201584 2010-09-18] (Egis Technology Inc.)

HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)

HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)

HKLM-x32\...\Run: [RoccatKova+] "C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE" [536576 2010-06-23] (Roccat GmbH)

HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2010-01-22] (NEC Electronics Corporation)

HKLM-x32\...\Run: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [177448 2011-02-18] (CyberLink Corp.)

HKLM-x32\...\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [620136 2011-01-19] ()

HKLM-x32\...\Run: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe [665424 2008-12-04] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()

HKLM-x32\...\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: []  [x]

HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-25] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)

HKU\Default\...\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} [x]

HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

HKU\UpdatusUser\...\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} [x]

HKU\UpdatusUser\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

Startup: C:\Users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Tinchen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk

ShortcutTarget: Netzmanager.lnk -> C:\Program Files\Netzmanager\netzmanager.exe (Deutsche Telekom AG)

Startup: C:\Users\Tinchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Extension: No Name - C:\Users\Tinchen\AppData\Roaming\Mozilla\Firefox\Profiles\vc46egcy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Extension: (Docs) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0

CHR Extension: (Gmail) - C:\Users\Tinchen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [9728 2010-11-04] (Deutsche Telekom AG)

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2401632 2012-11-29] (TuneUp Software)

R2 XTUService; C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe [21768 2010-11-24] (Intel Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R3 ArvoFltr; C:\Windows\System32\drivers\ArvoFltr.sys [15872 2009-05-06] (ROCCAT Development, Inc.)

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)

R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-05-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-05-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-27] (Avira Operations GmbH & Co. KG)

R2 IOCBIOS; C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys [34304 2010-09-15] (Intel Corporation)

R2 IOCBIOS; C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBIOS.sys [34304 2010-09-15] (Intel Corporation)

S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-06-30 18:00 - 2013-06-30 18:00 - 01933592 ____A (Farbar) C:\Users\Tinchen\Desktop\FRST64.exe

2013-06-30 17:56 - 2013-06-30 17:56 - 00001352 ____A C:\Users\Tinchen\Desktop\checkup.txt

2013-06-30 16:10 - 2013-06-30 16:10 - 00890988 ____A C:\Users\Tinchen\Desktop\SecurityCheck.exe

2013-06-30 11:55 - 2013-06-30 11:55 - 00000000 ____D C:\Program Files (x86)\ESET

2013-06-28 21:45 - 2013-06-28 21:45 - 00002834 ____A C:\Users\Tinchen\Desktop\JRT.txt

2013-06-28 21:41 - 2013-06-28 21:41 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Tinchen\Desktop\JRT.exe

2013-06-28 21:41 - 2013-06-28 21:41 - 00000000 ____D C:\Windows\ERUNT

2013-06-28 21:41 - 2013-06-28 21:41 - 00000000 ____D C:\JRT

2013-06-28 21:28 - 2013-06-28 21:29 - 00009234 ____A C:\AdwCleaner[S1].txt

2013-06-28 21:27 - 2013-06-28 21:27 - 00648201 ____A C:\Users\Tinchen\Desktop\adwcleaner.exe

2013-06-28 18:25 - 2013-06-28 18:25 - 00031187 ____A C:\ComboFix.txt

2013-06-28 18:18 - 2013-06-28 18:26 - 00000000 ____D C:\Qoobox

2013-06-28 18:18 - 2013-06-28 18:25 - 00000000 ____D C:\Windows\erdnt

2013-06-28 18:18 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe

2013-06-28 18:18 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe

2013-06-28 18:18 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe

2013-06-28 18:18 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe

2013-06-28 18:18 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe

2013-06-28 18:18 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe

2013-06-28 18:18 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe

2013-06-28 18:18 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe

2013-06-28 14:12 - 2013-06-28 21:50 - 00000000 ____D C:\Users\Tinchen\Desktop\Trojaner Board

2013-06-28 10:43 - 2013-06-28 10:43 - 00000000 ____D C:\FRST

2013-06-28 09:46 - 2013-06-28 09:46 - 01110476 ____A C:\Users\Tinchen\Desktop\7z920.exe

2013-06-28 09:46 - 2013-06-28 09:46 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-06-28 09:22 - 2013-06-28 09:22 - 00472200 ____A C:\Windows\Minidump\062813-29421-01.dmp

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Downloads\gmer_2.1.19163.exe

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Desktop\gmer_2.1.19163.exe

2013-06-28 08:33 - 2013-06-28 08:33 - 00602112 ____A (OldTimer Tools) C:\Users\Tinchen\Desktop\OTL.exe

2013-06-28 08:32 - 2013-06-28 08:32 - 00000000 ____A C:\Users\Tinchen\defogger_reenable

2013-06-28 08:20 - 2013-06-28 08:20 - 00050477 ____A C:\Users\Tinchen\Downloads\Defogger.exe

2013-06-28 08:10 - 2013-06-28 08:10 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-06-28 08:09 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswVmm.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSP.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSnx.sys.sum

2013-06-27 19:11 - 2013-06-30 17:55 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-06-27 19:11 - 2013-06-30 11:47 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-06-27 19:11 - 2013-06-28 08:00 - 01030952 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys

2013-06-27 19:11 - 2013-06-28 08:00 - 00378944 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys

2013-06-27 19:11 - 2013-06-28 08:00 - 00189936 ____A C:\Windows\System32\Drivers\aswVmm.sys

2013-06-27 19:11 - 2013-06-27 19:15 - 00000000 ____D C:\Users\Tinchen\AppData\Local\Google

2013-06-27 19:11 - 2013-06-27 19:12 - 00000000 ____D C:\Program Files (x86)\Google

2013-06-27 19:11 - 2013-06-27 19:11 - 00001926 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-06-27 19:11 - 2013-06-27 19:11 - 00000000 ____A C:\Windows\SysWOW64\config.nt

2013-06-27 19:11 - 2013-05-09 10:59 - 00080816 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00072016 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00065336 ____A C:\Windows\System32\Drivers\aswRvrt.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00064288 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys

2013-06-27 19:11 - 2013-05-09 10:59 - 00033400 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys

2013-06-27 19:11 - 2013-05-09 10:58 - 00287840 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe

2013-06-27 19:11 - 2013-05-09 10:58 - 00041664 ____A (AVAST Software) C:\Windows\avastSS.scr

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\ProgramData\AVAST Software

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\Program Files\AVAST Software

2013-06-27 18:31 - 2013-06-27 19:10 - 117478104 ____A C:\Users\Tinchen\Desktop\avast_free_antivirus_setup.exe

2013-06-24 09:59 - 2013-06-24 17:47 - 00105984 ____A C:\Users\Tinchen\Desktop\Kopie von ertragsvorschau-data.xls

2013-06-24 09:59 - 2013-06-24 09:59 - 00117248 ____A C:\Users\Tinchen\Downloads\Ertragsvorschau_3_Jahre-data.xls

2013-06-22 21:18 - 2013-06-28 14:12 - 00000000 ____D C:\Users\Tinchen\Desktop\HERNEL

2013-06-19 06:48 - 2013-06-19 06:52 - 00014233 ____A C:\Users\Tinchen\Desktop\Anschreiben Arbeitsbescheinigung.odt

2013-06-17 15:05 - 2013-06-28 14:16 - 00000000 ____D C:\Users\Tinchen\Desktop\Versicherungen

2013-06-15 22:46 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-06-15 22:46 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-06-15 22:46 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-06-15 22:46 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-06-15 22:46 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-06-15 22:46 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-06-15 22:46 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-06-15 22:46 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-06-15 22:46 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-06-15 21:25 - 2013-06-15 21:25 - 00001787 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-06-15 21:24 - 2013-06-15 21:25 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-15 21:24 - 2013-06-15 21:25 - 00000000 ____D C:\Program Files\iTunes

2013-06-15 21:24 - 2013-06-15 21:25 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-06-15 21:24 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files\iPod

2013-06-12 12:44 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-06-12 12:44 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-06-12 12:44 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-06-12 12:44 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-06-12 12:44 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-06-12 12:44 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-06-12 12:44 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-06-12 12:44 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-06-12 10:27 - 2013-06-12 10:27 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Schnellstart-DVD

2013-06-12 10:20 - 2013-06-12 10:20 - 00000000 ____D C:\ProgramData\mquadr.at

2013-06-12 10:20 - 2012-09-28 13:52 - 02475456 ____A (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll

2013-06-12 08:09 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2013-06-12 08:09 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2013-06-12 08:09 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2013-06-12 08:09 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll

2013-06-12 08:09 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-06-12 08:09 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-06-12 08:09 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-06-12 08:09 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe

2013-06-12 08:09 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe

2013-06-12 08:09 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll

2013-06-12 08:09 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll

2013-06-12 08:09 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll

2013-06-12 08:09 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

2013-06-12 08:09 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll

2013-06-12 08:09 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2013-06-12 08:09 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

2013-06-12 08:09 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2013-06-12 08:09 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll

2013-06-12 08:09 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll

2013-06-07 11:56 - 2013-06-07 11:56 - 00033280 ____A C:\Users\Tinchen\Desktop\Dienstleistungsvertrag.wiz

2013-06-05 10:56 - 2013-06-05 11:01 - 00014001 ____A C:\Users\Tinchen\Desktop\Eigenebeleg Finanzamt.odt

2013-06-04 21:08 - 2013-06-04 21:08 - 00012450 ____A C:\Users\Tinchen\Desktop\Unbenannt 1.odt
 

==================== One Month Modified Files and Folders =======
 

2013-06-30 18:00 - 2013-06-30 18:00 - 01933592 ____A (Farbar) C:\Users\Tinchen\Desktop\FRST64.exe

2013-06-30 17:56 - 2013-06-30 17:56 - 00001352 ____A C:\Users\Tinchen\Desktop\checkup.txt

2013-06-30 17:55 - 2013-06-27 19:11 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-06-30 17:55 - 2012-07-04 23:19 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-06-30 16:10 - 2013-06-30 16:10 - 00890988 ____A C:\Users\Tinchen\Desktop\SecurityCheck.exe

2013-06-30 16:07 - 2011-04-22 03:39 - 01809982 ____A C:\Windows\WindowsUpdate.log

2013-06-30 11:56 - 2011-04-22 13:33 - 00654594 ____A C:\Windows\System32\perfh007.dat

2013-06-30 11:56 - 2011-04-22 13:33 - 00130208 ____A C:\Windows\System32\perfc007.dat

2013-06-30 11:56 - 2009-07-14 07:13 - 01500254 ____A C:\Windows\System32\PerfStringBackup.INI

2013-06-30 11:56 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-06-30 11:56 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-06-30 11:55 - 2013-06-30 11:55 - 00000000 ____D C:\Program Files (x86)\ESET

2013-06-30 11:48 - 2013-01-21 10:30 - 00000000 ___RD C:\Users\Tinchen\Dropbox

2013-06-30 11:48 - 2013-01-21 10:28 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Dropbox

2013-06-30 11:48 - 2011-06-27 16:28 - 00000374 ____A C:\Windows\System32\Drivers\etc\hosts.ics

2013-06-30 11:48 - 2011-05-13 21:37 - 00000000 ____D C:\ProgramData\clear.fi

2013-06-30 11:47 - 2013-06-27 19:11 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-06-30 11:47 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-06-30 11:46 - 2011-04-22 03:47 - 00000000 ____D C:\ProgramData\NVIDIA

2013-06-30 11:46 - 2009-07-14 06:51 - 00107927 ____A C:\Windows\setupact.log

2013-06-28 21:50 - 2013-06-28 14:12 - 00000000 ____D C:\Users\Tinchen\Desktop\Trojaner Board

2013-06-28 21:45 - 2013-06-28 21:45 - 00002834 ____A C:\Users\Tinchen\Desktop\JRT.txt

2013-06-28 21:41 - 2013-06-28 21:41 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Tinchen\Desktop\JRT.exe

2013-06-28 21:41 - 2013-06-28 21:41 - 00000000 ____D C:\Windows\ERUNT

2013-06-28 21:41 - 2013-06-28 21:41 - 00000000 ____D C:\JRT

2013-06-28 21:29 - 2013-06-28 21:28 - 00009234 ____A C:\AdwCleaner[S1].txt

2013-06-28 21:27 - 2013-06-28 21:27 - 00648201 ____A C:\Users\Tinchen\Desktop\adwcleaner.exe

2013-06-28 18:29 - 2010-11-21 05:47 - 00841616 ____A C:\Windows\PFRO.log

2013-06-28 18:26 - 2013-06-28 18:18 - 00000000 ____D C:\Qoobox

2013-06-28 18:25 - 2013-06-28 18:25 - 00031187 ____A C:\ComboFix.txt

2013-06-28 18:25 - 2013-06-28 18:18 - 00000000 ____D C:\Windows\erdnt

2013-06-28 18:24 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini

2013-06-28 14:16 - 2013-06-17 15:05 - 00000000 ____D C:\Users\Tinchen\Desktop\Versicherungen

2013-06-28 14:12 - 2013-06-22 21:18 - 00000000 ____D C:\Users\Tinchen\Desktop\HERNEL

2013-06-28 11:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF

2013-06-28 10:43 - 2013-06-28 10:43 - 00000000 ____D C:\FRST

2013-06-28 09:46 - 2013-06-28 09:46 - 01110476 ____A C:\Users\Tinchen\Desktop\7z920.exe

2013-06-28 09:46 - 2013-06-28 09:46 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-06-28 09:22 - 2013-06-28 09:22 - 00472200 ____A C:\Windows\Minidump\062813-29421-01.dmp

2013-06-28 09:22 - 2012-01-16 22:47 - 848030936 ____A C:\Windows\MEMORY.DMP

2013-06-28 09:22 - 2012-01-16 22:47 - 00000000 ____D C:\Windows\Minidump

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Downloads\gmer_2.1.19163.exe

2013-06-28 08:42 - 2013-06-28 08:42 - 00377856 ____A C:\Users\Tinchen\Desktop\gmer_2.1.19163.exe

2013-06-28 08:33 - 2013-06-28 08:33 - 00602112 ____A (OldTimer Tools) C:\Users\Tinchen\Desktop\OTL.exe

2013-06-28 08:32 - 2013-06-28 08:32 - 00000000 ____A C:\Users\Tinchen\defogger_reenable

2013-06-28 08:32 - 2011-05-13 21:30 - 00000000 ____D C:\users\Tinchen

2013-06-28 08:20 - 2013-06-28 08:20 - 00050477 ____A C:\Users\Tinchen\Downloads\Defogger.exe

2013-06-28 08:10 - 2013-06-28 08:10 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-06-28 08:09 - 2013-06-28 08:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswVmm.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSP.sys.sum

2013-06-28 08:00 - 2013-06-28 08:00 - 00000175 ____A C:\Windows\System32\Drivers\aswSnx.sys.sum

2013-06-28 08:00 - 2013-06-27 19:11 - 01030952 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys

2013-06-28 08:00 - 2013-06-27 19:11 - 00378944 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys

2013-06-28 08:00 - 2013-06-27 19:11 - 00189936 ____A C:\Windows\System32\Drivers\aswVmm.sys

2013-06-27 19:15 - 2013-06-27 19:11 - 00000000 ____D C:\Users\Tinchen\AppData\Local\Google

2013-06-27 19:12 - 2013-06-27 19:11 - 00000000 ____D C:\Program Files (x86)\Google

2013-06-27 19:11 - 2013-06-27 19:11 - 00001926 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-06-27 19:11 - 2013-06-27 19:11 - 00000000 ____A C:\Windows\SysWOW64\config.nt

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\ProgramData\AVAST Software

2013-06-27 19:10 - 2013-06-27 19:10 - 00000000 ____D C:\Program Files\AVAST Software

2013-06-27 19:10 - 2013-06-27 18:31 - 117478104 ____A C:\Users\Tinchen\Desktop\avast_free_antivirus_setup.exe

2013-06-25 13:17 - 2013-05-20 11:35 - 00000000 ____D C:\Users\Tinchen\Desktop\Quest Coaching

2013-06-25 11:18 - 2013-05-27 18:47 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys

2013-06-24 20:39 - 2011-05-20 10:41 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\SoftGrid Client

2013-06-24 17:47 - 2013-06-24 09:59 - 00105984 ____A C:\Users\Tinchen\Desktop\Kopie von ertragsvorschau-data.xls

2013-06-24 09:59 - 2013-06-24 09:59 - 00117248 ____A C:\Users\Tinchen\Downloads\Ertragsvorschau_3_Jahre-data.xls

2013-06-19 06:52 - 2013-06-19 06:48 - 00014233 ____A C:\Users\Tinchen\Desktop\Anschreiben Arbeitsbescheinigung.odt

2013-06-15 21:25 - 2013-06-15 21:25 - 00001787 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-06-15 21:25 - 2013-06-15 21:24 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-15 21:25 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files\iTunes

2013-06-15 21:25 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-06-15 21:24 - 2013-06-15 21:24 - 00000000 ____D C:\Program Files\iPod

2013-06-14 10:56 - 2011-06-07 22:20 - 00000000 ____D C:\Users\Tinchen\Desktop\Bewerbung

2013-06-13 12:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-06-13 11:05 - 2012-07-04 23:19 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-06-13 11:05 - 2011-05-14 16:16 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-06-12 12:44 - 2011-05-17 07:34 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-06-12 10:27 - 2013-06-12 10:27 - 00000000 ____D C:\Users\Tinchen\AppData\Roaming\Schnellstart-DVD

2013-06-12 10:20 - 2013-06-12 10:20 - 00000000 ____D C:\ProgramData\mquadr.at

2013-06-12 10:19 - 2011-05-14 10:52 - 00000000 ____D C:\Users\Tinchen\AppData\Local\Dtag

2013-06-08 16:08 - 2013-06-15 22:46 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-06-08 16:07 - 2013-06-15 22:46 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-06-08 16:06 - 2013-06-15 22:46 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-06-08 16:06 - 2013-06-15 22:46 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-06-08 16:06 - 2013-06-15 22:46 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-06-08 14:28 - 2013-06-15 22:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-06-08 13:42 - 2013-06-15 22:46 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-06-08 13:40 - 2013-06-15 22:46 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-06-08 13:13 - 2013-06-15 22:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-06-07 11:56 - 2013-06-07 11:56 - 00033280 ____A C:\Users\Tinchen\Desktop\Dienstleistungsvertrag.wiz

2013-06-05 11:01 - 2013-06-05 10:56 - 00014001 ____A C:\Users\Tinchen\Desktop\Eigenebeleg Finanzamt.odt

2013-06-04 21:08 - 2013-06-04 21:08 - 00012450 ____A C:\Users\Tinchen\Desktop\Unbenannt 1.odt

2013-06-04 06:26 - 2013-04-17 08:44 - 00000000 ____D C:\Users\Tinchen\Desktop\Timo
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-06-24 18:51
 

==================== End Of Log ============================

--- --- ---

Java, Adobe und Firefox updaten.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Es hat soweit alles funktioniert, aber ich habe noch das Programm gmer auf dem Pc...wie kann ich das denn deinstallieren. Irgendwie finde ich das nicht :(
Gibt es noch etwas das ich machen/beachten sollte wegen der Trojaner und Viren die ich hatte?

LG :)

Mit Delfix wird das gelöscht, ansonsten einfach das Desktop Symbol löschen :).

Sonst sind wir durch :)

Mein Pc läuft wieder normal und es ist alles okay :)
Abschliessend einen lieben Dank, echt toll wie schnell und kompetent einem
hier geholfen wird.

LG und macht weiter so :)