Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Maleware via Steam bekommen. Malewarebytes Log auswertung (https://www.trojaner-board.de/162878-maleware-via-steam-bekommen-malewarebytes-log-auswertung.html)

Pumpernicker 19.01.2015 11:10
1. adwCleaner log:

Code:
# AdwCleaner v4.108 - Bericht erstellt am 19/01/2015 um 10:41:45
# Aktualisiert 17/01/2015 von Xplode
# Database : 2015-01-18.1 [Live]
# Betriebssystem : Windows 7 Enterprise Service Pack 1 (64 bits)
# Benutzername : Björn - BJÖRN-PC
# Gestartet von : C:\Users\Björn\Desktop\AdwCleaner_4.108.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\eSupport.com
Ordner Gelöscht : C:\Program Files (x86)\JustCloud
Ordner Gelöscht : C:\Program Files (x86)\Tbccint
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\BJRN~1\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\BJRN~1\AppData\Local\Temp\Security Systems
Ordner Gelöscht : C:\Users\Björn\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Björn\AppData\Local\eSupport.com
Ordner Gelöscht : C:\Users\Björn\AppData\Local\CrashRpt
Ordner Gelöscht : C:\Users\Björn\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Björn\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Björn\AppData\Roaming\Security System 2

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [BackgroundContainerV2]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2613550
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3EF5F3B2-DA8D-4CD5-8960-5187AAC6508E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\eSupport.com
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Tbccint_HKLM
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainerV2
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v


-\\ Google Chrome v39.0.2171.99


*************************

AdwCleaner[R0].txt - [6512 octets] - [19/01/2015 10:38:41]
AdwCleaner[S0].txt - [5968 octets] - [19/01/2015 10:41:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6028 octets] ##########
2. JRT log:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Enterprise x64
Ran by Bj”rn on 19.01.2015 at 10:56:59,27
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}



~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\DriverToolkit Autorun.job



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.01.2015 at 11:01:16,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3.
FRST:

Code:

LastRegBack: 2015-01-15 09:00

==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2015
Ran by Björn at 2015-01-19 11:05:27
Running from C:\Users\Björn\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Free Firewall (Disabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Cloud Player (HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Amazon Amazon Cloud Player) (Version: 2.2.0.399 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArmA 2 Free Uninstall (HKLM-x32\...\ArmA 2) (Version:  - )
ARMA 2 Operation Arrowhead Uninstall (HKLM-x32\...\ARMA 2 Operation Arrowhead) (Version:  - )
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version:  - Rocksteady Studios)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.1.7 - EA Digital Illusions CE AB)
BattlEye (A2Free) Uninstall (HKLM-x32\...\BattlEye A2 Free) (Version:  - )
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Burnout Paradise: The Ultimate Box (HKLM-x32\...\Steam App 24740) (Version:  - Criterion Games)
Burnout(TM) Paradise The Ultimate Box (HKLM-x32\...\{9A996B6A-846E-4A89-B9C4-17546B7BE49F}) (Version: 1.1.0.0 - Electronic Arts)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version:  - Infinity Ward)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Counter-Strike (HKLM-x32\...\Steam App 10) (Version:  - Valve)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
Crysis® 2 (HKLM-x32\...\{6033673D-2530-4587-8AD0-EB059FC263F9}) (Version: 1.9.0.0 - Electronic Arts)
DayZ Commander (HKLM-x32\...\{B3653588-3AC0-4A1D-950F-D96531E84374}) (Version: 0.92.91 - Dotjosh Studios)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.55.4 - Electronic Arts)
Die Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.5.1 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
Drakonia Black (HKLM-x32\...\{2EAD3327-2F92-455F-A675-E5CC4980B67A}}_is1) (Version:  - )
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Free YouTube to MP3 Converter version 3.12.1.320 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.1.320 - DVDVideoSoft Ltd.)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Guardians of Middle-earth (HKLM-x32\...\Steam App 111900) (Version:  - Zombie Studios)
ICQ7M (HKLM-x32\...\{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}) (Version: 7.8 - ICQ)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IP Camera Adapter (HKLM-x32\...\{6D140BFF-7CC5-4BFE-AD6D-47035FFE5F14}) (Version: 2.0.0.0 - Pavel Khlebovich)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Just Cause 2 (HKLM-x32\...\Steam App 8190) (Version:  - Avalanche)
Just Cause 2: Multiplayer Mod (HKLM-x32\...\Steam App 259080) (Version:  - JC2-MP Team)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Metin2 (HKLM-x32\...\Metin2_is1) (Version:  - Gameforge 4D GmbH)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mortal Kombat Kollection (HKLM-x32\...\Steam App 205350) (Version:  - Other Ocean Interactive)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
Nitro Reader 3 (HKLM\...\{1197549C-5221-4C9A-8182-E77D289734DA}) (Version: 3.5.3.14 - Nitro)
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.3 - )
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.2.2730 - Electronic Arts, Inc.)
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
Play withSIX (HKLM-x32\...\{D7F3EEAD-183C-47DE-BDC5-593539573F97}) (Version: 1.30.0474 - SIX Networks)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
Ralink RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.31.3 - Ralink)
Realtek PCI Fast Ethernet Controller Driver For Vista and Win7 (HKLM-x32\...\{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}) (Version: 1.00.0005 - Realtek)
Risen (HKLM-x32\...\Steam App 40300) (Version:  - Piranha – Bytes)
Risen 2 - Dark Waters (HKLM-x32\...\Steam App 40390) (Version:  - Piranha Bytes)
Serious Sam 3: BFE (HKLM-x32\...\Steam App 41070) (Version:  - Croteam)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.9.201406230908 - Sony Mobile Communications AB)
Sony PC Companion 2.10.211 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.211 - Sony)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Unity Web Player (HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VC 9.0 Runtime (x32 Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
VLC media player 2.0.6 (HKLM\...\VLC media player) (Version: 2.0.6 - VideoLAN)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
War Thunder Launcher 1.0.1.335 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version:  - Gaijin Entertainment)
webcamXP 5 Free (HKLM-x32\...\wLite) (Version: 5.8.5.0 - Moonware Studios)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
ZoneAlarm Firewall (x32 Version: 10.1.079.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free (HKLM-x32\...\ZoneAlarm Free) (Version: 10.1.065.000 - Check Point)
ZoneAlarm Security (x32 Version: 10.1.079.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm-Sicherheit Toolbar (HKLM-x32\...\ZoneAlarm-Sicherheit Toolbar) (Version: 6.7.0.6 - ZoneAlarm-Sicherheit)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2440887171-1312972135-4275482140-1000_Classes\CLSID\{07474513-7B58-45c7-B3E6-13A3669B1AFD}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

==================== Restore Points  =========================

26-12-2014 13:28:44 Geplanter Prüfpunkt
09-01-2015 14:38:28 Geplanter Prüfpunkt
15-01-2015 08:10:40 Windows Update
18-01-2015 23:26:53 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1A339B67-E3DF-4B29-9A18-DA1603CE994C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {5CE7E608-7BE5-4654-B3F3-3C5ADC760FFA} - System32\Tasks\Amazon Music Helper => C:\Users\Björn\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [2013-12-12] ()
Task: {67B08A27-23E6-48CF-87E8-0C756973FCC9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-10] (Google Inc.)
Task: {7206A4CA-73F5-4D1B-9E5E-DC8447DB6E38} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-10] (Google Inc.)
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {C4E8B14A-4159-4C58-BDAD-281DBBFC97E8} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => d:\program files\windows defender\MpCmdRun.exe
Task: {E0BC7317-BC12-4E65-894A-1F47A604E820} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-11-11 14:27 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-08-29 01:42 - 2013-08-29 09:13 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-12-30 22:00 - 2013-12-12 20:56 - 03145536 _____ () C:\Users\Björn\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
2012-01-10 14:41 - 2014-03-02 20:40 - 00567880 _____ () C:\Program Files (x86)\puush\puush.exe
2014-12-25 11:51 - 2013-10-29 14:49 - 00248832 _____ () C:\Program Files (x86)\Drakonia Configurator\hid.exe
2014-12-25 11:51 - 2013-06-26 17:01 - 00240640 _____ () C:\Program Files (x86)\Drakonia Configurator\trayicon.exe
2014-10-11 12:06 - 2014-10-11 12:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-06 14:14 - 2014-02-17 19:13 - 00092984 _____ () C:\Program Files (x86)\DriverToolkit\zlibwapi.dll
2014-09-01 07:40 - 2014-11-11 19:48 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-09-01 07:40 - 2014-11-11 19:48 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-09-01 07:40 - 2014-11-11 19:48 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2013-04-23 17:30 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-06-01 11:25 - 2014-11-18 21:23 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll
2014-09-01 07:40 - 2014-11-11 19:48 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-09-01 07:40 - 2014-11-11 19:48 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2013-02-08 13:03 - 2014-11-18 21:23 - 00690880 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-12-25 11:51 - 2013-01-15 17:06 - 00061952 _____ () C:\Program Files (x86)\Drakonia Configurator\HidDevice.dll
2014-12-25 11:51 - 2013-11-05 16:31 - 00249856 _____ () C:\Program Files (x86)\Drakonia Configurator\language.dll
2013-02-08 13:03 - 2014-11-11 19:48 - 34589888 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-04-17 02:27 - 2014-04-17 02:27 - 00087552 _____ () C:\Program Files (x86)\IP Camera Adapter\IPCameraAdapter.dll
2015-01-14 13:27 - 2015-01-09 01:35 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\libglesv2.dll
2015-01-14 13:27 - 2015-01-09 01:35 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\libegl.dll
2015-01-14 13:27 - 2015-01-09 01:35 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\pdf.dll
2015-01-14 13:27 - 2015-01-09 01:35 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2440887171-1312972135-4275482140-500 - Administrator - Disabled)
Björn (S-1-5-21-2440887171-1312972135-4275482140-1000 - Administrator - Enabled) => C:\Users\Björn
Gast (S-1-5-21-2440887171-1312972135-4275482140-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2440887171-1312972135-4275482140-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-2440887171-1312972135-4275482140-1004 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2015-01-19 11:03:40.265
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 23:53:45.297
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 17:37:57.795
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-18 12:13:03.679
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-16 10:57:30.109
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-16 00:46:32.706
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-15 09:13:25.720
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-15 08:34:08.300
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-15 08:19:27.242
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-13 11:05:54.400
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: AMD Athlon(tm) 7750 Dual-Core Processor
Percentage of memory in use: 40%
Total physical RAM: 4095.55 MB
Available physical RAM: 2424.61 MB
Total Pagefile: 8189.29 MB
Available Pagefile: 5925.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:368.1 GB) (Free:17.41 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:97.66 GB) (Free:97.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: B1E01E0C)
Partition 1: (Active) - (Size=368.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus 19.01.2015 11:29
FRST.txt Logfile bitte richtig posten

Pumpernicker 19.01.2015 13:11
Das einzige was in der txt drin stand habe ich oben gepostet.

Ich habs einfach nochmal drüber laufen lassen und nun hat es geklappt :).

Hier die neue FRST.txt:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015
Ran by Björn (administrator) on BJÖRN-PC on 19-01-2015 13:05:36
Running from C:\Users\Björn\Desktop
Loaded Profiles: Björn (Available profiles: Björn & UpdatusUser)
Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Megaify Software Co., Ltd.) C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe
() C:\Users\Björn\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ICQ, LLC.) C:\Program Files (x86)\ICQ7M\ICQ.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
() C:\Program Files (x86)\puush\puush.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
() C:\Program Files (x86)\Drakonia Configurator\hid.exe
() C:\Program Files (x86)\Drakonia Configurator\trayicon.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Björn\Desktop\FRST64 (1).exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ISW] => [X]
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73360 2011-12-18] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3838800 2014-12-13] (LogMeIn Inc.)
HKLM-x32\...\Run: [GamingMouse] => C:\Program Files (x86)\Drakonia Configurator\hid.exe [248832 2013-10-29] ()
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Run: [ICQ] => C:\Program Files (x86)\ICQ7M\ICQ.exe [127040 2012-11-10] (ICQ, LLC.)
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Run: [GoogleChromeAutoLaunch_10DA39C636EC9A6AA772F52E30D234A5] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [856904 2015-01-09] (Google Inc.)
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Run: [AVMUSBFernanschluss] => "C:\Users\Björn\AppData\Local\Apps\2.0\TJ451ZN3.GGH\7QY81OGN.P38\frit..tion_1acae14e4778b8d2_0002.0003_7c9366a34786c7f9\AVMAutoStart.exe"
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2014-03-02] ()
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\MountPoints2: {b03d7d23-b973-11e3-b241-bc05430ce017} - F:\Startme.exe
HKU\S-1-5-21-2440887171-1312972135-4275482140-1000\...\MountPoints2: {fd39d03f-3fae-11e2-9465-00040ec2e362} - L:\pushinst.exe
HKU\S-1-5-18\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoThumbnailCache] 1
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
URLSearchHook: HKLM-x32 - CCC003 Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\prxtbZon2.dll No File
URLSearchHook: HKU\S-1-5-21-2440887171-1312972135-4275482140-1000 - CCC003 Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\prxtbZon2.dll No File
SearchScopes: HKLM -> {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2440887171-1312972135-4275482140-1000 -> {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - CCC003 Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\prxtbZon2.dll No File
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKU\S-1-5-21-2440887171-1312972135-4275482140-1000 -> ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKU\S-1-5-21-2440887171-1312972135-4275482140-1000 -> No Name - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2440887171-1312972135-4275482140-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Björn\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

Chrome:
=======
CHR HomePage: Default ->
CHR Profile: C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-10]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]
CHR Extension: (YouTube) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-10]
CHR Extension: (Google-Suche) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-10]
CHR Extension: (Avira Browserschutz) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-12-07]
CHR Extension: (AdBlock) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-11-25]
CHR Extension: (Stealthy) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2012-11-26]
CHR Extension: (YouTube to MP3) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkippmhiimpgejpacdkdgladdckocicj [2013-04-07]
CHR Extension: (Google Wallet) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Google Mail) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-10]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-05-27] () [File not signed]
R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [827520 2011-11-03] (Check Point Software Technologies)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-05-01] (Nitro PDF Software)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-29] ()
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2011-06-16] (Microsoft Corporation) [File not signed]
S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2420616 2011-12-18] (Check Point Software Technologies LTD)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-28] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-04] (AVM Berlin)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fet6x64.sys [47872 2009-06-10] (VIA Technologies, Inc.              )
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [1293824 2010-10-04] (AVM GmbH)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-20] (Sony Mobile Communications)
R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33672 2011-11-03] (Check Point Software Technologies)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [96472 2015-01-18] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MxEFUF; C:\Windows\System32\DRIVERS\MxEFUF64.sys [157696 2011-10-20] (Matrox Graphics Inc.)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
U4 SR; No ImagePath
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 11:06 - 2015-01-19 13:05 - 00019665 _____ () C:\Users\Björn\Desktop\FRST.txt
2015-01-19 11:05 - 2015-01-19 11:06 - 00023300 _____ () C:\Users\Björn\Desktop\Addition.txt
2015-01-19 11:04 - 2015-01-19 13:05 - 00000000 ____D () C:\Users\Björn\Desktop\Neuer Ordner (8)
2015-01-19 11:03 - 2015-01-19 11:03 - 02126848 _____ (Farbar) C:\Users\Björn\Desktop\FRST64 (1).exe
2015-01-19 10:56 - 2015-01-19 10:56 - 00000000 ____D () C:\Windows\ERUNT
2015-01-19 10:54 - 2015-01-19 10:54 - 01707939 _____ (Thisisu) C:\Users\Björn\Desktop\JRT.exe
2015-01-19 10:38 - 2015-01-19 10:42 - 00000000 ____D () C:\AdwCleaner
2015-01-19 10:36 - 2015-01-19 10:36 - 02186752 _____ () C:\Users\Björn\Desktop\AdwCleaner_4.108.exe
2015-01-18 17:24 - 2015-01-19 10:28 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-18 17:19 - 2015-01-18 17:19 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\1E7B7FB4.sys
2015-01-18 17:18 - 2015-01-18 23:27 - 00000000 ____D () C:\Users\Björn\Desktop\mbar
2015-01-18 11:52 - 2015-01-18 11:52 - 00000000 ____D () C:\Users\Björn\Desktop\Neuer Ordner (7)
2015-01-17 18:43 - 2015-01-19 13:05 - 00000000 ____D () C:\FRST
2015-01-17 16:47 - 2015-01-17 16:47 - 00001042 _____ () C:\Users\Björn\Documents\troja.txt
2015-01-17 16:19 - 2015-01-19 10:49 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-17 16:19 - 2015-01-18 17:23 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-17 16:19 - 2015-01-17 16:19 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-17 16:19 - 2015-01-17 16:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-17 16:19 - 2015-01-17 16:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-17 16:19 - 2015-01-17 16:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-17 16:19 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-17 16:19 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-14 13:11 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 13:11 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 13:11 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 13:11 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 13:11 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 13:11 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 13:11 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 13:11 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 13:11 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 13:11 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 13:11 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 13:11 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 13:11 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 09:21 - 2015-01-13 09:21 - 00000000 ____D () C:\Users\Björn\Desktop\Neuer Ordner (2)
2015-01-13 08:36 - 2015-01-14 00:10 - 00000000 ____D () C:\Users\Björn\Desktop\Neuer Ordner
2015-01-10 10:55 - 2015-01-10 10:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-01-10 10:55 - 2015-01-10 10:55 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-01 20:51 - 2015-01-01 20:51 - 00498712 _____ () C:\Windows\Minidump\010115-54537-01.dmp
2014-12-26 11:56 - 2015-01-13 08:17 - 00000000 ____D () C:\Users\Björn\Desktop\Gta
2014-12-26 11:45 - 2014-12-26 11:45 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-25 11:51 - 2014-12-25 11:51 - 00018412 _____ () C:\Windows\unins000.dat
2014-12-25 11:51 - 2014-12-25 11:51 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\MingGuan
2014-12-25 11:51 - 2014-12-25 11:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drakonia Black
2014-12-25 11:51 - 2014-12-25 11:51 - 00000000 ____D () C:\Program Files (x86)\Drakonia Configurator
2014-12-25 11:51 - 2014-12-25 11:48 - 01192533 _____ () C:\Windows\unins000.exe
2014-12-25 11:04 - 2014-12-25 11:04 - 01082573 _____ () C:\Users\Björn\Documents\teste.wma
2014-12-25 10:32 - 2014-12-25 10:32 - 00153143 _____ () C:\Users\Björn\Documents\twat.wma
2014-12-24 11:35 - 2014-12-24 11:35 - 00000008 _____ () C:\Users\Björn\Documents\rapin.txt
2014-12-22 14:01 - 2015-01-13 08:35 - 00000000 ____D () C:\Users\Björn\Desktop\Neuer Ordner (5)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 12:48 - 2009-07-14 05:45 - 00027856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-19 12:48 - 2009-07-14 05:45 - 00027856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-19 12:40 - 2012-11-10 17:39 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 12:25 - 2012-11-10 13:52 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-19 10:51 - 2012-11-09 17:10 - 01859999 _____ () C:\Windows\WindowsUpdate.log
2015-01-19 10:47 - 2012-11-11 13:51 - 00000000 ____D () C:\Users\Björn\AppData\Local\LogMeIn Hamachi
2015-01-19 10:46 - 2013-02-08 13:00 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-19 10:45 - 2012-11-10 13:52 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-19 10:44 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-19 10:43 - 2012-12-30 00:26 - 00152634 _____ () C:\Windows\PFRO.log
2015-01-19 10:43 - 2012-12-02 10:57 - 00120173 _____ () C:\Windows\setupact.log
2015-01-19 10:43 - 2012-11-11 14:28 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-19 10:32 - 2012-11-10 11:30 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\ICQ
2015-01-18 23:30 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\addins
2015-01-18 23:00 - 2013-02-08 22:02 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\TS3Client
2015-01-18 22:41 - 2014-06-18 20:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-17 16:43 - 2012-11-10 14:16 - 00000000 ____D () C:\Program Files (x86)\ZoneAlarm-Sicherheit
2015-01-15 08:33 - 2013-10-27 14:13 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 08:13 - 2013-10-27 14:12 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 00:40 - 2012-11-10 17:39 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 00:40 - 2012-11-10 17:39 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 00:40 - 2012-11-10 17:39 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-11 20:44 - 2013-02-22 18:53 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Skype
2015-01-10 10:56 - 2013-02-22 18:52 - 00000000 ____D () C:\ProgramData\Skype
2014-12-26 13:36 - 2013-03-17 14:58 - 00000000 ____D () C:\Users\Björn\Documents\GTA San Andreas User Files

==================== Files in the root of some directories =======
2014-12-07 14:31 - 2014-12-07 14:31 - 0000273 _____ () C:\Users\Björn\AppData\Roaming\removeAllComponents.bat
2014-05-19 12:18 - 2014-05-19 12:18 - 0000136 _____ () C:\Users\Björn\AppData\Roaming\tmp_register.bat
2014-12-07 14:31 - 2014-12-07 14:31 - 0000141 _____ () C:\Users\Björn\AppData\Roaming\tmp_unregister.bat
2014-04-23 20:21 - 2014-04-23 20:21 - 0000853 _____ () C:\Users\Björn\AppData\Local\recently-used.xbel
2012-11-10 11:51 - 2012-11-10 11:51 - 0007605 _____ () C:\Users\Björn\AppData\Local\Resmon.ResmonCfg
2013-11-05 16:09 - 2013-11-05 16:09 - 0001534 _____ () C:\ProgramData\ss.ini

Files to move or delete:
====================
C:\Users\Björn\avmacc64.dll
C:\Users\Björn\avmadd64.DLL
C:\Users\Björn\fwlan4ci.dll
C:\Users\Björn\fwlanci.dll
C:\Users\Björn\fwusbnci.dll
C:\Users\Björn\setup.exe


Some content of TEMP:
====================
C:\Users\Björn\AppData\Local\Temp\amazonicon_v5.exe
C:\Users\Björn\AppData\Local\Temp\APNStub.exe
C:\Users\Björn\AppData\Local\Temp\avgnt.exe
C:\Users\Björn\AppData\Local\Temp\cdbxp_setup_4.5.3.4643.exe
C:\Users\Björn\AppData\Local\Temp\dotnetfx45_full_x86_x64.exe
C:\Users\Björn\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\Björn\AppData\Local\Temp\foxy_security.exe
C:\Users\Björn\AppData\Local\Temp\jansi-64-git-Bukkit-1.4.2-R0.2-12-g99043bc-b2469jnks.dll
C:\Users\Björn\AppData\Local\Temp\nitro_reader3.exe
C:\Users\Björn\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\Björn\AppData\Local\Temp\Play withSIX Setup.exe
C:\Users\Björn\AppData\Local\Temp\Quarantine.exe
C:\Users\Björn\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Björn\AppData\Local\Temp\sdapskill.exe
C:\Users\Björn\AppData\Local\Temp\sdaspwn.exe
C:\Users\Björn\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Björn\AppData\Local\Temp\sonarinst.exe
C:\Users\Björn\AppData\Local\Temp\sqlite3.dll
C:\Users\Björn\AppData\Local\Temp\tmp-drivermax3878639.exe
C:\Users\Björn\AppData\Local\Temp\UDPv243.exe
C:\Users\Björn\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Björn\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe
[2011-06-13 02:13] - [2011-06-18 00:30] - 2871808 ____A (Microsoft Corporation) 5740B1555D51D56547043181789027A5

C:\Windows\SysWOW64\explorer.exe
[2011-06-13 02:13] - [2011-06-18 00:35] - 2616320 ____A (Microsoft Corporation) 88B413E78ADB75A062AB947C1BF6D49A

C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-15 09:00

==================== End Of Log ============================
--- --- ---

--- --- ---



Gruß

cosinus 19.01.2015 13:28
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\Users\Björn\AppData\Local\Temp\amazonicon_v5.exe
C:\Users\Björn\AppData\Local\Temp\APNStub.exe
C:\Users\Björn\AppData\Local\Temp\avgnt.exe
C:\Users\Björn\AppData\Local\Temp\cdbxp_setup_4.5.3.4643.exe
C:\Users\Björn\AppData\Local\Temp\dotnetfx45_full_x86_x64.exe
C:\Users\Björn\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\Björn\AppData\Local\Temp\foxy_security.exe
C:\Users\Björn\AppData\Local\Temp\jansi-64-git-Bukkit-1.4.2-R0.2-12-g99043bc-b2469jnks.dll
C:\Users\Björn\AppData\Local\Temp\nitro_reader3.exe
C:\Users\Björn\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\Björn\AppData\Local\Temp\Play withSIX Setup.exe
C:\Users\Björn\AppData\Local\Temp\Quarantine.exe
C:\Users\Björn\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Björn\AppData\Local\Temp\sdapskill.exe
C:\Users\Björn\AppData\Local\Temp\sdaspwn.exe
C:\Users\Björn\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Björn\AppData\Local\Temp\sonarinst.exe
C:\Users\Björn\AppData\Local\Temp\sqlite3.dll
C:\Users\Björn\AppData\Local\Temp\tmp-drivermax3878639.exe
C:\Users\Björn\AppData\Local\Temp\UDPv243.exe
C:\Users\Björn\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Björn\AppData\Local\Temp\xmlUpdater.exe
C:\Users\Björn\avmacc64.dll
C:\Users\Björn\avmadd64.DLL
C:\Users\Björn\fwlan4ci.dll
C:\Users\Björn\fwlanci.dll
C:\Users\Björn\fwusbnci.dll
C:\Users\Björn\setup.exe
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Pumpernicker 19.01.2015 21:27
Fixlog.txt:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by Björn at 2015-01-19 21:11:29 Run:1
Running from C:\Users\Björn\Desktop
Loaded Profiles: Björn (Available profiles: Björn & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\Users\Björn\AppData\Local\Temp\amazonicon_v5.exe
C:\Users\Björn\AppData\Local\Temp\APNStub.exe
C:\Users\Björn\AppData\Local\Temp\avgnt.exe
C:\Users\Björn\AppData\Local\Temp\cdbxp_setup_4.5.3.4643.exe
C:\Users\Björn\AppData\Local\Temp\dotnetfx45_full_x86_x64.exe
C:\Users\Björn\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\Björn\AppData\Local\Temp\foxy_security.exe
C:\Users\Björn\AppData\Local\Temp\jansi-64-git-Bukkit-1.4.2-R0.2-12-g99043bc-b2469jnks.dll
C:\Users\Björn\AppData\Local\Temp\nitro_reader3.exe
C:\Users\Björn\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\Björn\AppData\Local\Temp\Play withSIX Setup.exe
C:\Users\Björn\AppData\Local\Temp\Quarantine.exe
C:\Users\Björn\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Björn\AppData\Local\Temp\sdapskill.exe
C:\Users\Björn\AppData\Local\Temp\sdaspwn.exe
C:\Users\Björn\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Björn\AppData\Local\Temp\sonarinst.exe
C:\Users\Björn\AppData\Local\Temp\sqlite3.dll
C:\Users\Björn\AppData\Local\Temp\tmp-drivermax3878639.exe
C:\Users\Björn\AppData\Local\Temp\UDPv243.exe
C:\Users\Björn\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Björn\AppData\Local\Temp\xmlUpdater.exe
C:\Users\Björn\avmacc64.dll
C:\Users\Björn\avmadd64.DLL
C:\Users\Björn\fwlan4ci.dll
C:\Users\Björn\fwlanci.dll
C:\Users\Björn\fwusbnci.dll
C:\Users\Björn\setup.exe
EmptyTemp:
Hosts:
       
*****************

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
C:\Users\Björn\AppData\Local\Temp\amazonicon_v5.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\APNStub.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\cdbxp_setup_4.5.3.4643.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\dotnetfx45_full_x86_x64.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\drm_dyndata_7390006.dll => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\foxy_security.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\jansi-64-git-Bukkit-1.4.2-R0.2-12-g99043bc-b2469jnks.dll => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\nitro_reader3.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\nitro_reader3_64.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\Play withSIX Setup.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\sdanircmdc.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\sdapskill.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\sdaspwn.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\sonarinst.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\tmp-drivermax3878639.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\UDPv243.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\vcredist_x64.exe => Moved successfully.
C:\Users\Björn\AppData\Local\Temp\xmlUpdater.exe => Moved successfully.
C:\Users\Björn\avmacc64.dll => Moved successfully.
C:\Users\Björn\avmadd64.DLL => Moved successfully.
C:\Users\Björn\fwlan4ci.dll => Moved successfully.
C:\Users\Björn\fwlanci.dll => Moved successfully.
C:\Users\Björn\fwusbnci.dll => Moved successfully.
C:\Users\Björn\setup.exe => Moved successfully.
"C:\Windows\System32\Drivers\etc\hosts" => Could not move.
Could not reset Hosts.
EmptyTemp: => Removed 1.7 GB temporary data.


The system needed a reboot.

==== End of Fixlog 21:18:32 ====

cosinus 20.01.2015 11:13
Virenscanner deaktivieren, Fix wiederholen

Pumpernicker 20.01.2015 13:17
fixlog.txt

HTML-Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by Björn at 2015-01-20 13:06:21 Run:2
Running from C:\Users\Björn\Desktop
Loaded Profiles: Björn (Available profiles: Björn & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\Users\Björn\AppData\Local\Temp\amazonicon_v5.exe
C:\Users\Björn\AppData\Local\Temp\APNStub.exe
C:\Users\Björn\AppData\Local\Temp\avgnt.exe
C:\Users\Björn\AppData\Local\Temp\cdbxp_setup_4.5.3.4643.exe
C:\Users\Björn\AppData\Local\Temp\dotnetfx45_full_x86_x64.exe
C:\Users\Björn\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\Björn\AppData\Local\Temp\foxy_security.exe
C:\Users\Björn\AppData\Local\Temp\jansi-64-git-Bukkit-1.4.2-R0.2-12-g99043bc-b2469jnks.dll
C:\Users\Björn\AppData\Local\Temp\nitro_reader3.exe
C:\Users\Björn\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\Björn\AppData\Local\Temp\Play withSIX Setup.exe
C:\Users\Björn\AppData\Local\Temp\Quarantine.exe
C:\Users\Björn\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Björn\AppData\Local\Temp\sdapskill.exe
C:\Users\Björn\AppData\Local\Temp\sdaspwn.exe
C:\Users\Björn\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Björn\AppData\Local\Temp\sonarinst.exe
C:\Users\Björn\AppData\Local\Temp\sqlite3.dll
C:\Users\Björn\AppData\Local\Temp\tmp-drivermax3878639.exe
C:\Users\Björn\AppData\Local\Temp\UDPv243.exe
C:\Users\Björn\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Björn\AppData\Local\Temp\xmlUpdater.exe
C:\Users\Björn\avmacc64.dll
C:\Users\Björn\avmadd64.DLL
C:\Users\Björn\fwlan4ci.dll
C:\Users\Björn\fwlanci.dll
C:\Users\Björn\fwusbnci.dll
C:\Users\Björn\setup.exe
EmptyTemp:
Hosts:
*****************

HKLM\SOFTWARE\Policies\Google => Key not found.
HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => Key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => Key not found.
"C:\Users\Björn\AppData\Local\Temp\amazonicon_v5.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\APNStub.exe" => File/Directory not found.
C:\Users\Björn\AppData\Local\Temp\avgnt.exe => Moved successfully.
"C:\Users\Björn\AppData\Local\Temp\cdbxp_setup_4.5.3.4643.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\dotnetfx45_full_x86_x64.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\drm_dyndata_7390006.dll" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\foxy_security.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\jansi-64-git-Bukkit-1.4.2-R0.2-12-g99043bc-b2469jnks.dll" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\nitro_reader3.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\nitro_reader3_64.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\Play withSIX Setup.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\Quarantine.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\sdanircmdc.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\sdapskill.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\sdaspwn.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\SkypeSetup.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\sonarinst.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\sqlite3.dll" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\tmp-drivermax3878639.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\UDPv243.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\vcredist_x64.exe" => File/Directory not found.
"C:\Users\Björn\AppData\Local\Temp\xmlUpdater.exe" => File/Directory not found.
"C:\Users\Björn\avmacc64.dll" => File/Directory not found.
"C:\Users\Björn\avmadd64.DLL" => File/Directory not found.
"C:\Users\Björn\fwlan4ci.dll" => File/Directory not found.
"C:\Users\Björn\fwlanci.dll" => File/Directory not found.
"C:\Users\Björn\fwusbnci.dll" => File/Directory not found.
"C:\Users\Björn\setup.exe" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 238.1 MB temporary data.


The system needed a reboot.

==== End of Fixlog 13:06:32 ====

cosinus 20.01.2015 13:32
Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Pumpernicker 20.01.2015 22:57
Mbam log:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 20.01.2015
Suchlauf-Zeit: 15:13:38
Logdatei: MBamlog.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.20.05
Rootkit Datenbank: v2015.01.14.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Björn

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 385804
Verstrichene Zeit: 19 Min, 30 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
Eset log:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=73efab0b20132949a8707228927a64be
# engine=22058
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-20 07:08:44
# local_time=2015-01-20 08:08:44 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 21409 287200614 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 48251780 173410774 0 0
# scanned=328885
# found=46
# cleaned=0
# scan_time=14372
sh=CF6185A9EDFBA0217C9D36D25CA9F6ADCC9F6BC8 ft=1 fh=f90d49fcbe154eac vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"
sh=08A0C25B0BF40535697C1C584ACCDA490D6BC882 ft=1 fh=dbe7f66a50ce49ed vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\BJRN~1\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=314F703F0F190BF70F0386509C10998D4E2BD10B ft=1 fh=2f9f46df1834d950 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Björn\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.1.dll.vir"
sh=D3CBDD7C6ED2C9D81DA4FCF9AF57CDD5D3711ED3 ft=1 fh=86dbe26399c3d0fa vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Björn\AppData\Local\Conduit\BackgroundContainer\TBUpdaterLogic_1.0.0.2.dll.vir"
sh=76B997BE33132963D2D177908AB15DC0C69C7E89 ft=1 fh=b39dacf1316c7436 vn="Variante von Win32/Adware.Synatix.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Björn\AppData\Roaming\Security System 2\data\upd.exe.vir"
sh=73098BBBA6CBC76BF206226FBDC659758EAC7F0B ft=1 fh=6c165ff8a046d46e vn="Win32/Adware.Synatix.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Björn\AppData\Roaming\Security System 2\data\ie\ie.dll.vir"
sh=E3D9389D8746D1847AA4A6AF248D2EA76B797E93 ft=1 fh=0a55342cdda5f9ee vn="Variante von Win32/Adware.Synatix.A Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Björn\AppData\Local\Temp\foxy_security.exe.xBAD"
sh=C25E453070C795849C94FCB0311ED1DDD4F7B74D ft=1 fh=a07ba6255bd749e6 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\CheckPoint\ZAForceField\CUninstaller.exe"
sh=AC27C174CB607C5F7193903F1B6B74A2DCA1D990 ft=1 fh=ac2d0c4787f9f4c1 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\CheckPoint\ZAForceField\TBI.exe"
sh=C25E453070C795849C94FCB0311ED1DDD4F7B74D ft=1 fh=a07ba6255bd749e6 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\CheckPoint\Install\CUninstaller.exe"
sh=A5036051A02ACCB9BE3ACEF32FB53509C1E866F4 ft=1 fh=8203b411154288ad vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\CheckPoint\Install\Install.exe"
sh=DACCEF26229D06C78049B88C7BE2772EA347B8A2 ft=1 fh=fefb97b647b2f1e6 vn="Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\hk64tbZon0.dll"
sh=A473F1057D0844C61ED68047F97C6CD8B3F79F51 ft=1 fh=851ca62d1383db26 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\hktbZon0.dll"
sh=28F30DCBC3836B85CF84C0445F20FDD74276105F ft=1 fh=a5122cc400caea7d vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\ldrtbZon0.dll"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\ldrtbZone.dll"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\prxtbZone.dll"
sh=4C716303AC281E9F6F92DBAA25DFCF342B2E8300 ft=1 fh=2ce425e33ba62b65 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZon0.dll"
sh=E6F9792E271F52A2245CC8D72C05A57D6DFBBDE3 ft=1 fh=0690a81bbbd9c1b6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll"
sh=37FDC039C02562267559D42D94DDB64B692FD091 ft=1 fh=7aeecd1bb81f6a22 vn="Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon0.dll"
sh=89EFB95EA494B79655C7F863F1C1281CD2709657 ft=1 fh=e87f6ab06a9e2986 vn="Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon2.dll"
sh=A6D053127826CDA8DD8FCDBB4E81F63000910624 ft=1 fh=e8f05c501331b563 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon0.dll"
sh=AB06A99D1673ACFDB102B0E2A1A77589CFEBEB88 ft=1 fh=1adb5a7836c4d687 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon2.dll"
sh=4ED909DA6660CED26F0838A7C1233779B8A23013 ft=1 fh=779718076a3c51f7 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZon2.dll"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll"
sh=7148AC44C7FE0CB8D30A12ACB28171AE1F609C20 ft=1 fh=779162af1796b620 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon0.dll"
sh=174DE1FD238363B9AA5933C55BC233674682F4F0 ft=1 fh=9aea40f367c54e56 vn="Variante von Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon1.dll"
sh=0BEB96A71B86E22B0B605D512C47BB0BA5A9AA7F ft=1 fh=963ff6bc3d69b8f0 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon2.dll"
sh=E6F9792E271F52A2245CC8D72C05A57D6DFBBDE3 ft=1 fh=0690a81bbbd9c1b6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll"
sh=B5C93DA0C608B26C9487ABC49CCB643C9A15ED33 ft=1 fh=75f1c65aa8a331ed vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll"
sh=E817CC39A06582B3A381CC0540B1CE8013936AB3 ft=0 fh=0000000000000000 vn="Android/TrojanSMS.Bosm.E Trojaner" ac=I fn="C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb.apk"
sh=E817CC39A06582B3A381CC0540B1CE8013936AB3 ft=0 fh=0000000000000000 vn="Android/TrojanSMS.Bosm.E Trojaner" ac=I fn="C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb_2.apk"
sh=E817CC39A06582B3A381CC0540B1CE8013936AB3 ft=0 fh=0000000000000000 vn="Android/TrojanSMS.Bosm.E Trojaner" ac=I fn="C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb.apk"
sh=E817CC39A06582B3A381CC0540B1CE8013936AB3 ft=0 fh=0000000000000000 vn="Android/TrojanSMS.Bosm.E Trojaner" ac=I fn="C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb_2.apk"
sh=96C4BB0BA8D9FCE01583C3B1B92EF7F31CC10C3A ft=1 fh=ba2e43f588bdf530 vn="MSIL/Soft32Downloader.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\3com etherlink xl 10 100 pci for complete pc management nic 3c905c tx setup.exe"
sh=27C1E36828C37D2CF773992C1C1F8629D031C99E ft=1 fh=e15050cebca1e78e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\CDBurnerXP-lnstall.exe"
sh=04389DCB7D71213058D51D202E0DBE13CAE2CBF3 ft=1 fh=4ced5b55bca1e78e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\CloneCD-lnstall (1).exe"
sh=04389DCB7D71213058D51D202E0DBE13CAE2CBF3 ft=1 fh=4ced5b55bca1e78e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\CloneCD-lnstall.exe"
sh=7C6E976B190E99C8C66D9F16CDADA855A9A9E098 ft=1 fh=b1f7a7c23a65b8c8 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\FreeAudioDub_1.7.9.908.exe"
sh=4C653C110768CCC1B25ECBC001A910583DFECEA6 ft=1 fh=ccf66b23098a1fab vn="Variante von Win32/Toolbar.Widgi.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\freeripmp3-setup.exe"
sh=F7260CE69E39008609AC6570C2013A39315C46F5 ft=1 fh=c8129b0266621a88 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe"
sh=53A522459FEFD253ACBFF5BBD6C06423CD210750 ft=1 fh=27c30b0c1ed3d963 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\FunnyVoice - CHIP-Installer.exe"
sh=2BC76B9E05792064F9311D1CCBF86EA1EF6EBCC7 ft=1 fh=fa73b674c7ea9994 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_nitro-pdf-reader.exe"
sh=D240651E85B124954D3A508439911802F124B6CD ft=1 fh=84f42a7ddeb2ad60 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_pdfcreator.exe"
sh=CA93F551F47686F132C9F17E0247E4068DCB2CB1 ft=1 fh=e47c41f0d041cd21 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\zafwSetupWeb_110_000_504.exe"
sh=A5036051A02ACCB9BE3ACEF32FB53509C1E866F4 ft=1 fh=8203b411154288ad vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Björn\Searches\Downloads\zaSetupWeb_101_065_000.exe"

cosinus 20.01.2015 23:04
ZoneAlarm deinstallieren. Desktop-Firewalls konnte ich noch nie empfehlen. Wenn überhaupt ist die Windows-Firewall das einzig sinnvolle...

Avira wird auch schon lange nicht mehr empfohlen. Nimm MSE (kostenlos) oder Emsisoft.

Und räum den Desktop (siehe ESET-Funde) Downloads Ordner auf. Lauter Müll-Setups drin, tw. von den Adwareschleuden Chip und Softonic.

Pumpernicker 20.01.2015 23:22
Gut also schaut mein PC nun relativ clean aus?

Welche Kombination genau würdest du denn Empfehlen (Firewall und Antivir mäßig)? Habe in letzer Zeit viel ausprobiert... Auch auf einem zweiten Gerät (Netbook).

Problem bei den meisten Programmen ist einfach die hohe Systemauslastung und das ständige Probleme machen im Hintergrund... mein PC ist leider nicht mehr der neuste und das Netbook ist eben für Schreibarbeit.

Probiert habe ich die Windows Standard Software, Macafee und Norton. Und die haben meine Hardware leider viel zu oft mit in die Knie gezwungen... Weshalb ich eben im Moment die ZA & Avira Kombination nehme.


Gruß

cosinus 20.01.2015 23:39
Na wenn wir schon dabei sind, können wir auch eben die Funde wegräumen...Virenscanner vorher deaktivieren:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon0.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon0.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon0.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon1.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb.apk
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb_2.apk
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb.apk
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb_2.apk
C:\Users\Björn\Searches\Downloads\3com etherlink xl 10 100 pci for complete pc management nic 3c905c tx setup.exe
C:\Users\Björn\Searches\Downloads\CDBurnerXP-lnstall.exe
C:\Users\Björn\Searches\Downloads\CloneCD-lnstall (1).exe
C:\Users\Björn\Searches\Downloads\CloneCD-lnstall.exe
C:\Users\Björn\Searches\Downloads\FreeAudioDub_1.7.9.908.exe
C:\Users\Björn\Searches\Downloads\freeripmp3-setup.exe
C:\Users\Björn\Searches\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe
C:\Users\Björn\Searches\Downloads\FunnyVoice - CHIP-Installer.exe
C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_nitro-pdf-reader.exe
C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_pdfcreator.exe
C:\Users\Björn\Searches\Downloads\zafwSetupWeb_110_000_504.exe
C:\Users\Björn\Searches\Downloads\zaSetupWeb_101_065_000.exe
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Pumpernicker 20.01.2015 23:51
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by Björn at 2015-01-20 23:50:21 Run:3
Running from C:\Users\Björn\Desktop
Loaded Profiles: Björn &  (Available profiles: Björn & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon0.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon0.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon0.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon1.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb.apk C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb_2.apk C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb.apk C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb_2.apk C:\Users\Björn\Searches\Downloads\3com etherlink xl 10 100 pci for complete pc management nic 3c905c tx setup.exe C:\Users\Björn\Searches\Downloads\CDBurnerXP-lnstall.exe C:\Users\Björn\Searches\Downloads\CloneCD-lnstall (1).exe C:\Users\Björn\Searches\Downloads\CloneCD-lnstall.exe C:\Users\Björn\Searches\Downloads\FreeAudioDub_1.7.9.908.exe C:\Users\Björn\Searches\Downloads\freeripmp3-setup.exe C:\Users\Björn\Searches\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe C:\Users\Björn\Searches\Downloads\FunnyVoice - CHIP-Installer.exe C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_nitro-pdf-reader.exe C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_pdfcreator.exe C:\Users\Björn\Searches\Downloads\zafwSetupWeb_110_000_504.exe C:\Users\Björn\Searches\Downloads\zaSetupWeb_101_065_000.exe EmptyTemp: Hosts:
*****************

"C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon0.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon0.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon0.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon1.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon2.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb.apk C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb_2.apk C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb.apk C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb_2.apk C:\Users\Björn\Searches\Downloads\3com etherlink xl 10 100 pci for complete pc management nic 3c905c tx setup.exe C:\Users\Björn\Searches\Downloads\CDBurnerXP-lnstall.exe C:\Users\Björn\Searches\Downloads\CloneCD-lnstall (1).exe C:\Users\Björn\Searches\Downloads\CloneCD-lnstall.exe C:\Users\Björn\Searches\Downloads\FreeAudioDub_1.7.9.908.exe C:\Users\Björn\Searches\Downloads\freeripmp3-setup.exe C:\Users\Björn\Searches\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe C:\Users\Björn\Searches\Downloads\FunnyVoice - CHIP-Installer.exe C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_nitro-pdf-reader.exe C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_pdfcreator.exe C:\Users\Björn\Searches\Downloads\zafwSetupWeb_110_000_504.exe C:\Users\Björn\Searches\Downloads\zaSetupWeb_101_065_000.exe EmptyTemp: Hosts:" => File/Directory not found.

==== End of Fixlog 23:50:21 ====

cosinus 21.01.2015 09:24
Du hast die Fixlist völllig falsch erstellt, weil alle Einträge in eine Zeile gequtscht wurden. Pro zu löschendem Eintrag bzw Objekt muss eine neue Zeile in der fixlist.txt sein.

Pumpernicker 21.01.2015 11:36
Oh sorry, war wohl schon innerlich am schlafen :D

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by Björn at 2015-01-21 11:16:16 Run:4
Running from C:\Users\Björn\Desktop
Loaded Profiles: Björn (Available profiles: Björn & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon0.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon0.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon0.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon1.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon2.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb.apk
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb_2.apk
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb.apk
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb_2.apk
C:\Users\Björn\Searches\Downloads\3com etherlink xl 10 100 pci for complete pc management nic 3c905c tx setup.exe
C:\Users\Björn\Searches\Downloads\CDBurnerXP-lnstall.exe
C:\Users\Björn\Searches\Downloads\CloneCD-lnstall (1).exe
C:\Users\Björn\Searches\Downloads\CloneCD-lnstall.exe
C:\Users\Björn\Searches\Downloads\FreeAudioDub_1.7.9.908.exe
C:\Users\Björn\Searches\Downloads\freeripmp3-setup.exe
C:\Users\Björn\Searches\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe
C:\Users\Björn\Searches\Downloads\FunnyVoice - CHIP-Installer.exe
C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_nitro-pdf-reader.exe
C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_pdfcreator.exe
C:\Users\Björn\Searches\Downloads\zafwSetupWeb_110_000_504.exe
C:\Users\Björn\Searches\Downloads\zaSetupWeb_101_065_000.exe
EmptyTemp:
Hosts:
       
*****************

C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon0.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hk64tbZon2.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon0.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\hktbZon2.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZon2.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon0.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon1.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZon2.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll => Moved successfully.
C:\Users\Björn\AppData\LocalLow\ZoneAlarm-Sicherheit\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll => Moved successfully.
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb.apk => Moved successfully.
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\gesamtbackup\bluetooth\smsbomb_2.apk => Moved successfully.
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb.apk => Moved successfully.
C:\Users\Björn\Desktop\Mechanik\Neuer Ordner\Neuer Ordner (2)\Neuer Ordner (12)\Musicc\handybackup\smsbomb_2.apk => Moved successfully.
C:\Users\Björn\Searches\Downloads\3com etherlink xl 10 100 pci for complete pc management nic 3c905c tx setup.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\CDBurnerXP-lnstall.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\CloneCD-lnstall (1).exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\CloneCD-lnstall.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\FreeAudioDub_1.7.9.908.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\freeripmp3-setup.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\FunnyVoice - CHIP-Installer.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_nitro-pdf-reader.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\SoftonicDownloader_fuer_pdfcreator.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\zafwSetupWeb_110_000_504.exe => Moved successfully.
C:\Users\Björn\Searches\Downloads\zaSetupWeb_101_065_000.exe => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 267.1 MB temporary data.


The system needed a reboot.

==== End of Fixlog 11:16:34 ====


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:10 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131