Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Interpol Sperrbildschirm-Keinen Zugriff mehr auf meinen Rechner (https://www.trojaner-board.de/154667-interpol-sperrbildschirm-keinen-zugriff-mehr-meinen-rechner.html)

bocken 02.06.2014 12:25
Interpol Sperrbildschirm-Keinen Zugriff mehr auf meinen Rechner
 
Hallo,
Ich bin neu hier im Forum und hoffe auf Eure Hilfe, Danke im vorraus.
Ich habe mir wohl einen schon bekannten Trojaner eingefanngen.
Interpol Sperrbildschirm mit der Aufforderung 100, EUR zu zahlen um meinen Rechner wieder nutzen zu können.

Nach Eurer Anleitung habe ich schon die Logfile mit frst gescannt, siehe hier

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-06-2014 01
Ran by SYSTEM on MININT-OVC803V on 02-06-2014 12:41:01
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-15] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\Bocken\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Bocken\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Bocken\...\Policies\system: [DisableLockWorkstation] 0
HKU\Bocken\...\Policies\system: [DisableChangePassword] 0
HKU\Default\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Default User\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Sabrina Boy\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKU\Sabrina Boy\...\Policies\system: [DisableLockWorkstation] 0
HKU\Sabrina Boy\...\Policies\system: [DisableChangePassword] 0
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Sabrina Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-23] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-23] (Avira Operations GmbH & Co. KG)
S2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [123392 2014-05-25] ()
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-05-25] (globalUpdate)
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-05-25] (globalUpdate)
S2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [27192 2010-07-02] ()
S2 TpmInitd; C:\Windows\system32\itsacapi_pe-2.3.exe [119296 2014-05-25] ()
S2 Winmgmt; C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gggwyg.dot [333052 2014-06-02] (Microsoft Corporation)
S2 Update raving reyven; "C:\Program Files (x86)\raving reyven\updateravingreyven.exe" [X]

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-17] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-22] (Realtek Semiconductor Corp.)
S3 ssm_bus; C:\Windows\System32\DRIVERS\ssm_bus.sys [136192 2013-06-20] (MCCI Corporation)
S3 ssm_mdfl; C:\Windows\System32\DRIVERS\ssm_mdfl.sys [18944 2013-06-20] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\System32\DRIVERS\ssm_mdm.sys [172032 2013-06-20] (MCCI Corporation)
S1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)

========================== Drivers MD5 =======================

C:\Windows\system32\DRIVERS\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ACPI.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys DB9D6C6B2CD95A9CA414D045B627422E
C:\Windows\System32\DRIVERS\agrsm64.sys 98022774D9930ECBB292E70DB7601DF6
C:\Windows\system32\DRIVERS\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\aliide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 8155EA1864D1FA8B168C46C41ED97A76
C:\Windows\System32\DRIVERS\atikmpag.sys 4841C7AF2BAC05AE23955D65B4336446
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys ==> MD5 is legit
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys E857EEE6B92AAA473EBB3465ADD8F7E7
C:\Windows\System32\drivers\AtiHdmi.sys 2D648572BA9A610952FCAFBA1E119C2D
C:\Windows\System32\DRIVERS\avgntflt.sys 7806BFCD1D7FA5EC23F7324D4EAFD25B
C:\Windows\System32\DRIVERS\avipbb.sys C3A58DBD18786C338126D30BF8C33D72
C:\Windows\System32\DRIVERS\avkmgr.sys 390184FAD8FCC1B6DA25AEBAE928C3B6
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bcmwl664.sys 810BE94A9E42309B3F74217AC28BC6AC
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys E10D1912634974EA273A1588C75CCB76
C:\Windows\System32\Drivers\BTHUSB.sys 19B784B6ECBB3ADBB2242700FEE90BEC
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys CA7720B73446FDDEC5C69519C1174C98
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys 73BDD44A6088916964945886F9025409
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys EBCE0B0924835F635F620D19F0529DCE
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\SysWOW64\FsUsbExDisk.SYS DDEE99DC54EFA20BD5A442CD733C4462
C:\Windows\System32\Drivers\Fs_Rec.sys D3E3F93D67821A2DB2B3D9FAC2DC2064
C:\Windows\System32\DRIVERS\fvevol.sys 1F44F8559E61A8306ECC67BB1E168B7C
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys 1384872112E8E7FD5786ECEB8BDDF4C9
C:\Windows\system32\drivers\iaStorV.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\igdkmd64.sys FBACBED7A37B3223822470FF1D8EA00F
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys E76FDFFF07F8A2FA81FF250DDA0F6BBA
C:\Windows\system32\DRIVERS\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\igdpmd64.sys FBACBED7A37B3223822470FF1D8EA00F
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\isapnp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 4F4B5FDE429416877DE7143044582EB5
C:\Windows\System32\Drivers\ksecpkg.sys 6F40465A44ECDC1731BEFAFEC5BDD03C
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb10.sys F0067552F8F9B33D7C59403AB808A3CB
C:\Windows\System32\DRIVERS\mrxsmb20.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\msahci.sys 5E939CF91EA4A841DBAFE4627E0292BB
C:\Windows\system32\DRIVERS\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netw5v64.sys 64428DFDAF6E88366CB51F45A79C5F69
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 9A6089B056EA1B83B36424FC9D0A300E
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvstor.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\optousb.sys 84DFFAD6904D29DAA208D28C0C00A8A6
C:\Windows\System32\DRIVERS\optovcm.sys 1B30BF9F42D6AC7CE27B8DC83F4B5913
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 90061B1ACFE8CCAA5345750FFE08D8B8
C:\Windows\System32\DRIVERS\pci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys 447DE7E3DEA39D422C1504F245B668B1
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 483DF0B58CA532E5240E59DC41F30AA2
C:\Windows\SysWOW64\Drivers\RtsUStor.sys 483DF0B58CA532E5240E59DC41F30AA2
C:\Windows\System32\DRIVERS\Rt64win7.sys 20A466B9EA2BD828C0EC723F99B8CFE7
C:\Windows\system32\DRIVERS\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\sdbus.sys 54E47AD086782D3AE9417C155CDCEB9B
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys 2046AA7491DE7EFA4D70E615D9BC9D09
C:\Windows\System32\DRIVERS\Sftplaylh.sys 0E0446BC4D51BE4263ACB7E33491191C
C:\Windows\System32\DRIVERS\Sftredirlh.sys C5FB982CD266E604ED3142102C26D62C
C:\Windows\System32\DRIVERS\Sftvollh.sys 2575511AF67AA1FA068CCC4918E2C2A3
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv2.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\VSTAZL6.SYS 0C4540311E11664B245A263E1154CEF8
C:\Windows\System32\DRIVERS\VSTDPV6.SYS 02071D207A9858FBE3A48CBFD59C4A04
C:\Windows\System32\DRIVERS\VSTCNXT6.SYS 18E40C245DBFAF36FD0134A7EF2DF396
C:\Windows\System32\DRIVERS\srvnet.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssadbus.sys 52D6F40B50ECFC051979FEC68E74F0F8
C:\Windows\System32\DRIVERS\ssadmdfl.sys D6CFD3B2EABCF9327DE39C62BABFA1E3
C:\Windows\System32\DRIVERS\ssadmdm.sys 5EB01E6148742C3EC2185AC92F6D16FD
C:\Windows\System32\DRIVERS\ssm_bus.sys 8E1B485AEBF4743F05B4FB162F6ED430
C:\Windows\System32\DRIVERS\ssm_mdfl.sys 1DFDEE4A0E168B6362A6A0778EAFDB55
C:\Windows\System32\DRIVERS\ssm_mdm.sys 1FFCC272F19BD84596378780F5C9843D
C:\Windows\System32\DRIVERS\ssudmdm.sys 5252D7BC56E5E0ED715AEA8FE173A455
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 4998AE89119C7106C92F0A64E4840FF6
C:\Windows\System32\drivers\tcpip.sys 5CFB7AB8F9524D1A1E14369DE63B83CC
C:\Windows\System32\DRIVERS\tcpip.sys 5CFB7AB8F9524D1A1E14369DE63B83CC
C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 7518F7BCFD4B308ABC9192BACAF6C970
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys C06E6F4679CEB8F430B90A51D76D8D3C
C:\Windows\system32\DRIVERS\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 537A4E03D7103C12D42DFD8FFDB5BDC9
C:\Windows\system32\DRIVERS\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys FBB21EBE49F6D560DB37AC25FBC68E66
C:\Windows\System32\DRIVERS\usbhub.sys 6B7A8A99C4A459E73C286A6763EA24CC
C:\Windows\system32\drivers\usbohci.sys 8C88AA7617B4CBC2E4BED61D26B33A27
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS ==> MD5 is legit
C:\Windows\system32\drivers\usbuhci.sys 0B5B3B2DF3FD1709618ACFA50B8392B0
C:\Windows\System32\Drivers\usbvideo.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viaide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys 9E425AC5C9A5A973273D169F43B4F5E1
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\System32\DRIVERS\yk62x64.sys B3EEACF62445E24FBB2CD4B0FB4DB026
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys BA8BD1C0182BD860A379C0DF959976F3

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-02 12:40 - 2014-06-02 12:41 - 00000000 ____D () C:\FRST
2014-06-02 02:00 - 2014-06-02 02:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 01:48 - 2014-06-02 01:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 01:27 - 2014-06-02 02:24 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 01:27 - 2014-06-02 01:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 01:23 - 2014-06-02 02:23 - 00000392 _____ () C:\Windows\setupact.log
2014-06-02 01:23 - 2014-06-02 01:23 - 00305472 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-06-02 01:23 - 2014-06-02 01:23 - 00000640 _____ () C:\Windows\PFRO.log
2014-06-02 01:23 - 2014-06-02 01:23 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-02 00:34 - 2014-06-02 00:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 00:21 - 2014-06-02 00:24 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 00:15 - 2014-06-02 00:19 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-06-02 00:05 - 2014-06-02 00:14 - 00000000 ____D () C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172
2014-06-01 10:19 - 2014-05-22 08:20 - 00061120 _____ (StdLib) C:\Windows\System32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-25 04:57 - 2014-05-25 04:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 04:56 - 2014-06-02 01:23 - 00000000 ____D () C:\Program Files (x86)\raving reyven
2014-05-25 04:56 - 2014-05-25 04:56 - 00123392 _____ () C:\Windows\System32\DlProtectSvc.exe
2014-05-25 04:56 - 2014-05-25 04:56 - 00119296 _____ () C:\Windows\System32\itsacapi_pe-2.3.exe
2014-05-25 04:56 - 2014-05-25 04:56 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-05-25 04:55 - 2014-06-02 00:44 - 00000000 ____D () C:\Program Files (x86)\PSHD-9.9
2014-05-25 04:55 - 2014-05-25 04:55 - 00003460 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-3.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00002194 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-4.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00001462 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-5.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00001366 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-1.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00000922 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\globalUpdate
2014-05-25 04:55 - 2014-05-25 04:55 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-05-25 04:53 - 2014-05-25 04:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 04:53 - 2014-05-25 04:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\BupSystem
2014-05-25 04:51 - 2014-05-25 04:51 - 00468096 _____ () C:\Users\Sabrina Boy\Downloads\ccleaner.exe
2014-05-25 04:50 - 2014-05-25 04:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 04:50 - 2014-05-25 04:50 - 00000000 ____D () C:\users\Administrator
2014-05-20 10:23 - 2014-05-20 10:55 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-20 10:19 - 2014-06-02 02:07 - 00193649 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 00:59 - 2014-05-14 11:35 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt
2014-05-07 04:00 - 2014-05-07 04:00 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-06 23:26 - 2014-05-06 23:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job

==================== One Month Modified Files and Folders =======

2014-06-02 12:41 - 2014-06-02 12:40 - 00000000 ____D () C:\FRST
2014-06-02 11:58 - 2011-07-05 20:49 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-02 02:24 - 2014-06-02 01:27 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 02:23 - 2014-06-02 01:23 - 00000392 _____ () C:\Windows\setupact.log
2014-06-02 02:07 - 2014-05-20 10:19 - 00193649 _____ () C:\Windows\WindowsUpdate.log
2014-06-02 02:07 - 2009-07-13 20:45 - 00023024 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-02 02:07 - 2009-07-13 20:45 - 00023024 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-02 02:00 - 2014-06-02 02:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 02:00 - 2011-03-09 08:41 - 00000000 ____D () C:\Users\Bocken\AppData\Local\Temp
2014-06-02 01:48 - 2014-06-02 01:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 01:27 - 2014-06-02 01:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 01:26 - 2009-07-13 19:20 - 00000000 ___HD () C:\Windows\System32\GroupPolicy
2014-06-02 01:24 - 2011-03-05 07:59 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\Temp
2014-06-02 01:23 - 2014-06-02 01:23 - 00305472 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-06-02 01:23 - 2014-06-02 01:23 - 00000640 _____ () C:\Windows\PFRO.log
2014-06-02 01:23 - 2014-06-02 01:23 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-02 01:23 - 2014-05-25 04:56 - 00000000 ____D () C:\Program Files (x86)\raving reyven
2014-06-02 01:18 - 2011-08-12 08:55 - 00000000 ____D () C:\Windows\pss
2014-06-02 00:44 - 2014-05-25 04:55 - 00000000 ____D () C:\Program Files (x86)\PSHD-9.9
2014-06-02 00:34 - 2014-06-02 00:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 00:24 - 2014-06-02 00:21 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 00:19 - 2014-06-02 00:15 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-06-02 00:14 - 2014-06-02 00:05 - 00000000 ____D () C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172
2014-06-01 23:10 - 2010-07-17 10:47 - 00654852 _____ () C:\Windows\System32\perfh007.dat
2014-06-01 23:10 - 2010-07-17 10:47 - 00130434 _____ () C:\Windows\System32\perfc007.dat
2014-06-01 23:10 - 2009-07-13 21:13 - 01500294 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-25 04:57 - 2014-05-25 04:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 04:57 - 2011-03-05 13:29 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-25 04:57 - 2011-03-05 13:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-25 04:56 - 2014-05-25 04:56 - 00123392 _____ () C:\Windows\System32\DlProtectSvc.exe
2014-05-25 04:56 - 2014-05-25 04:56 - 00119296 _____ () C:\Windows\System32\itsacapi_pe-2.3.exe
2014-05-25 04:56 - 2014-05-25 04:56 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-05-25 04:55 - 2014-05-25 04:55 - 00003460 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-3.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00002194 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-4.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00001462 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-5.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00001366 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-1.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00000922 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2014-05-25 04:55 - 2014-05-25 04:55 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\globalUpdate
2014-05-25 04:55 - 2014-05-25 04:55 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-05-25 04:53 - 2014-05-25 04:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 04:53 - 2014-05-25 04:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\BupSystem
2014-05-25 04:51 - 2014-05-25 04:51 - 00468096 _____ () C:\Users\Sabrina Boy\Downloads\ccleaner.exe
2014-05-25 04:50 - 2014-05-25 04:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 04:50 - 2014-05-25 04:50 - 00000000 ____D () C:\users\Administrator
2014-05-22 08:20 - 2014-06-01 10:19 - 00061120 _____ (StdLib) C:\Windows\System32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-20 10:55 - 2014-05-20 10:23 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-15 22:40 - 2013-08-17 11:06 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-15 22:37 - 2011-03-10 23:30 - 93223848 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-05-14 11:35 - 2014-05-14 00:59 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt
2014-05-07 04:00 - 2014-05-07 04:00 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-06 23:26 - 2014-05-06 23:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\Bocken\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2013-06-23 05:26:13
Restore point made on: 2013-06-23 05:26:21
Restore point made on: 2013-06-23 05:26:22
Restore point made on: 2013-06-23 05:26:22
Restore point made on: 2013-06-23 05:26:27
Restore point made on: 2013-06-23 05:26:30
Restore point made on: 2013-06-23 05:26:38
Restore point made on: 2014-03-06 03:18:46
Restore point made on: 2014-03-06 03:31:16
Restore point made on: 2014-03-06 03:31:43
Restore point made on: 2014-03-06 03:32:05
Restore point made on: 2014-03-06 03:32:38
Restore point made on: 2014-03-06 03:39:12
Restore point made on: 2014-03-06 04:15:33
Restore point made on: 2014-03-15 09:34:14
Restore point made on: 2014-03-17 23:59:04
Restore point made on: 2014-03-25 23:58:47
Restore point made on: 2014-03-26 00:02:05
Restore point made on: 2014-03-28 06:58:27
Restore point made on: 2014-03-31 23:45:12
Restore point made on: 2014-04-10 02:00:29
Restore point made on: 2014-04-14 22:42:10
Restore point made on: 2014-04-19 12:12:41
Restore point made on: 2014-04-19 12:16:22
Restore point made on: 2014-04-22 23:31:43
Restore point made on: 2014-04-26 00:58:44
Restore point made on: 2014-05-04 04:10:08
Restore point made on: 2014-05-04 04:32:49
Restore point made on: 2014-05-04 04:32:56
Restore point made on: 2014-05-04 13:06:31
Restore point made on: 2014-05-13 04:15:27
Restore point made on: 2014-05-14 11:45:31
Restore point made on: 2014-05-15 22:37:11
Restore point made on: 2014-05-20 10:21:42
Restore point made on: 2014-05-22 19:46:50
Restore point made on: 2014-06-01 10:21:53
Restore point made on: 2014-06-01 10:23:31
Restore point made on: 2014-06-01 23:42:13
Restore point made on: 2014-06-01 23:45:36
Restore point made on: 2014-06-02 01:16:43

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=Y:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
extendedinput          Yes
default                {default}
resumeobject            {c279be75-9b51-11de-9b93-a29d207e6d0e}
displayorder            {default}
toolsdisplayorder      {memdiag}
timeout                30
customactions          0x1000085000001
                        0x5400000f
custom:5400000f        {current}

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{008ec3c1-c4bb-11df-9d1f-fe7ff272e1c4}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{008ec3c1-c4bb-11df-9d1f-fe7ff272e1c4}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Windows-Startladeprogramm
-------------------------
Bezeichner              {572bcd60-ffa7-11d9-aae0-0007e994107d}
device                  ramdisk=[boot]\sources\boot.wim,{ramdiskoptions}
path                    \windows\system32\boot\winload.exe
description            Microsoft Windows PE 2.0
osdevice                ramdisk=[boot]\sources\boot.wim,{ramdiskoptions}
systemroot              \windows
detecthal              Yes
winpe                  Yes
ems                    Yes

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {current}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {c279be75-9b51-11de-9b93-a29d207e6d0e}
nx                      OptIn

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {c279be75-9b51-11de-9b93-a29d207e6d0e}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description            Windows Memory Diagnostic
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {008ec3c1-c4bb-11df-9d1f-fe7ff272e1c4}
description            Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

Optionen zum RAM-Datentr„gersetup
---------------------------------
Bezeichner              {ramdiskoptions}
description            Ramdisk Options
ramdisksdidevice        boot
ramdisksdipath          \boot\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3893.86 MB
Available physical RAM: 3183.88 MB
Total Pagefile: 3892.01 MB
Available Pagefile: 3173.91 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:281.96 GB) (Free:201.86 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (RECOVERY) (Fixed) (Total:15.84 GB) (Free:2.28 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
Drive h: (Intenso) (Removable) (Total:7.81 GB) (Free:7.76 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 91CA769B)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

========================================================
Disk: 1 (Size: 8 GB) (Disk ID: 76CDA3CF)
Partition 1: (Not Active) - (Size=8 GB) - (Type=0B)


LastRegBack: 2013-06-23 04:12

==================== End Of Log ============================
Ich hoffe die Daten sind Aussagekräftig.

Leider bin ich kein Profi am Rechner und bitte vorab um Verständnis, Danke!

schrauber 02.06.2014 12:26
hi,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
Startup: C:\Users\Sabrina Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
S2 Winmgmt; C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gggwyg.dot [333052 2014-06-02] (Microsoft Corporation)
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.



Rechner normal starten.

bocken 02.06.2014 14:05
Hallo,
Danke für die schnelle Antwort.
Zwischenzeitlich habe ich im abgesicherten Modus ein Systemwiederherstellungspunkt gewählt und mit dem Virenprogramm Avira ein Scan vollzogen.
Avira hat eine Datei in Quarantäne verschoben.
Jetzt habe ich nach Deiner Antwort die Schritte befolgt und hier die aktuelle Logfile
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-06-2014 01
Ran by SYSTEM at 2014-06-02 14:36:23 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
Startup: C:\Users\Sabrina Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
S2 Winmgmt; C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gggwyg.dot [333052 2014-06-02] (Microsoft Corporation)
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172

*****************

C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk not found.
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp => Moved successfully.
C:\Users\Sabrina Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk not found.
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp not found.
Winmgmt => Service restored successfully.
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172 => Moved successfully.

==== End of Fixlog ====
ich hoffe, ich habe jetzt nichts durcheinander gebracht.:wtf:

Hallo,
Danke für die schnelle Antwort.
Zwischenzeitlich habe ich im abgespeicherten Modus ein Systemwiederherstellungspunkt gewählt und der Rechner lief wieder.
Habe Deine Nachricht erhalten und die Schritte befolgt.
Hier die logfix

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-06-2014 01
Ran by SYSTEM at 2014-06-02 14:36:23 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
Startup: C:\Users\Sabrina Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp (Microsoft Corporation)
S2 Winmgmt; C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gggwyg.dot [333052 2014-06-02] (Microsoft Corporation)
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172

*****************

C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk not found.
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp => Moved successfully.
C:\Users\Sabrina Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk not found.
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\gywggg.cpp not found.
Winmgmt => Service restored successfully.
C:\ProgramData\11764AFC2A3364905E8D1EAE8BD77172 => Moved successfully.

==== End of Fixlog ====
danke für die schnelle Antwort

schrauber 03.06.2014 10:08
Kannste also jetz tim normalen Modus booten? Wenn ja dann das hier vom Desktop:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


bocken 04.06.2014 15:36
Hallo,
habe alles so wie Beschrieben durchgeführt.
hier die frst.txt

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Sabrina Boy (administrator) on SABRINASLAPTOP on 04-06-2014 16:30:32
Running from C:\Users\Sabrina Boy\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(globalUpdate) C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_4_402_265_ActiveX.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: F - F:\ting.exe
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: {245b7740-b66e-11e2-9d25-a6699b6f42c6} - F:\ting.exe
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=CC89C0CB3829A1DE&affID=120695&tt=250613_gr2&tsp=4927
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.myplaycity.com/
URLSearchHook: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
URLSearchHook: HKLM-x32 - Bigpoint Games DE Toolbar - {0e3dbc69-a682-48da-84e1-82c63a5d678e} - C:\Program Files (x86)\Bigpoint_Games_DE\prxtbBigp.dll (Conduit Ltd.)
URLSearchHook: HKLM-x32 - WiseConvert 1.3 Toolbar - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.)
URLSearchHook: HKCU - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
URLSearchHook: HKCU - Bigpoint Games DE Toolbar - {0e3dbc69-a682-48da-84e1-82c63a5d678e} - C:\Program Files (x86)\Bigpoint_Games_DE\prxtbBigp.dll (Conduit Ltd.)
URLSearchHook: HKCU - WiseConvert 1.3 Toolbar - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3242337
SearchScopes: HKLM-x32 - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^Y6^xdm043^YY^de&si=swissconverter&ptb=01C76C6B-A0C8-4165-865C-F995B375C5EF&ind=2013062803&n=77fce693&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3242337
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3320324&octid=EB_ORIGINAL_CTID&ISID=M5049F39C-EC9F-45FB-934D-9B2A60005DA3&SearchSource=58&CUI=&UM=5&UP=SP70409782-B690-4A8E-B311-9116D80111ED&q={searchTerms}&SSPV=
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3320324&octid=EB_ORIGINAL_CTID&ISID=M5049F39C-EC9F-45FB-934D-9B2A60005DA3&SearchSource=58&CUI=&UM=5&UP=SP70409782-B690-4A8E-B311-9116D80111ED&q={searchTerms}&SSPV=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=CC89C0CB3829A1DE&affID=120695&tt=250613_gr2&tsp=4927
SearchScopes: HKCU - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} URL = hxxp://home.myplaycity.com/results.php?category=web&s={searchTerms}
SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^Y6^xdm043^YY^de&si=swissconverter&ptb=01C76C6B-A0C8-4165-865C-F995B375C5EF&ind=2013062803&n=77fce693&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {A4D04BDE-D60A-4627-B228-25721E6494EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3242337
SearchScopes: HKCU - {C18995F8-9267-42C8-AE61-57077F75E2AC} URL = hxxp://search.softonic.com/MON1207T11/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=514
SearchScopes: HKCU - {FA7403CF-0EB6-4620-947F-4ADC58E485E4} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=41868C55-63C5-4313-A21D-7040FE2BAEBA&apn_sauid=103B60E9-33D4-4BC4-928C-9EF32E42AA50
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  No File
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
Toolbar: HKCU - No Name - {0E3DBC69-A682-48DA-84E1-82C63A5D678E} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {213C8ED6-1D78-4D8F-8729-25006AA86A76} -  No File
DPF: HKLM-x32 {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab
DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2010-07-17] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 - C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 - C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{13893AF3-7C14-43C9-943C-F7375E3FAA88}] - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi [2014-06-02]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-23] (Avira Operations GmbH & Co. KG)
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-05-25] (globalUpdate)
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-05-25] (globalUpdate)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 ssm_bus; C:\Windows\System32\DRIVERS\ssm_bus.sys [136192 2013-06-21] (MCCI Corporation)
S3 ssm_mdfl; C:\Windows\System32\DRIVERS\ssm_mdfl.sys [18944 2013-06-21] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\System32\DRIVERS\ssm_mdm.sys [172032 2013-06-21] (MCCI Corporation)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-04 16:30 - 2014-06-04 16:31 - 00015833 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-04 16:29 - 2014-06-04 16:29 - 02068992 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-04 16:28 - 2014-06-04 16:28 - 01059840 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST.exe
2014-06-04 16:14 - 2014-06-04 16:14 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-04 16:12 - 2014-06-04 16:13 - 00313776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-04 16:12 - 2014-06-04 16:12 - 00009072 _____ () C:\Windows\PFRO.log
2014-06-04 16:12 - 2014-06-04 16:12 - 00000056 _____ () C:\Windows\setupact.log
2014-06-04 16:12 - 2014-06-04 16:12 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-02 22:40 - 2014-06-04 16:30 - 00000000 ____D () C:\FRST
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:11 - 2014-06-02 14:12 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:47 - 2014-06-02 13:48 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:44 - 2014-06-02 13:45 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:21 - 2014-06-02 10:24 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:15 - 2014-06-02 10:19 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-06-01 20:19 - 2014-05-22 18:20 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:56 - 2014-06-02 20:09 - 00000000 ____D () C:\Program Files (x86)\raving reyven
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:55 - 2014-05-25 14:55 - 00003460 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-3.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00002194 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-4.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00001462 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-5.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00001366 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-1.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00000922 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\globalUpdate
2014-05-25 14:55 - 2014-05-25 14:55 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-05-25 14:53 - 2014-06-02 15:15 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 14:51 - 2014-05-25 14:51 - 00468096 _____ () C:\Users\Sabrina Boy\Downloads\ccleaner.exe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-20 20:23 - 2014-05-20 20:55 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-20 20:19 - 2014-06-04 16:31 - 00212527 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 10:59 - 2014-05-14 21:35 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt
2014-05-07 14:00 - 2014-05-07 14:00 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-07 09:26 - 2014-05-07 09:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job

==================== One Month Modified Files and Folders =======

2014-06-04 16:31 - 2014-06-04 16:30 - 00015833 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-04 16:31 - 2014-05-20 20:19 - 00212527 _____ () C:\Windows\WindowsUpdate.log
2014-06-04 16:31 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\Temp
2014-06-04 16:30 - 2014-06-02 22:40 - 00000000 ____D () C:\FRST
2014-06-04 16:29 - 2014-06-04 16:29 - 02068992 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-04 16:28 - 2014-06-04 16:28 - 01059840 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST.exe
2014-06-04 16:20 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-04 16:20 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-04 16:18 - 2010-07-17 20:47 - 00654852 _____ () C:\Windows\system32\perfh007.dat
2014-06-04 16:18 - 2010-07-17 20:47 - 00130434 _____ () C:\Windows\system32\perfc007.dat
2014-06-04 16:18 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-04 16:14 - 2014-06-04 16:14 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-04 16:13 - 2014-06-04 16:12 - 00313776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-04 16:12 - 2014-06-04 16:12 - 00009072 _____ () C:\Windows\PFRO.log
2014-06-04 16:12 - 2014-06-04 16:12 - 00000056 _____ () C:\Windows\setupact.log
2014-06-04 16:12 - 2014-06-04 16:12 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-03 00:19 - 2011-08-12 18:55 - 00000000 ____D () C:\Windows\pss
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken\AppData\Local\Temp
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken
2014-06-03 00:19 - 2010-09-20 15:29 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-03 00:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-06-02 21:58 - 2011-07-06 06:49 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-02 21:07 - 2010-07-17 11:19 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\ProgramData\WildTangent
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\Program Files (x86)\HP Games
2014-06-02 21:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-02 20:09 - 2014-05-25 14:56 - 00000000 ____D () C:\Program Files (x86)\raving reyven
2014-06-02 15:15 - 2014-05-25 14:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:22 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-02 14:21 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy
2014-06-02 14:12 - 2014-06-02 14:11 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:48 - 2014-06-02 13:47 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:45 - 2014-06-02 13:44 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:24 - 2014-06-02 10:21 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:19 - 2014-06-02 10:15 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:57 - 2011-03-05 23:29 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-25 14:57 - 2011-03-05 23:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:55 - 2014-05-25 14:55 - 00003460 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-3.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00002194 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-4.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00001462 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-5.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00001366 _____ () C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-1.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00000922 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2014-05-25 14:55 - 2014-05-25 14:55 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\globalUpdate
2014-05-25 14:55 - 2014-05-25 14:55 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-05-25 14:51 - 2014-05-25 14:51 - 00468096 _____ () C:\Users\Sabrina Boy\Downloads\ccleaner.exe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-22 18:20 - 2014-06-01 20:19 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-20 20:55 - 2014-05-20 20:23 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-16 08:40 - 2013-08-17 21:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 08:37 - 2011-03-11 09:30 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 21:35 - 2014-05-14 10:59 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt
2014-05-07 14:00 - 2014-05-07 14:00 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-07 09:26 - 2014-05-07 09:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job

Some content of TEMP:
====================
C:\Users\Bocken\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-23 14:12

==================== End Of Log ============================
--- --- ---

--- --- ---


....und hier die addition.txt

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by Sabrina Boy at 2014-06-04 16:31:34
Running from C:\Users\Sabrina Boy\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.4.402.265 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.01) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.01 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Bigpoint Games DE Toolbar (HKLM-x32\...\Bigpoint_Games_DE Toolbar) (Version: 6.3.3.3 - Bigpoint Games DE)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0621.2137.36973 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0621.2137.36973 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0621.2137.36973 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0621.2137.36973 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help English (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help French (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help German (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0621.2137.36973 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0621.2137.36973 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.)
CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
ElsterFormular für Privatanwender (HKLM-x32\...\ElsterFormular für Privatanwender 12.2.2.6665p) (Version: 12.2.2.6665p - Landesfinanzdirektion Thüringen)
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
GIMP 2.6.10 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.10 - The GIMP Team)
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{69ABD67D-5C2E-4724-B519-695DEF3EC23B}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Power Manager (HKLM-x32\...\{4B156358-CE9C-4E9F-8CAD-79AE86A68C60}) (Version: 1.0.3 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Software Framework (HKLM-x32\...\{AF6EB833-D48A-49AC-9394-4C57489FDFF2}) (Version: 4.1.13.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{FC17E0A7-EAA9-4902-92F8-C83B9FD02246}) (Version: 5.0.14.2 - Hewlett-Packard Company)
HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe)
MAGIX FunPix Maker 1.0.0.0 (D) (HKLM-x32\...\MAGIX FunPix Maker D) (Version: 1.0.0.0 - MAGIX AG)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version:  - )
Meine CEWE FOTOWELT (HKLM-x32\...\Meine CEWE FOTOWELT) (Version:  - )
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\...\{172423F9-522A-483A-AD65-03600CE4CA4F}) (Version: 9.7.0000 - Microsoft Corporation)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Opticon USB Drivers Installer (HKLM-x32\...\Opticon USB Installer) (Version:  - )
Panel Client 3.2 (HKLM-x32\...\Panel Client_is1) (Version:  - GfK Panel Services Deutschland GmbH)
PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4204 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4204 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version:  - )
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6066 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden
Rossmann Fotowelt Software 4.12.1 (HKLM-x32\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
RtVOsd (HKLM\...\{F3D7AC17-1FF4-41A8-BB18-3FC39C65AEB9}) (Version: 1.0.3 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated)
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WiseConvert 1.3 Toolbar (HKLM-x32\...\WiseConvert_1.3 Toolbar) (Version: 6.9.0.16 - WiseConvert 1.3)
ZoneAlarm Firewall (x32 Version: 11.0.000.057 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm LTD Toolbar (HKLM\...\ZoneAlarm LTD Toolbar) (Version:  - Check Point Software Technologies)
ZoneAlarm Security (x32 Version: 11.0.000.504 - Check Point Software Technologies Ltd.) Hidden

==================== Restore Points  =========================

06-03-2014 11:18:15 Windows Update
15-03-2014 17:34:01 Windows Update
18-03-2014 07:58:39 Windows Update
26-03-2014 08:01:51 Windows Update
28-03-2014 14:58:01 Windows Update
01-04-2014 07:44:57 Windows Update
10-04-2014 10:00:14 Windows Update
15-04-2014 06:41:37 Windows Update
19-04-2014 20:15:54 Windows Update
23-04-2014 07:31:28 Windows Update
26-04-2014 08:58:24 Windows Update
04-05-2014 12:09:52 Windows Update
13-05-2014 12:15:13 Windows Update
14-05-2014 19:45:18 Windows Update
16-05-2014 06:36:48 Windows Update
23-05-2014 03:46:34 Windows Update
01-06-2014 18:23:02 Windows Update
02-06-2014 12:26:08 Windows Update
02-06-2014 19:07:14 Removed HP Quick Launch

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {202921F1-E7D7-4176-8E25-93F243D267CF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-01] (Google Inc.)
Task: {2FA09A2F-D336-4A3D-BDAF-33A9FBFBBA93} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
Task: {56D42C05-48B0-4F8C-8A45-FB99458AD224} - System32\Tasks\BrowserDefendert => Sc.exe start BrowserDefendert <==== ATTENTION
Task: {792FB150-1014-419B-A4C8-A91F410779DA} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {820AA1E8-175F-4B49-8B3C-9DE99DAA2219} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-08-06] (Microsoft)
Task: {9A0B503B-C3D4-472B-BFAC-FD730664E5E5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-06-30] (Hewlett-Packard Company)
Task: {9D2E49C1-0609-45B1-A699-030B02A78611} - System32\Tasks\4803 => Wscript.exe C:\Users\SABRIN~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {A0DF4138-EF01-4104-A7D5-73BB850C169A} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {A4758714-3684-4F53-A5C5-0F7AA2135880} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-01] (Google Inc.)
Task: {B2EAD807-9403-471B-8C4F-867D1566D742} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-06-30] (Hewlett-Packard Company)
Task: {BFF7D14B-6637-44AE-AA9C-C0F090260FA8} - System32\Tasks\COMODO\COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe
Task: {D206E34B-4B1D-495B-AF13-F688B7CA7CD4} - System32\Tasks\HPCeeScheduleForSabrina Boy => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {E8F6FFFC-EB0A-49AE-88B5-F3E810994DE8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: C:\Windows\Tasks\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}.job => C:\Users\SABRIN~1\AppData\Local\Temp\cis281C.exe
Task: C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-1.job => C:\Program Files (x86)\PSHD-9.9\PSHD-9.9-codedownloader.exe
Task: C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-3.job => C:\Program Files (x86)\PSHD-9.9\f0d91f53-b4b4-4abd-95db-8335c8813830-3.exe
Task: C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-4.job => C:\Program Files (x86)\PSHD-9.9\f0d91f53-b4b4-4abd-95db-8335c8813830-4.exe
Task: C:\Windows\Tasks\f0d91f53-b4b4-4abd-95db-8335c8813830-5.job => C:\Program Files (x86)\PSHD-9.9\f0d91f53-b4b4-4abd-95db-8335c8813830-5.exe
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForSabrina Boy.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2010-06-10 17:12 - 2010-06-10 17:12 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-06-21 21:36 - 2010-06-21 21:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2012-11-04 12:34 - 2012-09-19 20:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-01-10 16:44 - 2013-01-10 16:44 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9e5dc5d1c75de12100f8c1d8c65de002\IsdiInterop.ni.dll
2010-09-20 05:39 - 2010-04-13 09:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: KiesPDLR => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/04/2014 04:23:44 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (06/04/2014 04:23:44 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.


CodeIntegrity Errors:
===================================
  Date: 2013-10-07 18:49:18.674
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:18.557
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:16.006
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:15.895
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:13.691
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:13.570
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:11.394
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:11.281
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:09.105
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-10-07 18:49:08.987
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 37%
Total physical RAM: 3893.86 MB
Available physical RAM: 2423.26 MB
Total Pagefile: 7785.86 MB
Available Pagefile: 5940.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:281.96 GB) (Free:203.21 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:15.84 GB) (Free:2.28 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 91CA769B)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End Of Log ============================
ich hoffe es ist hilfreich:wtf:

iss der Rechner jetzt wieder okay und der Trojaner restlos weg?

schrauber 05.06.2014 12:35
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

bocken 05.06.2014 15:44
Hallo,
Hier die neuen Dateien.

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 05.06.2014
Suchlauf-Zeit: 15:40:14
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.05.08
Rootkit Datenbank: v2014.06.02.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7
CPU: x64
Dateisystem: NTFS
Benutzer: Sabrina Boy

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 319662
Verstrichene Zeit: 14 Min, 28 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

Code:
# AdwCleaner v3.211 - Bericht erstellt am 05/06/2014 um 16:08:23
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzername : Sabrina Boy - SABRINASLAPTOP
# Gestartet von : C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : globalUpdate
Dienst Gefunden : globalUpdatem

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gefunden : C:\Users\Public\Desktop\eBay.lnk
Datei Gefunden : C:\Windows\System32\Tasks\BrowserDefendert
Datei Gefunden : C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
Ordner Gefunden : C:\Program Files (x86)\Bigpoint_Games_DE
Ordner Gefunden : C:\Program Files (x86)\globalUpdate
Ordner Gefunden : C:\Program Files (x86)\raving reyven
Ordner Gefunden : C:\Program Files (x86)\WiseConvert_1.3
Ordner Gefunden : C:\ProgramData\Ask
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\BitGuard
Ordner Gefunden : C:\ProgramData\BrowserDefender
Ordner Gefunden : C:\ProgramData\Tarma Installer
Ordner Gefunden : C:\Users\Bocken\AppData\LocalLow\Bigpoint_Games_DE
Ordner Gefunden : C:\Users\Bocken\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Bocken\AppData\LocalLow\ConduitEngine
Ordner Gefunden : C:\Users\Bocken\AppData\LocalLow\Softonic
Ordner Gefunden : C:\Users\Bocken\AppData\LocalLow\WiseConvert_1.3
Ordner Gefunden : C:\Users\Bocken\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\Local\globalUpdate
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\Bigpoint_Games_DE
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\ConduitEngine
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\Delta
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\iac
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\PriceGong
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\Softonic
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\Roaming\Babylon
Ordner Gefunden : C:\Users\Sabrina Boy\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\855d6d0b368eb49
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Bigpoint_Games_DE
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\conduitEngine
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Toolbar
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\WiseConvert_1.3
Schlüssel Gefunden : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gefunden : HKCU\Software\BabSolution
Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\installedbrowserextensions
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E3DBC69-A682-48DA-84E1-82C63A5D678E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E3DBC69-A682-48DA-84E1-82C63A5D678E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC7E25D7-4681-46A3-AF5A-9A1B865783ED}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C66A678D-5E6C-4AF9-8F57-C6192F42CF74}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gefunden : HKCU\Software\Myfree Codec
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\BabSolution
Schlüssel Gefunden : [x64] HKCU\Software\IM
Schlüssel Gefunden : [x64] HKCU\Software\ImInstaller
Schlüssel Gefunden : [x64] HKCU\Software\installedbrowserextensions
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : [x64] HKCU\Software\Myfree Codec
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : HKLM\SOFTWARE\855d6d0b368eb49
Schlüssel Gefunden : HKLM\Software\Bigpoint_Games_DE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{0E3DBC69-A682-48DA-84E1-82C63A5D678E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7D051421-BC1A-4A59-94B7-25C6BA60FE34}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2843456
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT3242337
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gefunden : HKLM\Software\installedbrowserextensions
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8EDD851B-8756-4CB5-A73B-031C9BE3C518}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1568AA1-4A72-459F-B637-D1C758DEB35F}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3B27182-2299-4B34-BE0F-8F354B90D9AF}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F22CF1DA-4C87-471E-A792-1876F8BCDA62}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyDeltaTB_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyDeltaTB_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_gimp[1]_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_gimp[1]_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_magix-funpix-maker[1]_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_magix-funpix-maker[1]_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape[1]_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape[1]_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WiseConvert_1_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WiseConvert_1_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7D051421-BC1A-4A59-94B7-25C6BA60FE34}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bigpoint_Games_DE Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert 1.3 Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_1.3 Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gefunden : HKLM\Software\Myfree Codec
Schlüssel Gefunden : HKLM\Software\WiseConvert_1.3
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Tarma Installer
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0E3DBC69-A682-48DA-84E1-82C63A5D678E}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{0E3DBC69-A682-48DA-84E1-82C63A5D678E}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0E3DBC69-A682-48DA-84E1-82C63A5D678E}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}]

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7600.17267


*************************

AdwCleaner[R0].txt - [15588 octets] - [05/06/2014 16:08:23]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [15649 octets] ##########

Code:
# AdwCleaner v3.211 - Bericht erstellt am 05/06/2014 um 16:09:28
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzername : Sabrina Boy - SABRINASLAPTOP
# Gestartet von : C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : globalUpdate
[#] Dienst Gelöscht : globalUpdatem

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BitGuard
Ordner Gelöscht : C:\ProgramData\BrowserDefender
Ordner Gelöscht : C:\ProgramData\Tarma Installer
[!] Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\raving reyven
Ordner Gelöscht : C:\Program Files (x86)\Bigpoint_Games_DE
Ordner Gelöscht : C:\Program Files (x86)\WiseConvert_1.3
Ordner Gelöscht : C:\Users\Bocken\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Bocken\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Bocken\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Bocken\AppData\LocalLow\Bigpoint_Games_DE
Ordner Gelöscht : C:\Users\Bocken\AppData\LocalLow\WiseConvert_1.3
Ordner Gelöscht : C:\Users\Bocken\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\iac
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\Bigpoint_Games_DE
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Sabrina Boy\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserDefendert
Datei Gelöscht : C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyDeltaTB_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyDeltaTB_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WiseConvert_1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WiseConvert_1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gelöscht : HKCU\Software\855d6d0b368eb49
Schlüssel Gelöscht : HKLM\SOFTWARE\855d6d0b368eb49
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2843456
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3242337
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_gimp[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_gimp[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_magix-funpix-maker[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_magix-funpix-maker[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0E3DBC69-A682-48DA-84E1-82C63A5D678E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7D051421-BC1A-4A59-94B7-25C6BA60FE34}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC7E25D7-4681-46A3-AF5A-9A1B865783ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C66A678D-5E6C-4AF9-8F57-C6192F42CF74}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E3DBC69-A682-48DA-84E1-82C63A5D678E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E3DBC69-A682-48DA-84E1-82C63A5D678E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7D051421-BC1A-4A59-94B7-25C6BA60FE34}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1568AA1-4A72-459F-B637-D1C758DEB35F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3B27182-2299-4B34-BE0F-8F354B90D9AF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F22CF1DA-4C87-471E-A792-1876F8BCDA62}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8EDD851B-8756-4CB5-A73B-031C9BE3C518}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0E3DBC69-A682-48DA-84E1-82C63A5D678E}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{0E3DBC69-A682-48DA-84E1-82C63A5D678E}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0E3DBC69-A682-48DA-84E1-82C63A5D678E}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKLM\Software\installedbrowserextensions
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\Software\Bigpoint_Games_DE
Schlüssel Gelöscht : HKLM\Software\WiseConvert_1.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert 1.3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bigpoint_Games_DE Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_1.3 Toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7600.17267


*************************

AdwCleaner[R0].txt - [15846 octets] - [05/06/2014 16:08:23]
AdwCleaner[S0].txt - [14288 octets] - [05/06/2014 16:09:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14349 octets] ##########

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Sabrina Boy on 05.06.2014 at 16:21:21,90
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2899099275-4155470742-1896681866-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110511291116}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110511291116}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9AA0EE78-F120-4F67-8760-0DE1FE14D329}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9AA0EE78-F120-4F67-8760-0DE1FE14D329}



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\sho4E57.tmp



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.06.2014 at 16:28:32,71
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Sabrina Boy (administrator) on SABRINASLAPTOP on 05-06-2014 16:35:15
Running from C:\Users\Sabrina Boy\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: F - F:\ting.exe
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: {245b7740-b66e-11e2-9d25-a6699b6f42c6} - F:\ting.exe
HKU\S-1-5-21-2899099275-4155470742-1896681866-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\S-1-5-21-2899099275-4155470742-1896681866-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-2899099275-4155470742-1896681866-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Policies\system: [DisableChangePassword] 0
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
URLSearchHook: HKCU - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {13C2FF9F-313B-48DC-A2D2-DA4A07002C34} URL =
SearchScopes: HKCU - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL =
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  No File
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
DPF: HKLM-x32 {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab
DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2010-07-17] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{13893AF3-7C14-43C9-943C-F7375E3FAA88}] - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi [2014-06-02]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 ssm_bus; C:\Windows\System32\DRIVERS\ssm_bus.sys [136192 2013-06-21] (MCCI Corporation)
S3 ssm_mdfl; C:\Windows\System32\DRIVERS\ssm_mdfl.sys [18944 2013-06-21] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\System32\DRIVERS\ssm_mdm.sys [172032 2013-06-21] (MCCI Corporation)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:20 - 2014-06-05 16:21 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:11 - 2014-06-05 16:11 - 00007412 _____ () C:\Windows\PFRO.log
2014-06-05 16:08 - 2014-06-05 16:09 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:02 - 2014-06-05 16:07 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-05 15:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-05 15:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-05 15:32 - 2014-06-05 15:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-05 15:20 - 2014-06-05 16:33 - 00000224 _____ () C:\Windows\setupact.log
2014-06-05 15:20 - 2014-06-05 15:20 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-05 15:20 - 2014-06-05 15:20 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-05 15:19 - 2014-06-05 15:20 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-04 16:31 - 2014-06-04 16:32 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-04 16:30 - 2014-06-05 16:35 - 00011335 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-04 16:29 - 2014-06-04 16:29 - 02068992 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-04 16:28 - 2014-06-04 16:28 - 01059840 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST.exe
2014-06-02 22:40 - 2014-06-05 16:35 - 00000000 ____D () C:\FRST
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:11 - 2014-06-02 14:12 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:47 - 2014-06-02 13:48 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:44 - 2014-06-02 13:45 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:21 - 2014-06-02 10:24 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:15 - 2014-06-02 10:19 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-06-01 20:19 - 2014-05-22 18:20 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:53 - 2014-06-02 15:15 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-20 20:23 - 2014-05-20 20:55 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-20 20:19 - 2014-06-05 16:11 - 00255535 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 10:59 - 2014-05-14 21:35 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt
2014-05-07 14:00 - 2014-05-07 14:00 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-07 09:26 - 2014-05-07 09:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job

==================== One Month Modified Files and Folders =======

2014-06-05 16:35 - 2014-06-04 16:30 - 00011335 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-05 16:35 - 2014-06-02 22:40 - 00000000 ____D () C:\FRST
2014-06-05 16:35 - 2014-05-20 20:19 - 00255535 _____ () C:\Windows\WindowsUpdate.log
2014-06-05 16:35 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\Temp
2014-06-05 16:33 - 2014-06-05 15:20 - 00000224 _____ () C:\Windows\setupact.log
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:21 - 2014-06-05 16:20 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:19 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-05 16:19 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-05 16:16 - 2010-07-17 20:47 - 00654852 _____ () C:\Windows\system32\perfh007.dat
2014-06-05 16:16 - 2010-07-17 20:47 - 00130434 _____ () C:\Windows\system32\perfc007.dat
2014-06-05 16:16 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-05 16:11 - 2014-06-05 16:11 - 00007412 _____ () C:\Windows\PFRO.log
2014-06-05 16:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2014-06-05 16:09 - 2014-06-05 16:08 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:07 - 2014-06-05 16:02 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:36 - 2014-06-05 15:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-05 15:25 - 2013-03-29 11:57 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-05 15:25 - 2013-03-29 11:57 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-05 15:20 - 2014-06-05 15:20 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-05 15:20 - 2014-06-05 15:20 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-05 15:20 - 2014-06-05 15:19 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-04 16:32 - 2014-06-04 16:31 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-04 16:29 - 2014-06-04 16:29 - 02068992 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-04 16:28 - 2014-06-04 16:28 - 01059840 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST.exe
2014-06-03 00:19 - 2011-08-12 18:55 - 00000000 ____D () C:\Windows\pss
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken\AppData\Local\Temp
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken
2014-06-03 00:19 - 2010-09-20 15:29 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-03 00:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-06-02 21:58 - 2011-07-06 06:49 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-02 21:07 - 2010-07-17 11:19 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\ProgramData\WildTangent
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\Program Files (x86)\HP Games
2014-06-02 21:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-02 15:15 - 2014-05-25 14:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:22 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-02 14:21 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy
2014-06-02 14:12 - 2014-06-02 14:11 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:48 - 2014-06-02 13:47 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:45 - 2014-06-02 13:44 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:24 - 2014-06-02 10:21 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:19 - 2014-06-02 10:15 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:57 - 2011-03-05 23:29 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-25 14:57 - 2011-03-05 23:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-22 18:20 - 2014-06-01 20:19 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-20 20:55 - 2014-05-20 20:23 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-16 08:40 - 2013-08-17 21:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 08:37 - 2011-03-11 09:30 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 21:35 - 2014-05-14 10:59 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt
2014-05-12 07:26 - 2014-06-05 15:37 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-05 15:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-05 15:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-07 14:00 - 2014-05-07 14:00 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-07 09:26 - 2014-05-07 09:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69c5bb9541dd.job

Some content of TEMP:
====================
C:\Users\Bocken\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-23 14:12

==================== End Of Log ============================
--- --- ---

--- --- ---



...ich hoffe es hilft...

schrauber 06.06.2014 11:46

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

bocken 10.06.2014 15:22
hallo....



Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=7143f38ac6642a479ef5570892c9ff8d
# engine=18648
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-10 11:40:05
# local_time=2014-06-10 01:40:05 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 1312 267820095 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 1211 154030255 0 0
# scanned=13220
# found=15
# cleaned=0
# scan_time=276
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bigpoint_Games_DE\tbBigp.dll.vir"
sh=A1280B1F085B8284DC157EC359BD1ADA091CFE7E ft=1 fh=d8aa3384d1249a40 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\ldrtbWise.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll.vir"
sh=92E84D2216A7763D580E42FA2493CCF67D0D0560 ft=1 fh=e8efc42494afd9f6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\tbWise.dll.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\WiseConvert_1.3ToolbarHelper.exe.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\Bigpoint_Games_DE\tbBigp.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\ConduitEngine\ConduitEngine.dll.vir"
sh=A1280B1F085B8284DC157EC359BD1ADA091CFE7E ft=1 fh=d8aa3384d1249a40 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\WiseConvert_1.3\ldrtbWise.dll.vir"
sh=92E84D2216A7763D580E42FA2493CCF67D0D0560 ft=1 fh=e8efc42494afd9f6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\WiseConvert_1.3\tbWise.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\Bigpoint_Games_DE\tbBigp.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\ConduitEngine\ConduitEngine.dll.vir"
sh=A1280B1F085B8284DC157EC359BD1ADA091CFE7E ft=1 fh=d8aa3384d1249a40 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3\ldrtbWise.dll.vir"
sh=92E84D2216A7763D580E42FA2493CCF67D0D0560 ft=1 fh=e8efc42494afd9f6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3\tbWise.dll.vir"
sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll.vir"
sh=37F73DA65248F8F4BE634106CD017C160637AC3C ft=1 fh=3fb3cb70b18ab9a7 vn="Variante von Win64/Kryptik.FZ Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\11764AFC2A3364905E8D1EAE8BD77172\gggwyg.dot"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=7143f38ac6642a479ef5570892c9ff8d
# engine=18648
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-10 01:53:17
# local_time=2014-06-10 03:53:17 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 9304 267828087 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 9203 154038247 0 0
# scanned=253416
# found=35
# cleaned=0
# scan_time=7507
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bigpoint_Games_DE\tbBigp.dll.vir"
sh=A1280B1F085B8284DC157EC359BD1ADA091CFE7E ft=1 fh=d8aa3384d1249a40 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\ldrtbWise.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll.vir"
sh=92E84D2216A7763D580E42FA2493CCF67D0D0560 ft=1 fh=e8efc42494afd9f6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\tbWise.dll.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WiseConvert_1.3\WiseConvert_1.3ToolbarHelper.exe.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\Bigpoint_Games_DE\tbBigp.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\ConduitEngine\ConduitEngine.dll.vir"
sh=A1280B1F085B8284DC157EC359BD1ADA091CFE7E ft=1 fh=d8aa3384d1249a40 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\WiseConvert_1.3\ldrtbWise.dll.vir"
sh=92E84D2216A7763D580E42FA2493CCF67D0D0560 ft=1 fh=e8efc42494afd9f6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Bocken\AppData\LocalLow\WiseConvert_1.3\tbWise.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\Bigpoint_Games_DE\tbBigp.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\ConduitEngine\ConduitEngine.dll.vir"
sh=A1280B1F085B8284DC157EC359BD1ADA091CFE7E ft=1 fh=d8aa3384d1249a40 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3\ldrtbWise.dll.vir"
sh=92E84D2216A7763D580E42FA2493CCF67D0D0560 ft=1 fh=e8efc42494afd9f6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3\tbWise.dll.vir"
sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Sabrina Boy\AppData\LocalLow\WiseConvert_1.3\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll.vir"
sh=37F73DA65248F8F4BE634106CD017C160637AC3C ft=1 fh=3fb3cb70b18ab9a7 vn="Variante von Win64/Kryptik.FZ Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\11764AFC2A3364905E8D1EAE8BD77172\11764AFC2A3364905E8D1EAE8BD77172\gggwyg.dot"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\apnic.dll"
sh=1A3F14C0A66F9AF050D1F34FBACBAADC31751A07 ft=1 fh=2704a03a0f47b728 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\apntoolbarinstaller.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=F5EE1489F5BD5427F1EA65441E5DCCA924E31336 ft=1 fh=eae9470eeeee5c10 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll"
sh=298A0B2E376066F775AAF9B794D2EFD3C6786B07 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabrina Boy\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.49_0\extensionData\plugins\91.js"
sh=EE9717AD935A15AB07DD2E226398C2D9082D8E82 ft=1 fh=b775fe24c08839c1 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\avira_free_antivirus_de.exe"
sh=B289C53DBB01232884364F964E8A5BCCDFBCE00A ft=1 fh=20604ce9407285e3 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup310.exe"
sh=3FC75D7EC85B4B4766AE1195896F0C2C5FB3E6FE ft=1 fh=f3111313b4ad1f30 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup314.exe"
sh=DC1FE696A24E0072BA7221FCB0DAFEDB9B3560B4 ft=1 fh=5aa7e24d05d642d5 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup315.exe"
sh=2E9FC5EE22DDB3588857BAEB1EC51885EB3D3C27 ft=1 fh=78aa2c558c3526a3 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup318.exe"
sh=7EF1CA17E9835CBBA989D1F2CFEF4B794D928D13 ft=1 fh=c7fc25b20d8e6134 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup320.exe"
sh=432E95C9B13671B563FDDECA6C408A763B4020F8 ft=1 fh=5a87b2eed39a59c6 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup321.exe"
sh=B876F5F15137EF8A1680C2AC04DC786D2A191DC9 ft=1 fh=850ac12ce80cbbb1 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup322.exe"
sh=9EBEEAD23C136B3C8E6CC0220B4F47C3D67B9B4D ft=1 fh=f7cfbc4528e170a2 vn="Win32/Bundled.Toolbar.Google.E potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\ccsetup324.exe"
sh=868CA1776E5A96E6221DF0314BDCB6E827C50966 ft=1 fh=1951e73c8fe5e4b6 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\Comodo_Firewall_-_CHIP-Downloader.exe"
sh=3531F9AD7200E584FE9CED4461E924FB8A94FECE ft=1 fh=adfdf198dd8ec87e vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabrina Boy\Downloads\FreeOCR_-_CHIP-Downloader.exe"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ApnIC[1].0"
sh=E32AA2E78D2C8F0E9316080E71A714BEFE851E6C ft=1 fh=374915f71a49693e vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[2].0"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ApnIC[1].0"
sh=E32AA2E78D2C8F0E9316080E71A714BEFE851E6C ft=1 fh=374915f71a49693e vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[2].0"

schrauber 11.06.2014 08:50
und der Rest?

bocken 12.06.2014 11:45
hallo,...


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 01
Ran by Sabrina Boy (administrator) on SABRINASLAPTOP on 12-06-2014 12:37:16
Running from C:\Users\Sabrina Boy\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_4_402_265_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: F - F:\ting.exe
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: {245b7740-b66e-11e2-9d25-a6699b6f42c6} - F:\ting.exe
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
URLSearchHook: HKCU - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {13C2FF9F-313B-48DC-A2D2-DA4A07002C34} URL =
SearchScopes: HKCU - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL =
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  No File
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
DPF: HKLM-x32 {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab
DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2010-07-17] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{13893AF3-7C14-43C9-943C-F7375E3FAA88}] - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi [2014-06-02]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [121344 2010-06-30] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 RtVOsdService; C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [315392 2010-06-17] (Realtek Semiconductor Corp.) [File not signed]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] () [File not signed]
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 ssm_bus; C:\Windows\System32\DRIVERS\ssm_bus.sys [136192 2013-06-21] (MCCI Corporation)
S3 ssm_mdfl; C:\Windows\System32\DRIVERS\ssm_mdfl.sys [18944 2013-06-21] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\System32\DRIVERS\ssm_mdm.sys [172032 2013-06-21] (MCCI Corporation)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-12 12:37 - 2014-06-12 12:37 - 00011865 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-12 12:36 - 2014-06-12 12:36 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\FRST-OlderVersion
2014-06-12 12:13 - 2014-06-12 12:14 - 00854367 _____ () C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
2014-06-12 11:56 - 2014-06-12 11:56 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00000056 _____ () C:\Windows\setupact.log
2014-06-12 11:55 - 2014-06-12 11:55 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-10 13:32 - 2014-06-10 13:32 - 02347384 _____ (ESET) C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe
2014-06-10 13:32 - 2014-06-10 13:32 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:20 - 2014-06-05 16:21 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:08 - 2014-06-05 16:09 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:02 - 2014-06-05 16:07 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-05 15:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-05 15:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-05 15:32 - 2014-06-05 15:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-04 16:31 - 2014-06-04 16:32 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-04 16:29 - 2014-06-12 12:36 - 02081792 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-02 22:40 - 2014-06-12 12:37 - 00000000 ____D () C:\FRST
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:11 - 2014-06-02 14:12 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:47 - 2014-06-02 13:48 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:44 - 2014-06-02 13:45 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:21 - 2014-06-02 10:24 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:15 - 2014-06-02 10:19 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-06-01 20:19 - 2014-05-22 18:20 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:53 - 2014-06-02 15:15 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-20 20:23 - 2014-05-20 20:55 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-20 20:19 - 2014-06-12 12:14 - 00363900 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 10:59 - 2014-05-14 21:35 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt

==================== One Month Modified Files and Folders =======

2014-06-12 12:38 - 2014-06-12 12:37 - 00011865 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-12 12:38 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\Temp
2014-06-12 12:37 - 2014-06-02 22:40 - 00000000 ____D () C:\FRST
2014-06-12 12:37 - 2014-05-20 20:19 - 00363900 _____ () C:\Windows\WindowsUpdate.log
2014-06-12 12:36 - 2014-06-12 12:36 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\FRST-OlderVersion
2014-06-12 12:36 - 2014-06-04 16:29 - 02081792 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-12 12:14 - 2014-06-12 12:13 - 00854367 _____ () C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
2014-06-12 12:03 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 12:03 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 12:00 - 2010-07-17 20:47 - 00654852 _____ () C:\Windows\system32\perfh007.dat
2014-06-12 12:00 - 2010-07-17 20:47 - 00130434 _____ () C:\Windows\system32\perfc007.dat
2014-06-12 12:00 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-12 11:56 - 2014-06-12 11:56 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00000056 _____ () C:\Windows\setupact.log
2014-06-12 11:55 - 2014-06-12 11:55 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-10 13:32 - 2014-06-10 13:32 - 02347384 _____ (ESET) C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe
2014-06-10 13:32 - 2014-06-10 13:32 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-10 13:32 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy
2014-06-10 13:25 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken\AppData\Local\Temp
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:21 - 2014-06-05 16:20 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2014-06-05 16:09 - 2014-06-05 16:08 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:07 - 2014-06-05 16:02 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:36 - 2014-06-05 15:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-05 15:25 - 2013-03-29 11:57 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-05 15:25 - 2013-03-29 11:57 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 16:32 - 2014-06-04 16:31 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-03 00:19 - 2011-08-12 18:55 - 00000000 ____D () C:\Windows\pss
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken
2014-06-03 00:19 - 2010-09-20 15:29 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-03 00:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-06-02 21:58 - 2011-07-06 06:49 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-02 21:07 - 2010-07-17 11:19 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\ProgramData\WildTangent
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\Program Files (x86)\HP Games
2014-06-02 21:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-02 15:15 - 2014-05-25 14:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:22 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-02 14:12 - 2014-06-02 14:11 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:48 - 2014-06-02 13:47 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:45 - 2014-06-02 13:44 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:24 - 2014-06-02 10:21 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:19 - 2014-06-02 10:15 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:57 - 2011-03-05 23:29 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-25 14:57 - 2011-03-05 23:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-22 18:20 - 2014-06-01 20:19 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-20 20:55 - 2014-05-20 20:23 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-16 08:40 - 2013-08-17 21:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 08:37 - 2011-03-11 09:30 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 21:35 - 2014-05-14 10:59 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt

Files to move or delete:
====================
C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe


Some content of TEMP:
====================
C:\Users\Bocken\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-06-23 14:12

==================== End Of Log ============================
--- --- ---



Code:
Results of screen317's Security Check version 0.99.83 
 Windows 7  x64 
 Out of date service pack!!
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
Avira Desktop 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Reader XI 
````````Process Check: objlist.exe by Laurent```````` 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

bitte schön....

und nu?

schrauber 12.06.2014 11:53
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Windows updaten, da fehlt ein Servicvepack!!


Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.



bocken 12.06.2014 11:56
hallo..


Code:
Results of screen317's Security Check version 0.99.83 
 Windows 7  x64 
 Out of date service pack!!
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
Avira Desktop 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Reader XI 
````````Process Check: objlist.exe by Laurent```````` 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 01
Ran by Sabrina Boy (administrator) on SABRINASLAPTOP on 12-06-2014 12:37:16
Running from C:\Users\Sabrina Boy\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_4_402_265_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: F - F:\ting.exe
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: {245b7740-b66e-11e2-9d25-a6699b6f42c6} - F:\ting.exe
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
URLSearchHook: HKCU - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {13C2FF9F-313B-48DC-A2D2-DA4A07002C34} URL =
SearchScopes: HKCU - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL =
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  No File
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
DPF: HKLM-x32 {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab
DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2010-07-17] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{13893AF3-7C14-43C9-943C-F7375E3FAA88}] - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi [2014-06-02]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [121344 2010-06-30] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 RtVOsdService; C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [315392 2010-06-17] (Realtek Semiconductor Corp.) [File not signed]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] () [File not signed]
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 ssm_bus; C:\Windows\System32\DRIVERS\ssm_bus.sys [136192 2013-06-21] (MCCI Corporation)
S3 ssm_mdfl; C:\Windows\System32\DRIVERS\ssm_mdfl.sys [18944 2013-06-21] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\System32\DRIVERS\ssm_mdm.sys [172032 2013-06-21] (MCCI Corporation)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-12 12:37 - 2014-06-12 12:37 - 00011865 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-12 12:36 - 2014-06-12 12:36 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\FRST-OlderVersion
2014-06-12 12:13 - 2014-06-12 12:14 - 00854367 _____ () C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
2014-06-12 11:56 - 2014-06-12 11:56 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00000056 _____ () C:\Windows\setupact.log
2014-06-12 11:55 - 2014-06-12 11:55 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-10 13:32 - 2014-06-10 13:32 - 02347384 _____ (ESET) C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe
2014-06-10 13:32 - 2014-06-10 13:32 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:20 - 2014-06-05 16:21 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:08 - 2014-06-05 16:09 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:02 - 2014-06-05 16:07 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-05 15:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-05 15:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-05 15:32 - 2014-06-05 15:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-04 16:31 - 2014-06-04 16:32 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-04 16:29 - 2014-06-12 12:36 - 02081792 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-02 22:40 - 2014-06-12 12:37 - 00000000 ____D () C:\FRST
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:11 - 2014-06-02 14:12 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:47 - 2014-06-02 13:48 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:44 - 2014-06-02 13:45 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:21 - 2014-06-02 10:24 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:15 - 2014-06-02 10:19 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-06-01 20:19 - 2014-05-22 18:20 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:53 - 2014-06-02 15:15 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-20 20:23 - 2014-05-20 20:55 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-20 20:19 - 2014-06-12 12:14 - 00363900 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 10:59 - 2014-05-14 21:35 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt

==================== One Month Modified Files and Folders =======

2014-06-12 12:38 - 2014-06-12 12:37 - 00011865 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-12 12:38 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\Temp
2014-06-12 12:37 - 2014-06-02 22:40 - 00000000 ____D () C:\FRST
2014-06-12 12:37 - 2014-05-20 20:19 - 00363900 _____ () C:\Windows\WindowsUpdate.log
2014-06-12 12:36 - 2014-06-12 12:36 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\FRST-OlderVersion
2014-06-12 12:36 - 2014-06-04 16:29 - 02081792 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-12 12:14 - 2014-06-12 12:13 - 00854367 _____ () C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
2014-06-12 12:03 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 12:03 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 12:00 - 2010-07-17 20:47 - 00654852 _____ () C:\Windows\system32\perfh007.dat
2014-06-12 12:00 - 2010-07-17 20:47 - 00130434 _____ () C:\Windows\system32\perfc007.dat
2014-06-12 12:00 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-12 11:56 - 2014-06-12 11:56 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-12 11:55 - 2014-06-12 11:55 - 00000056 _____ () C:\Windows\setupact.log
2014-06-12 11:55 - 2014-06-12 11:55 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-10 13:32 - 2014-06-10 13:32 - 02347384 _____ (ESET) C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe
2014-06-10 13:32 - 2014-06-10 13:32 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-10 13:32 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy
2014-06-10 13:25 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken\AppData\Local\Temp
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:21 - 2014-06-05 16:20 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2014-06-05 16:09 - 2014-06-05 16:08 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:07 - 2014-06-05 16:02 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:36 - 2014-06-05 15:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-05 15:25 - 2013-03-29 11:57 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-05 15:25 - 2013-03-29 11:57 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 16:32 - 2014-06-04 16:31 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-03 00:19 - 2011-08-12 18:55 - 00000000 ____D () C:\Windows\pss
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken
2014-06-03 00:19 - 2010-09-20 15:29 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-03 00:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-06-02 21:58 - 2011-07-06 06:49 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-02 21:07 - 2010-07-17 11:19 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\ProgramData\WildTangent
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\Program Files (x86)\HP Games
2014-06-02 21:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-02 15:15 - 2014-05-25 14:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-06-02 14:22 - 2014-06-02 14:22 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:22 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-02 14:12 - 2014-06-02 14:11 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:48 - 2014-06-02 13:47 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:45 - 2014-06-02 13:44 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:24 - 2014-06-02 10:21 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:19 - 2014-06-02 10:15 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:57 - 2011-03-05 23:29 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-25 14:57 - 2011-03-05 23:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-22 18:20 - 2014-06-01 20:19 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-05-20 20:55 - 2014-05-20 20:23 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-16 08:40 - 2013-08-17 21:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 08:37 - 2011-03-11 09:30 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 21:35 - 2014-05-14 10:59 - 00015363 _____ () C:\Users\Sabrina Boy\Documents\Widerspruch Bescheid Bock 2013.odt

Files to move or delete:
====================
C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe


Some content of TEMP:
====================
C:\Users\Bocken\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-06-23 14:12

==================== End Of Log ============================
--- --- ---



bitte schön...
und nu?:abklatsch:

schrauber 12.06.2014 11:59
Öhm, du hast meinen obigen Post schon gesehen? :)

bocken 16.06.2014 21:46
hallo..

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-06-2014
Ran by Sabrina Boy at 2014-06-16 22:37:02 Run:2
Running from C:\Users\Sabrina Boy\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-05-22] (StdLib)
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
       
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64 => Service stopped successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64 => Service deleted successfully.
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys => Moved successfully.


The system needed a reboot.

==== End of Fixlog ====
Code:
Farbar Service Scanner Version: 10-06-2014
Ran by Sabrina Boy (administrator) on 16-06-2014 at 22:43:38
Running from "C:\Users\Sabrina Boy\Desktop"
Microsoft Windows 7 Home Premium  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is set to Demand. The default start type is Auto.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****
bitte...

windows update wurde durchgeführt, er bietet mir kein weiteres serviceupdate an....

schrauber 17.06.2014 09:53
Ist Servicepack 1 jetzt installiert?

http://www.trojaner-board.de/126216-...epair-aio.html
Das bitte machen, dann ein frisches FSS und FRST log bitte.

bocken 18.06.2014 15:13
hallo....

Code:
System Variables
--------------------------------------------------------------------------------
OS: Windows 7 Home Premium
OS Architecture: 64-bit
OS Version: 6.1.7600
OS Service Pack:
Computer Name: SABRINASLAPTOP
Windows Drive: C:\
Windows Path: C:\Windows
Current Profile: C:\Users\Sabrina Boy
Current Profile SID: S-1-5-21-2899099275-4155470742-1896681866-1000
Current Profile Classes: S-1-5-21-2899099275-4155470742-1896681866-1000_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Sabrina Boy\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 00:26:34

Process Count: 73
Commit Total: 1,72 GB
Commit Limit: 7,60 GB
Commit Peak: 1,80 GB
Handle Count: 19401
Kernel Total: 329,17 MB
Kernel Paged: 247,09 MB
Kernel Non Paged: 82,07 MB
System Cache: 6,55 GB
Thread Count: 802
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3,80 GB
Memory Used: 1,35 GB(35,4826%)
Memory Avail.: 2,45 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3,80 GB
Memory Used: 1,08 GB(28,3584%)
Memory Avail.: 2,72 GB
--------------------------------------------------------------------------------

Starting Repairs...
  Start (18.06.2014 15:28:52)

01 - Reset Registry Permissions 01/03
  HKEY_CURRENT_USER & Sub Keys
  Start (18.06.2014 15:28:58)
  Running Repair Under Current User Account
  Done (18.06.2014 15:29:03)

01 - Reset Registry Permissions 02/03
  HKEY_LOCAL_MACHINE & Sub Keys
  Start (18.06.2014 15:29:03)
  Running Repair Under System Account
  Done (18.06.2014 15:30:38)

01 - Reset Registry Permissions 03/03
  HKEY_CLASSES_ROOT & Sub Keys
  Start (18.06.2014 15:30:38)
  Running Repair Under System Account
  Done (18.06.2014 15:31:35)

02 - Reset File Permissions: C:
  C: & Sub Folders
  Start (18.06.2014 15:31:35)
  Running Repair Under System Account
  Done (18.06.2014 15:42:20)

02 - Reset File Permissions: D:
  D: & Sub Folders
  Start (18.06.2014 15:42:20)
  Running Repair Under System Account
  Done (18.06.2014 15:42:22)

02 - Reset File Permissions: Q:
  Q: & Sub Folders
  Start (18.06.2014 15:42:22)
  Running Repair Under System Account
  Done (18.06.2014 15:42:25)

02 - Reset File Permissions: All Profiles
  C:\Users & Sub Folders
  Start (18.06.2014 15:42:25)
  Running Repair Under System Account
  Done (18.06.2014 15:45:02)

02 - Reset File Permissions: Current Profile
  C:\Users\Sabrina Boy & Sub Folders
  Start (18.06.2014 15:45:02)
  Running Repair Under System Account
  Done (18.06.2014 15:45:56)

02 - Reset File Permissions: Cleanup
  Repairing Restricted Folders Permissions To Avoid Infinite Loops
  Start (18.06.2014 15:45:57)
  Running Repair Under System Account
Processing ACL of: <\\?\C:\Documents and Settings>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Desktop>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Favorites>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Desktop>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Favorites>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default User>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Cookies>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Local Settings>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\My Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\NetHood>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\PrintHood>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\History>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Music>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Pictures>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Videos>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Public\Documents\My Music>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Public\Documents\My Pictures>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Public\Documents\My Videos>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Administrator\Application Data>
Reading the SD from <\\?\C:\Users\Administrator\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Cookies>
Reading the SD from <\\?\C:\Users\Administrator\Cookies> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Local Settings>
Reading the SD from <\\?\C:\Users\Administrator\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\My Documents>
Reading the SD from <\\?\C:\Users\Administrator\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\NetHood>
Reading the SD from <\\?\C:\Users\Administrator\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\PrintHood>
Reading the SD from <\\?\C:\Users\Administrator\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Recent>
Reading the SD from <\\?\C:\Users\Administrator\Recent> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\SendTo>
Reading the SD from <\\?\C:\Users\Administrator\SendTo> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Start Menu>
Reading the SD from <\\?\C:\Users\Administrator\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Templates>
Reading the SD from <\\?\C:\Users\Administrator\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\Administrator\AppData\Local\Application Data> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\AppData\Local\History>
Reading the SD from <\\?\C:\Users\Administrator\AppData\Local\History> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\AppData\Local\Temporary Internet Files>
Reading the SD from <\\?\C:\Users\Administrator\AppData\Local\Temporary Internet Files> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Documents\My Music>
Reading the SD from <\\?\C:\Users\Administrator\Documents\My Music> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\Administrator\Documents\My Pictures> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Documents\My Videos>
Reading the SD from <\\?\C:\Users\Administrator\Documents\My Videos> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Application Data>
Reading the SD from <\\?\C:\Users\AppData\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Cookies>
Reading the SD from <\\?\C:\Users\AppData\Cookies> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Local Settings>
Reading the SD from <\\?\C:\Users\AppData\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\My Documents>
Reading the SD from <\\?\C:\Users\AppData\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\NetHood>
Reading the SD from <\\?\C:\Users\AppData\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\PrintHood>
Reading the SD from <\\?\C:\Users\AppData\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Recent>
Reading the SD from <\\?\C:\Users\AppData\Recent> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\SendTo>
Reading the SD from <\\?\C:\Users\AppData\SendTo> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Start Menu>
Reading the SD from <\\?\C:\Users\AppData\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Templates>
Reading the SD from <\\?\C:\Users\AppData\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\AppData\AppData\Local\Application Data> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\AppData\Local\History>
Reading the SD from <\\?\C:\Users\AppData\AppData\Local\History> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\AppData\Local\Temporary Internet Files>
Reading the SD from <\\?\C:\Users\AppData\AppData\Local\Temporary Internet Files> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Documents\My Music>
Reading the SD from <\\?\C:\Users\AppData\Documents\My Music> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\AppData\Documents\My Pictures> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\AppData\Documents\My Videos>
Reading the SD from <\\?\C:\Users\AppData\Documents\My Videos> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\Application Data>
Reading the SD from <\\?\C:\Users\Bocken\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\Cookies>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Bocken\Local Settings>
Reading the SD from <\\?\C:\Users\Bocken\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\My Documents>
Reading the SD from <\\?\C:\Users\Bocken\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\NetHood>
Reading the SD from <\\?\C:\Users\Bocken\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\PrintHood>
Reading the SD from <\\?\C:\Users\Bocken\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Bocken\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Bocken\Start Menu>
Reading the SD from <\\?\C:\Users\Bocken\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\Templates>
Reading the SD from <\\?\C:\Users\Bocken\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\Bocken\AppData\Local\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\AppData\Local\History>
Reading the SD from <\\?\C:\Users\Bocken\AppData\Local\History> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Bocken\Documents\My Music>
Reading the SD from <\\?\C:\Users\Bocken\Documents\My Music> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\Bocken\Documents\My Pictures> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Bocken\Documents\My Videos>
Reading the SD from <\\?\C:\Users\Bocken\Documents\My Videos> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\Application Data>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\Cookies>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Sabrina Boy\Local Settings>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\My Documents>
Reading the SD from <\\?\C:\Users\Sabrina Boy\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\NetHood>
Reading the SD from <\\?\C:\Users\Sabrina Boy\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\PrintHood>
Reading the SD from <\\?\C:\Users\Sabrina Boy\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Sabrina Boy\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Sabrina Boy\Start Menu>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\Templates>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\Sabrina Boy\AppData\Local\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\AppData\Local\History>
Reading the SD from <\\?\C:\Users\Sabrina Boy\AppData\Local\History> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Sabrina Boy\Documents\My Music>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Documents\My Music> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Documents\My Pictures> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Sabrina Boy\Documents\My Videos>
Reading the SD from <\\?\C:\Users\Sabrina Boy\Documents\My Videos> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s):
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

  Done (18.06.2014 15:46:01)

03 - Register System Files
  Start (18.06.2014 15:46:01)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:46:35)

04 - Repair WMI
  Start (18.06.2014 15:46:35)

  Starting Security Center So We Can Export The Security Info.

  Exporting Antivirus Info...
  Avira Desktop Exported.

  Exporting AntiSpyware Info...
  Avira Desktop Exported.
  Windows Defender Exported.

  Exporting 3rd Party Firewall Info...
  No Firewall Products Reported.

  Running Repair Under Current User Account
  Done (18.06.2014 15:49:02)

05 - Repair Windows Firewall
  Start (18.06.2014 15:49:02)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:49:36)

06 - Repair Internet Explorer
  Start (18.06.2014 15:49:36)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:50:04)

07 - Repair MDAC/MS Jet
  Start (18.06.2014 15:50:04)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:50:15)

08 - Repair Hosts File
  Start (18.06.2014 15:50:15)
  Running Repair Under System Account
  Done (18.06.2014 15:50:17)

09 - Remove Policies Set By Infections
  Start (18.06.2014 15:50:17)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:50:22)

10 - Repair Start Menu Icons Removed By Infections
  Start (18.06.2014 15:50:22)
  Running Repair Under System Account
  Done (18.06.2014 15:50:24)

11 - Repair Icons
  Start (18.06.2014 15:50:25)
  Running Repair Under Current User Account
  Done (18.06.2014 15:50:27)

12 - Repair Winsock & DNS Cache
  Start (18.06.2014 15:50:27)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:50:53)

13 - Remove Temp Files
  Start (18.06.2014 15:50:53)
  Running Repair Under System Account
  Done (18.06.2014 15:50:55)

14 - Repair Proxy Settings
  Start (18.06.2014 15:50:55)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:51:00)

15 - Unhide Non System Files
  Start (18.06.2014 15:51:00)
  C:\ - Total Files Unhidden: 642 - Check Unhidden_Files.txt for list of files unhidden
  D:\ - Total Files Unhidden: 0 - Check Unhidden_Files.txt for list of files unhidden
  Q:\ - Total Files Unhidden: 0 - Check Unhidden_Files.txt for list of files unhidden
  Done (18.06.2014 15:51:55)

16 - Repair Windows Updates
  Start (18.06.2014 15:51:55)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:16)

17 - Repair CD/DVD Missing/Not Working
  Start (18.06.2014 15:52:16)
  iTunes not found, not applying UpperFilters iTunes Reg Key
  Done (18.06.2014 15:52:16)

18 - Repair Volume Shadow Copy Service
  Start (18.06.2014 15:52:16)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:25)

19 - Repair Windows Sidebar/Gadgets
  Start (18.06.2014 15:52:25)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:30)

20 - Repair MSI (Windows Installer)
  Start (18.06.2014 15:52:30)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:43)

21 - Repair Windows Snipping Tool
  Start (18.06.2014 15:52:43)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:47)

22.01 - Repair bat Association
  Start (18.06.2014 15:52:48)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:52)

22.02 - Repair cmd Association
  Start (18.06.2014 15:52:52)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:52:57)

22.03 - Repair com Association
  Start (18.06.2014 15:52:57)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:02)

22.04 - Repair Directory Association
  Start (18.06.2014 15:53:02)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:06)

22.05 - Repair Drive Association
  Start (18.06.2014 15:53:06)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:11)

22.06 - Repair exe Association
  Start (18.06.2014 15:53:11)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:16)

22.07 - Repair Folder Association
  Start (18.06.2014 15:53:16)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:21)

22.08 - Repair inf Association
  Start (18.06.2014 15:53:21)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:25)

22.09 - Repair lnk (Shortcuts) Association
  Start (18.06.2014 15:53:25)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:30)

22.10 - Repair msc Association
  Start (18.06.2014 15:53:30)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:35)

22.11 - Repair reg Association
  Start (18.06.2014 15:53:35)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:40)

22.12 - Repair scr Association
  Start (18.06.2014 15:53:40)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:44)

23 - Repair Windows Safe Mode
  Start (18.06.2014 15:53:44)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:53:49)

24 - Repair Print Spooler
  Start (18.06.2014 15:53:49)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:54:04)

25 - Restore Important Windows Services
  Start (18.06.2014 15:54:04)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:54:30)

26 - Set Windows Services To Default Startup
  Start (18.06.2014 15:54:30)
  Running Repair Under Current User Account
  Running Repair Under System Account
  Done (18.06.2014 15:54:37)

  Skipping Repair.
  Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
  Current version: 6.1

  Skipping Repair.
  Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
  Current version: 6.1

  Skipping Repair.
  Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
  Current version: 6.1

Cleaning up empty logs...

All Selected Repairs Done.
  Done (18.06.2014 15:54:37)
  Total Repair Time: 00:25:50


...YOU MUST RESTART YOUR SYSTEM...
  Running Repair Under Current User Account
Code:
Farbar Service Scanner Version: 10-06-2014
Ran by Sabrina Boy (administrator) on 18-06-2014 at 16:11:03
Running from "C:\Users\Sabrina Boy\Desktop"
Microsoft Windows 7 Home Premium  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-06-2014
Ran by Sabrina Boy (administrator) on SABRINASLAPTOP on 18-06-2014 16:09:23
Running from C:\Users\Sabrina Boy\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_4_402_265_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-05] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2014-06-10] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: F - F:\ting.exe
HKU\S-1-5-21-2899099275-4155470742-1896681866-1000\...\MountPoints2: {245b7740-b66e-11e2-9d25-a6699b6f42c6} - F:\ting.exe
Startup: C:\Users\Bocken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
URLSearchHook: HKCU - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {9AA0EE78-F120-4F67-8760-0DE1FE14D329} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {13C2FF9F-313B-48DC-A2D2-DA4A07002C34} URL =
SearchScopes: HKCU - {3CA16FF5-57F5-4DE0-9165-E463438C1B2F} URL =
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  No File
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
DPF: HKLM-x32 {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab
DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\syswow64\urlmon.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2010-07-17] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{13893AF3-7C14-43C9-943C-F7375E3FAA88}] - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{ECE8D100-69C8-4BF1-914D-D997C792E5E5}\{13893AF3-7C14-43C9-943C-F7375E3FAA88}.xpi [2014-06-02]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-05] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [121344 2010-06-30] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 RtVOsdService; C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [315392 2010-06-17] (Realtek Semiconductor Corp.) [File not signed]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] () [File not signed]
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 ssm_bus; C:\Windows\System32\DRIVERS\ssm_bus.sys [136192 2013-06-21] (MCCI Corporation)
S3 ssm_mdfl; C:\Windows\System32\DRIVERS\ssm_mdfl.sys [18944 2013-06-21] (MCCI Corporation)
S3 ssm_mdm; C:\Windows\System32\DRIVERS\ssm_mdm.sys [172032 2013-06-21] (MCCI Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-18 16:09 - 2014-06-18 16:09 - 00003222 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForSabrina Boy
2014-06-18 16:09 - 2014-06-18 16:09 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForSabrina Boy.job
2014-06-18 15:55 - 2014-06-18 15:55 - 00000352 _____ () C:\Windows\PFRO.log
2014-06-18 15:52 - 2014-06-18 15:52 - 00000220 _____ () C:\Windows\Tasks\SidebarExecute.job
2014-06-18 15:28 - 2014-06-18 15:54 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-18 15:26 - 2014-06-18 15:26 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-SABRINASLAPTOP-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2014-06-18 15:25 - 2014-06-18 15:25 - 00000000 ____D () C:\RegBackup
2014-06-18 15:02 - 2014-06-18 15:02 - 00003288 _____ () C:\bootsqm.dat
2014-06-18 14:48 - 2014-06-18 14:48 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\tweaking.com_windows_repair_aio
2014-06-18 14:47 - 2014-06-18 14:48 - 03434761 _____ () C:\Users\Sabrina Boy\Desktop\tweaking.com_windows_repair_aio.zip
2014-06-18 13:16 - 2014-06-18 13:16 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-06-18 13:14 - 2014-06-18 13:14 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate
2014-06-16 22:43 - 2014-06-16 22:43 - 00415744 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FSS.exe
2014-06-16 22:24 - 2014-06-18 15:59 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-16 22:23 - 2014-06-18 15:56 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-12 15:55 - 2014-06-18 15:59 - 00000560 _____ () C:\Windows\setupact.log
2014-06-12 15:55 - 2014-06-12 15:55 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-12 12:37 - 2014-06-18 16:09 - 00011833 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-12 12:36 - 2014-06-16 22:36 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\FRST-OlderVersion
2014-06-12 12:13 - 2014-06-12 12:14 - 00854367 _____ () C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
2014-06-10 13:32 - 2014-06-10 13:32 - 02347384 _____ (ESET) C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:20 - 2014-06-05 16:21 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:08 - 2014-06-05 16:09 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:02 - 2014-06-05 16:07 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-05 15:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-05 15:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-05 15:32 - 2014-06-05 15:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-04 16:31 - 2014-06-04 16:32 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-04 16:29 - 2014-06-16 22:36 - 02081280 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-02 22:40 - 2014-06-18 16:09 - 00000000 ____D () C:\FRST
2014-06-02 14:22 - 2014-06-16 22:38 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 14:11 - 2014-06-02 14:12 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:47 - 2014-06-02 13:48 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:44 - 2014-06-02 13:45 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:21 - 2014-06-02 10:24 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:15 - 2014-06-02 10:19 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:53 - 2014-06-02 15:15 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-20 20:23 - 2014-05-20 20:55 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag
2014-05-20 20:19 - 2014-06-18 15:46 - 00544627 _____ () C:\Windows\WindowsUpdate.log

==================== One Month Modified Files and Folders =======

2014-06-18 16:09 - 2014-06-18 16:09 - 00003222 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForSabrina Boy
2014-06-18 16:09 - 2014-06-18 16:09 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForSabrina Boy.job
2014-06-18 16:09 - 2014-06-12 12:37 - 00011833 _____ () C:\Users\Sabrina Boy\Desktop\FRST.txt
2014-06-18 16:09 - 2014-06-02 22:40 - 00000000 ____D () C:\FRST
2014-06-18 16:09 - 2014-05-20 20:19 - 00544627 _____ () C:\Windows\WindowsUpdate.log
2014-06-18 16:09 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Local\Temp
2014-06-18 16:08 - 2013-01-11 14:50 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-18 16:00 - 2010-07-17 20:47 - 00640990 _____ () C:\Windows\system32\perfh007.dat
2014-06-18 16:00 - 2010-07-17 20:47 - 00126264 _____ () C:\Windows\system32\perfc007.dat
2014-06-18 16:00 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-18 16:00 - 2009-07-14 06:45 - 00023024 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-18 16:00 - 2009-07-14 06:45 - 00023024 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-18 15:59 - 2014-06-16 22:24 - 00069240 _____ () C:\Users\Sabrina Boy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-18 15:59 - 2014-06-12 15:55 - 00000560 _____ () C:\Windows\setupact.log
2014-06-18 15:56 - 2014-06-16 22:23 - 00305472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-18 15:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-18 15:55 - 2014-06-18 15:55 - 00000352 _____ () C:\Windows\PFRO.log
2014-06-18 15:54 - 2014-06-18 15:28 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-18 15:52 - 2014-06-18 15:52 - 00000220 _____ () C:\Windows\Tasks\SidebarExecute.job
2014-06-18 15:50 - 2009-07-14 04:34 - 00000439 _____ () C:\Windows\win.ini
2014-06-18 15:26 - 2014-06-18 15:26 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-SABRINASLAPTOP-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2014-06-18 15:25 - 2014-06-18 15:25 - 00000000 ____D () C:\RegBackup
2014-06-18 15:02 - 2014-06-18 15:02 - 00003288 _____ () C:\bootsqm.dat
2014-06-18 14:48 - 2014-06-18 14:48 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\tweaking.com_windows_repair_aio
2014-06-18 14:48 - 2014-06-18 14:47 - 03434761 _____ () C:\Users\Sabrina Boy\Desktop\tweaking.com_windows_repair_aio.zip
2014-06-18 13:16 - 2014-06-18 13:16 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-06-18 13:14 - 2014-06-18 13:14 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate
2014-06-18 13:14 - 2012-02-18 15:06 - 00000000 ____D () C:\ProgramData\Samsung
2014-06-16 22:43 - 2014-06-16 22:43 - 00415744 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FSS.exe
2014-06-16 22:38 - 2014-06-02 14:22 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-16 22:37 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy
2014-06-16 22:36 - 2014-06-12 12:36 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\FRST-OlderVersion
2014-06-16 22:36 - 2014-06-04 16:29 - 02081280 _____ (Farbar) C:\Users\Sabrina Boy\Desktop\FRST64.exe
2014-06-16 22:31 - 2013-08-17 21:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-16 22:28 - 2011-03-11 09:30 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 15:55 - 2014-06-12 15:55 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-12 12:14 - 2014-06-12 12:13 - 00854367 _____ () C:\Users\Sabrina Boy\Desktop\SecurityCheck.exe
2014-06-10 13:32 - 2014-06-10 13:32 - 02347384 _____ (ESET) C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe
2014-06-10 13:32 - 2011-03-05 17:59 - 00000000 ____D () C:\Users\Sabrina Boy
2014-06-10 13:25 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken\AppData\Local\Temp
2014-06-05 16:28 - 2014-06-05 16:28 - 00001661 _____ () C:\Users\Sabrina Boy\Desktop\JRT.txt
2014-06-05 16:21 - 2014-06-05 16:21 - 00000000 ____D () C:\Windows\ERUNT
2014-06-05 16:21 - 2014-06-05 16:20 - 01016261 _____ (Thisisu) C:\Users\Sabrina Boy\Desktop\JRT.exe
2014-06-05 16:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2014-06-05 16:09 - 2014-06-05 16:08 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:07 - 2014-06-05 16:02 - 01327971 _____ () C:\Users\Sabrina Boy\Desktop\adwcleaner_3.211.exe
2014-06-05 16:01 - 2014-06-05 16:01 - 00001150 _____ () C:\Users\Sabrina Boy\Desktop\mbam.txt
2014-06-05 15:38 - 2014-06-05 15:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 15:37 - 2014-06-05 15:37 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 15:37 - 2014-06-05 15:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-05 15:36 - 2014-06-05 15:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sabrina Boy\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-05 15:25 - 2013-03-29 11:57 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-05 15:25 - 2013-03-29 11:57 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 16:32 - 2014-06-04 16:31 - 00028062 _____ () C:\Users\Sabrina Boy\Desktop\Addition.txt
2014-06-03 00:19 - 2011-08-12 18:55 - 00000000 ____D () C:\Windows\pss
2014-06-03 00:19 - 2011-03-09 18:41 - 00000000 ____D () C:\Users\Bocken
2014-06-03 00:19 - 2010-09-20 15:29 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-03 00:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-06-02 21:58 - 2011-07-06 06:49 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-02 21:07 - 2010-07-17 11:19 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\ProgramData\WildTangent
2014-06-02 21:06 - 2010-09-20 05:57 - 00000000 ____D () C:\Program Files (x86)\HP Games
2014-06-02 21:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-02 15:15 - 2014-05-25 14:53 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\Security System 2
2014-06-02 14:12 - 2014-06-02 14:11 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2540-F.txt
2014-06-02 13:48 - 2014-06-02 13:47 - 00000715 _____ () C:\ProgramData\RUNDLL32.EXE-2200-F.txt
2014-06-02 13:45 - 2014-06-02 13:44 - 00000227 _____ () C:\ProgramData\RUNDLL32.EXE-2364-F.txt
2014-06-02 12:00 - 2014-06-02 12:00 - 00000113 _____ () C:\ProgramData\RUNDLL32.EXE-2456-F.txt
2014-06-02 11:48 - 2014-06-02 11:48 - 00000366 _____ () C:\ProgramData\RUNDLL32.EXE-1160-F.txt
2014-06-02 11:27 - 2014-06-02 11:27 - 00000609 _____ () C:\ProgramData\RUNDLL32.EXE-2604-F.txt
2014-06-02 10:34 - 2014-06-02 10:34 - 00069240 _____ () C:\Users\Bocken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 10:24 - 2014-06-02 10:21 - 00000455 _____ () C:\ProgramData\RUNDLL32.EXE-2672-F.txt
2014-06-02 10:19 - 2014-06-02 10:15 - 00002622 _____ () C:\ProgramData\RUNDLL32.EXE-3608-F.txt
2014-05-25 14:57 - 2014-05-25 14:57 - 00000000 ____D () C:\Users\Sabrina Boy\AppData\Roaming\dlg
2014-05-25 14:57 - 2011-03-05 23:29 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-25 14:57 - 2011-03-05 23:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-25 14:56 - 2014-05-25 14:56 - 00119296 _____ () C:\Windows\system32\itsacapi_pe-2.3.exe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2014-05-25 14:50 - 2014-05-25 14:50 - 00000000 ____D () C:\Users\Administrator
2014-05-20 20:55 - 2014-05-20 20:23 - 00000000 ____D () C:\Users\Sabrina Boy\Desktop\Vatertag

Files to move or delete:
====================
C:\Users\Sabrina Boy\esetsmartinstaller_deu.exe


Some content of TEMP:
====================
C:\Users\Bocken\AppData\Local\Temp\avgnt.exe
C:\Users\Sabrina Boy\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-06-23 14:12

==================== End Of Log ============================
--- --- ---

schrauber 19.06.2014 13:13
Servicepack 1 fehlt immer noch. Noch Probleme?


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:42 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131