Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   POPUP Fenster gehen auf! (https://www.trojaner-board.de/163637-popup-fenster-gehen.html)

chudi24 05.02.2015 14:06
POPUP Fenster gehen auf!
 
Hallo habe das Problem das ständig neue Fenster bei mir aufgehen. Habe schon den Adw cleaner und Malwarebytes anti-malware durchlaufen lassen, aber die seiten kommen immer wieder kann mir jemand Helfen?



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: browsersupport helper - {B5147546-9359-4D9B-8B36-F54C54555799} - C:\Program Files (x86)\browsersupport\browsersupport.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ECtiClient] "C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe" -autostart
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe" -HideWindow
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [winengine] C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
O4 - HKCU\..\Run: [winengine2] C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
O4 - Startup: OptimizerProInstaller.lnk = C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kollmer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kollmer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kollmer.local
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: ESTOS Automatic Client Update (EACUSrv) - Unknown owner - C:\windows\system32\EACuSrv.exe (file missing)
O23 - Service: ESTOS Desktop Sharing Services (edsservice) - ESTOS GmbH - C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Trend Micro Security Agent Echtzeitsuche (ntrtscan) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: PDF Architect Helper Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\HelperService.exe
O23 - Service: PDF Architect Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\ConversionService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Trend Micro Common Client Solution Framework (TmCCSF) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
O23 - Service: Trend Micro Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe
O23 - Service: Trend Micro Security Agent NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

schrauber 05.02.2015 14:09
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)






So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

chudi24 05.02.2015 14:40
==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: No Name -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:13 - 2015-02-05 14:13 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-05 13:53 - 2015-02-05 13:53 - 00009271 _____ () C:\Users\andreas.chudalla\Desktop\hijackthis.log
2015-02-05 13:05 - 2015-02-05 13:05 - 00000085 _____ () C:\windows\wininit.ini
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 12:54 - 05027328 _____ () C:\Users\andreas.chudalla\Desktop\stuttgart.dwg
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:54 - 2015-02-05 12:54 - 00000213 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl2
2015-02-05 12:54 - 2015-02-05 12:54 - 00000063 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl
2015-02-05 12:52 - 2015-02-05 13:49 - 00018492 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-03 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieUserList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieSiteList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Macromedia
2015-01-08 07:57 - 2015-01-08 07:57 - 00003886 _____ () C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-08 07:56 - 2015-01-16 12:10 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp
2015-01-08 07:56 - 2015-01-08 07:56 - 00001425 _____ () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000842 __RSH () C:\Users\Lena.Fraunholz\ntuser.pol
2015-01-08 07:56 - 2015-01-08 07:56 - 00000020 ___SH () C:\Users\Lena.Fraunholz\ntuser.ini
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Vorlagen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Startmenü
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Netzwerkumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Lokale Einstellungen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Eigene Dateien
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Druckumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Musik
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Bilder
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Verlauf
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ___RD () C:\Users\Lena.Fraunholz\Virtual Machines
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Windows Small Business Server
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Small Business Server 2008
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\ESTOS
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Adobe
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\NVIDIA
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\Autodesk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz
2015-01-08 07:56 - 2014-01-15 17:22 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\ESTOS
2015-01-08 07:56 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-08 07:56 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:01 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-05 13:39 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 13:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 13:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-05 13:16 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-05 12:57 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-05 12:57 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-05 12:57 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:51 - 2014-08-18 11:10 - 00983160 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-05 12:51 - 2014-08-18 11:10 - 00543424 _____ () C:\windows\system32\TmInstall.log
2015-02-05 12:51 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-05 12:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:50 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-05 12:50 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-05 12:50 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:35 - 2014-02-11 09:08 - 00035852 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-02 14:07 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-26 09:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-26 09:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-26 09:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-08 07:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================

FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2015 01
Ran by andreas.chudalla at 2015-02-05 14:13:45
Running from C:\Users\andreas.chudalla\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TP6WHV59
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Security Agent (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Trend Micro Security Agent Anti-Spyware (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
AutoCAD LT 2013 - Deutsch (German) (HKLM\...\AutoCAD LT 2013 - Deutsch (German)) (Version: 19.0.55.0 - Autodesk)
AutoCAD LT 2013 - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD LT 2013 Language Pack - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
browsersupport (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 Version: 5 - ${CompanyName}) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DigiTrakLWD (HKLM-x32\...\{D16E1774-E054-4684-815E-1D7E652327EF}) (Version: 2.012.00.000 - Digital-Control, Inc.)
ESS Energie Indikator (HKLM-x32\...\{6E83470B-5EE2-407D-ABFC-CC87E070ED8C}) (Version: 20.13.0 - Nemetschek Allplan GmbH)
ESTOS ProCall (HKLM-x32\...\{F2D50027-E910-4C2C-AC57-E7D806AAE64E}) (Version: 4.1.10.20036 - ESTOS)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM-x32\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{6BC1F8BE-E812-43FC-B648-90770D1C8F34}) (Version: 6.3a - Silicon Laboratories, Inc.)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 19.0.1240 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 9.0 - Trend Micro Inc.) Hidden
Windows Small Business Server 2008 ClientAgent (HKLM\...\{E4FF4DF1-F99C-49AC-B398-BE0887432846}) (Version: 6.0.5601.6 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
winengine (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\winengine) (Version: 20.020 - Ad business Crown Solutions)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\de-DE\acadltficn.dll (Autodesk, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-13 13:31 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {309DDB9E-E5B2-49C4-A862-37419536E206} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-26] (Adobe Systems Incorporated)
Task: {386DF147-2C4A-43F7-BFBA-74BEECE839E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {39CCE3F9-BEB4-4791-85E6-1F7E953517E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3DBC1268-8B24-4A0D-B3C9-B0D747045405} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {462282DE-B532-47A9-9088-E092C9F7DD9B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E144FE06-4742-4F39-904C-BCC78CF23486} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F561A6DF-A3DF-43D0-87F0-D328B86A4C31} - System32\Tasks\sondhschedule => C:\Users\andreas.chudalla\AppData\Roaming\browsersupport\browsersupport-Installer.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2011-08-31 12:55 - 2011-08-31 12:55 - 00801792 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\sqlite3.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\windows\system32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\windows\system32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\windows\system32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\windows\system32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\windows\system32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\windows\system32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\windows\system32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\windows\system32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\windows\system32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\windows\system32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\windows\system32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\windows\system32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\windows\system32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\windows\system32\xi.dll
2009-07-02 15:32 - 2009-07-02 15:32 - 00089088 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\zlibwapi.dll
2012-05-31 09:03 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-01-16 09:19 - 2013-01-16 09:19 - 00048128 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_date_time-vc110-mt-1_49.dll
2013-04-02 11:25 - 2013-04-02 11:25 - 00675840 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\sqlite3.dll
2013-01-16 09:23 - 2013-01-16 09:23 - 00058368 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_thread-vc110-mt-1_49.dll
2013-04-17 14:32 - 2010-09-16 15:34 - 00146176 _____ () C:\Windows\System32\xdnorbgnd.exe
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\Windows\System32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\Windows\System32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\Windows\System32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\Windows\System32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\Windows\System32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\Windows\System32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\Windows\System32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\Windows\System32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\Windows\System32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\Windows\System32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\Windows\System32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\Windows\System32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\Windows\System32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\Windows\System32\xi.dll
2014-11-22 01:03 - 2014-11-22 01:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-12 13:34 - 2014-12-12 13:34 - 00511416 _____ () C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
2012-02-07 06:10 - 2012-02-07 06:10 - 00755624 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acapp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00184744 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accloudconnect.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00181672 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acismui.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 01382312 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acvmtools.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00826280 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accmmgr.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00111016 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acparameter.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00973736 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acdim.crx
2011-04-29 20:23 - 2011-04-29 20:23 - 00125376 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axutil.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00385984 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_engine.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00158144 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axiom.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00034752 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_parser.dll
2011-04-29 20:27 - 2011-04-29 20:27 - 01315264 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\libxml2.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00103360 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\neethi.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Control Panel\Desktop\\Wallpaper -> C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-3572959257-616895921-2767358109-1001 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3572959257-616895921-2767358109-500 - Administrator - Disabled)
Gast (S-1-5-21-3572959257-616895921-2767358109-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
        0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (02/05/2015 00:43:57 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (4412) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00074.log.


System errors:
=============
Error: (02/05/2015 01:43:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:43:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:43:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:35:03 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:35:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:35:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 00:44:27 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (02/05/2015 00:43:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/05/2015 00:43:57 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (02/05/2015 09:52:50 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "FLEXnet Licensing Service 64" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description:
Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description:
Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
4700

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description:
Details:
        0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (02/05/2015 00:43:57 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows4412Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00074.log-1811


CodeIntegrity Errors:
===================================
  Date: 2014-05-13 14:30:37.730
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-13 14:30:37.714
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 35%
Total physical RAM: 8154.33 MB
Available physical RAM: 5251.36 MB
Total Pagefile: 16306.84 MB
Available Pagefile: 13381.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.8 GB) (Free:8.99 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:465.76 GB) (Free:292.87 GB) NTFS
Drive g: (kollmerdaten) (Network) (Total:557.75 GB) (Free:241.45 GB) NTFS
Drive r: (Daten) (Network) (Total:309.4 GB) (Free:203.6 GB) NTFS
Drive u: (Daten) (Network) (Total:309.4 GB) (Free:203.6 GB) NTFS
Drive y: () (Network) (Total:400.19 GB) (Free:180.18 GB)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E3B0152C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 495EDE2A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---

Code:
==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: No Name -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:13 - 2015-02-05 14:13 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 13:53 - 2015-02-05 13:53 - 00009271 _____ () C:\Users\andreas.chudalla\Desktop\hijackthis.log
2015-02-05 13:05 - 2015-02-05 13:05 - 00000085 _____ () C:\windows\wininit.ini
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 12:54 - 05027328 _____ () C:\Users\andreas.chudalla\Desktop\stuttgart.dwg
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:54 - 2015-02-05 12:54 - 00000213 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl2
2015-02-05 12:54 - 2015-02-05 12:54 - 00000063 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl
2015-02-05 12:52 - 2015-02-05 13:49 - 00018492 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-03 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieUserList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieSiteList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Macromedia
2015-01-08 07:57 - 2015-01-08 07:57 - 00003886 _____ () C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-08 07:56 - 2015-01-16 12:10 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp
2015-01-08 07:56 - 2015-01-08 07:56 - 00001425 _____ () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000842 __RSH () C:\Users\Lena.Fraunholz\ntuser.pol
2015-01-08 07:56 - 2015-01-08 07:56 - 00000020 ___SH () C:\Users\Lena.Fraunholz\ntuser.ini
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Vorlagen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Startmenü
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Netzwerkumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Lokale Einstellungen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Eigene Dateien
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Druckumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Musik
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Bilder
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Verlauf
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ___RD () C:\Users\Lena.Fraunholz\Virtual Machines
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Windows Small Business Server
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Small Business Server 2008
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\ESTOS
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Adobe
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\NVIDIA
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\Autodesk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz
2015-01-08 07:56 - 2014-01-15 17:22 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\ESTOS
2015-01-08 07:56 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-08 07:56 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:01 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-05 13:39 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 13:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 13:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-05 13:16 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-05 12:57 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-05 12:57 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-05 12:57 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:51 - 2014-08-18 11:10 - 00983160 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-05 12:51 - 2014-08-18 11:10 - 00543424 _____ () C:\windows\system32\TmInstall.log
2015-02-05 12:51 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-05 12:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:50 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-05 12:50 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-05 12:50 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:35 - 2014-02-11 09:08 - 00035852 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-02 14:07 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-26 09:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-26 09:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-26 09:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-08 07:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================

schrauber 05.02.2015 18:04
FRST.txt bitte nochmal, ist unvollständig und teilweise nicht in Codetags.

chudi24 06.02.2015 07:33
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015
Ran by andreas.chudalla (administrator) on PC-0406 on 06-02-2015 07:31:10
Running from C:\Users\andreas.chudalla\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8U1QR2MI
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: No Name -> {3A2D5EBA-F86D-4BD3-A177-019765996711} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-05] (Malwarebytes Corporation)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 07:22 - 2015-02-06 07:22 - 00482080 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-06 07:22 - 2015-02-06 07:22 - 00003232 _____ () C:\windows\PFRO.log
2015-02-06 07:22 - 2015-02-06 07:22 - 00000168 _____ () C:\windows\setupact.log
2015-02-06 07:22 - 2015-02-06 07:22 - 00000000 _____ () C:\windows\setuperr.log
2015-02-05 14:13 - 2015-02-06 07:31 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-05 13:05 - 2015-02-05 13:05 - 00000085 _____ () C:\windows\wininit.ini
2015-02-05 12:55 - 2015-02-06 07:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 16:37 - 05187233 _____ () C:\Users\andreas.chudalla\Desktop\stuttgart.dwg
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:52 - 2015-02-06 07:25 - 00064903 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-03 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieUserList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieSiteList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Macromedia
2015-01-08 07:57 - 2015-01-08 07:57 - 00003886 _____ () C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-08 07:56 - 2015-01-16 12:10 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp
2015-01-08 07:56 - 2015-01-08 07:56 - 00001425 _____ () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000842 __RSH () C:\Users\Lena.Fraunholz\ntuser.pol
2015-01-08 07:56 - 2015-01-08 07:56 - 00000020 ___SH () C:\Users\Lena.Fraunholz\ntuser.ini
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Vorlagen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Startmenü
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Netzwerkumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Lokale Einstellungen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Eigene Dateien
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Druckumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Musik
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Bilder
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Verlauf
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ___RD () C:\Users\Lena.Fraunholz\Virtual Machines
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Windows Small Business Server
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Small Business Server 2008
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\ESTOS
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Adobe
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\NVIDIA
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\Autodesk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz
2015-01-08 07:56 - 2014-01-15 17:22 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\ESTOS
2015-01-08 07:56 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-08 07:56 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 07:29 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-06 07:29 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-06 07:28 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-06 07:28 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-06 07:26 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-06 07:26 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-06 07:26 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-06 07:23 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-06 07:22 - 2014-08-18 11:10 - 00987488 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-06 07:22 - 2014-08-18 11:10 - 00545860 _____ () C:\windows\system32\TmInstall.log
2015-02-06 07:22 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-06 07:22 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-06 07:22 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 16:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 16:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 16:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 16:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 16:05 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 16:05 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-05 14:57 - 2014-02-11 09:08 - 00036116 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-05 12:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-02 14:07 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-08 07:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 06.02.2015 10:41
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

chudi24 06.02.2015 12:28
Code:
ComboFix 15-02-02.01 - andreas.chudalla 06.02.2015  12:21:31.2.8 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.8154.6256 [GMT 1:00]
ausgeführt von:: c:\users\andreas.chudalla\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TP6WHV59\ComboFix.exe
AV: Trend Micro Security Agent *Enabled/Updated* {5D349EF8-873B-C657-917F-F1D93E101A7C}
SP: Trend Micro Security Agent Anti-Spyware *Enabled/Updated* {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-01-06 bis 2015-02-06  ))))))))))))))))))))))))))))))
.
.
2015-02-05 13:13 . 2015-02-06 06:32        --------        d-----w-        C:\FRST
2015-02-05 11:55 . 2015-02-05 12:05        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2015-02-05 11:55 . 2015-02-06 06:22        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy 2
2015-02-05 07:16 . 2015-02-05 07:16        --------        d-----w-        c:\program files (x86)\browsersupport
2015-02-05 07:05 . 2015-02-05 07:05        --------        d-----w-        C:\shoplog
2015-02-05 06:58 . 2015-02-05 06:58        --------        d-----w-        c:\users\andreas.chudalla\AppData\Local\winengine
2015-02-05 06:55 . 2015-02-05 06:56        --------        d-----w-        c:\program files (x86)\Opera
2015-02-05 06:55 . 2015-02-05 07:02        --------        d-----w-        c:\programdata\BlueStacksSetup
2015-02-05 06:55 . 2015-02-05 07:00        25136        ----a-w-        c:\windows\DCEBoot64.exe
2015-02-05 06:55 . 2015-02-05 06:55        240176        ----a-w-        c:\windows\RegBootClean64.exe
2015-02-05 06:55 . 2015-02-05 07:00        --------        d-----w-        c:\programdata\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-03 04:34 . 2014-12-15 03:13        11870360        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F40C3F50-06E7-4151-A388-337C829114A6}\mpengine.dll
2015-01-22 13:51 . 2015-01-22 13:51        --------        d-sh--w-        c:\users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 13:51 . 2015-01-22 13:51        --------        d-sh--w-        c:\users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-08 06:56 . 2015-01-08 06:56        --------        d-----w-        c:\users\Lena.Fraunholz
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-06 07:16 . 2013-03-25 13:23        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-06 07:16 . 2013-03-25 13:23        701616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-05 15:05 . 2014-05-13 12:13        129752        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-22 23:41 . 2010-11-21 03:27        298120        ------w-        c:\windows\system32\MpSigStub.exe
2014-11-21 05:14 . 2014-05-13 12:13        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys
2014-11-21 05:14 . 2014-05-13 12:13        93400        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 05:14 . 2014-05-13 12:13        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2014-11-21 7063832]
"winengine"="c:\users\andreas.chudalla\AppData\Local\winengine\rkr0.exe" [2014-12-12 511416]
"winengine2"="c:\users\andreas.chudalla\AppData\Local\winengine\rkr1.exe" [2014-12-12 511416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"ECtiClient"="c:\program files (x86)\ESTOS\ProCall 4\eCtiClient.exe" [2013-01-18 21245240]
"OfficeScanNT Monitor"="c:\program files (x86)\Trend Micro\Security Agent\pccntmon.exe" [2014-02-17 1989040]
.
c:\users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OptimizerProInstaller.lnk - c:\programdata\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe /startup [2014-2-5 6466040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 3wareDrv;3wareDrv;c:\windows\system32\drivers\3wareDrv.sys;c:\windows\SYSNATIVE\drivers\3wareDrv.sys [x]
R3 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys;c:\windows\SYSNATIVE\drivers\ahcix64s.sys [x]
R3 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys;c:\windows\SYSNATIVE\drivers\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys;c:\windows\SYSNATIVE\drivers\asmtxhci.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 edsservice;ESTOS Desktop Sharing Services;c:\program files (x86)\ESTOS\ProCall 4\EDeskShareService.exe;c:\program files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [x]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\System32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\System32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 megasas2;megasas2;c:\windows\system32\drivers\megasas2.sys;c:\windows\SYSNATIVE\drivers\megasas2.sys [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 NmPar;PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys;c:\windows\SYSNATIVE\drivers\NmPar.sys [x]
R3 nmserial;PCI Serial Port;c:\windows\system32\drivers\nmserial.sys;c:\windows\SYSNATIVE\drivers\nmserial.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2mdx64.sys;c:\windows\SYSNATIVE\drivers\o2mdx64.sys [x]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sdx64.sys;c:\windows\SYSNATIVE\drivers\o2sdx64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys;c:\windows\SYSNATIVE\DRIVERS\silabenm.sys [x]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys;c:\windows\SYSNATIVE\DRIVERS\silabser.sys [x]
R3 TmProxy;Trend Micro Security Agent NT Proxy Service;c:\program files (x86)\Trend Micro\Security Agent\TmProxy.exe;c:\program files (x86)\Trend Micro\Security Agent\TmProxy.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
S2 EACUSrv;ESTOS Automatic Client Update;c:\windows\system32\EACuSrv.exe;c:\windows\SYSNATIVE\EACuSrv.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TmFilter;Trend Micro Filter;c:\program files (x86)\Trend Micro\Security Agent\TmXPFlt.sys;c:\program files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [x]
S2 TmPreFilter;Trend Micro PreFilter;c:\program files (x86)\Trend Micro\Security Agent\TmPreFlt.sys;c:\program files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 TmCCSF;Trend Micro Common Client Solution Framework;c:\program files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe;c:\program files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-25 07:16]
.
2015-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-25 06:22]
.
2015-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-25 06:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2012-02-05 415680]
"XeroxScanUtility"="c:\program files\Xerox\Scan_Utility\xrxzipui.exe" [2010-09-16 2390784]
"XeroxEndeavorBackgroundTask"="c:\windows\system32\xdnorbgnd.exe" [2010-09-16 146176]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.81.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-02-06  12:26:57
ComboFix-quarantined-files.txt  2015-02-06 11:26
ComboFix2.txt  2014-05-13 12:33
.
Vor Suchlauf: 8.725.757.952 Bytes frei
Nach Suchlauf: 8.640.872.448 Bytes frei
.
- - End Of File - - 8ED5501015FA8847437D7D2AE829053A

schrauber 06.02.2015 19:16
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

chudi24 09.02.2015 08:00
Code:



~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3A2D5EBA-F86D-4BD3-A177-019765996711}



~~~ Files

Successfully deleted: [File] "C:\windows\wininit.ini"



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.02.2015 at  7:57:03,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Beim adw cleaner und Malwarebytes wurde nix weiter gefunden daher auch keine log Datei in meiner antwort

schrauber 09.02.2015 17:59
Was machen die Popups? Wenn sie noch da sind, in welchem Browser? Das frisch FRST Log fehlt noch.

chudi24 10.02.2015 07:44
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Professional x64
Ran by andreas.chudalla on 10.02.2015 at  7:39:33,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.02.2015 at  7:40:55,84
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und ja die kommen noch.. Benutze den Internet Explorer

schrauber 10.02.2015 15:18
Das neue FRST log fehlt immer noch :)

chudi24 10.02.2015 15:46
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by andreas.chudalla (administrator) on PC-0406 on 10-02-2015 15:41:56
Running from C:\Users\andreas.chudalla\Downloads
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Aec32BitAppServer57.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 15:41 - 2015-02-10 15:42 - 00015278 _____ () C:\Users\andreas.chudalla\Downloads\FRST.txt
2015-02-10 15:41 - 2015-02-10 15:41 - 02132992 _____ (Farbar) C:\Users\andreas.chudalla\Downloads\FRST64.exe
2015-02-10 07:46 - 2015-02-10 07:46 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-10 07:46 - 2015-02-10 07:46 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Mozilla
2015-02-06 12:26 - 2015-02-06 12:26 - 00018431 _____ () C:\ComboFix.txt
2015-02-05 14:13 - 2015-02-10 15:42 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-05 12:55 - 2015-02-06 07:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:52 - 2015-02-10 15:33 - 00335157 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-10 07:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-09 16:18 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 15:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-10 15:27 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-10 15:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-10 14:48 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-10 12:57 - 2014-02-11 09:08 - 00037102 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-10 12:32 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-10 07:32 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 07:32 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 07:29 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-10 07:29 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-10 07:29 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-10 07:29 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-10 07:25 - 2014-08-18 11:10 - 00996144 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-10 07:25 - 2014-08-18 11:10 - 00550732 _____ () C:\windows\system32\TmInstall.log
2015-02-10 07:24 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-10 07:24 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-09 16:06 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-09 07:53 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-06 12:27 - 2014-05-13 13:25 - 00000000 ____D () C:\Qoobox
2015-02-06 12:25 - 2009-07-14 03:34 - 00000215 ____N () C:\windows\system.ini
2015-02-06 11:40 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-02-06 08:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 08:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 08:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-16 12:10 - 2015-01-08 07:56 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by andreas.chudalla at 2015-02-10 15:42:35
Running from C:\Users\andreas.chudalla\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Security Agent (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Trend Micro Security Agent Anti-Spyware (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
AutoCAD LT 2013 - Deutsch (German) (HKLM\...\AutoCAD LT 2013 - Deutsch (German)) (Version: 19.0.55.0 - Autodesk)
AutoCAD LT 2013 - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD LT 2013 Language Pack - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
browsersupport (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 Version: 5 - ${CompanyName}) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DigiTrakLWD (HKLM-x32\...\{D16E1774-E054-4684-815E-1D7E652327EF}) (Version: 2.012.00.000 - Digital-Control, Inc.)
ESS Energie Indikator (HKLM-x32\...\{6E83470B-5EE2-407D-ABFC-CC87E070ED8C}) (Version: 20.13.0 - Nemetschek Allplan GmbH)
ESTOS ProCall (HKLM-x32\...\{F2D50027-E910-4C2C-AC57-E7D806AAE64E}) (Version: 4.1.10.20036 - ESTOS)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM-x32\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{6BC1F8BE-E812-43FC-B648-90770D1C8F34}) (Version: 6.3a - Silicon Laboratories, Inc.)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 19.0.1240 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 9.0 - Trend Micro Inc.) Hidden
Windows Small Business Server 2008 ClientAgent (HKLM\...\{E4FF4DF1-F99C-49AC-B398-BE0887432846}) (Version: 6.0.5601.6 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
winengine (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\winengine) (Version: 20.020 - Ad business Crown Solutions)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\de-DE\acadltficn.dll (Autodesk, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-13 13:31 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {309DDB9E-E5B2-49C4-A862-37419536E206} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {386DF147-2C4A-43F7-BFBA-74BEECE839E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {39CCE3F9-BEB4-4791-85E6-1F7E953517E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3DBC1268-8B24-4A0D-B3C9-B0D747045405} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {462282DE-B532-47A9-9088-E092C9F7DD9B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E144FE06-4742-4F39-904C-BCC78CF23486} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F561A6DF-A3DF-43D0-87F0-D328B86A4C31} - System32\Tasks\sondhschedule => C:\Users\andreas.chudalla\AppData\Roaming\browsersupport\browsersupport-Installer.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-31 09:03 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-08-31 12:55 - 2011-08-31 12:55 - 00801792 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\sqlite3.dll
2009-07-02 15:32 - 2009-07-02 15:32 - 00089088 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\zlibwapi.dll
2013-01-16 09:19 - 2013-01-16 09:19 - 00048128 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_date_time-vc110-mt-1_49.dll
2013-04-02 11:25 - 2013-04-02 11:25 - 00675840 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\sqlite3.dll
2013-01-16 09:23 - 2013-01-16 09:23 - 00058368 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_thread-vc110-mt-1_49.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\windows\system32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\windows\system32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\windows\system32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\windows\system32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\windows\system32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\windows\system32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\windows\system32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\windows\system32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\windows\system32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\windows\system32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\windows\system32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\windows\system32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\windows\system32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\windows\system32\xi.dll
2013-04-17 14:32 - 2010-09-16 15:34 - 00146176 _____ () C:\Windows\System32\xdnorbgnd.exe
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\Windows\System32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\Windows\System32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\Windows\System32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\Windows\System32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\Windows\System32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\Windows\System32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\Windows\System32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\Windows\System32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\Windows\System32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\Windows\System32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\Windows\System32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\Windows\System32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\Windows\System32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\Windows\System32\xi.dll
2014-11-22 01:03 - 2014-11-22 01:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-12 13:34 - 2014-12-12 13:34 - 00511416 _____ () C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
2012-02-07 06:10 - 2012-02-07 06:10 - 00755624 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acapp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00184744 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accloudconnect.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00181672 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acismui.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00339880 _____ () c:\program files\autodesk\autocad lt 2013\acfdeval.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00225704 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accalcengine.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 01382312 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acvmtools.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00826280 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accmmgr.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00111016 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acparameter.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00973736 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acdim.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00061352 _____ () c:\program files\autodesk\autocad lt 2013\units.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00162728 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acpltstamp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00362408 _____ () c:\program files\autodesk\autocad lt 2013\acmted.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 02391976 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\aceplotx.crx
2011-04-29 20:23 - 2011-04-29 20:23 - 00125376 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axutil.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00385984 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_engine.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00158144 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axiom.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00034752 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_parser.dll
2011-04-29 20:27 - 2011-04-29 20:27 - 01315264 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\libxml2.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00103360 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\neethi.dll
2015-02-10 07:46 - 2015-01-23 11:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-02-06 08:16 - 2015-02-06 08:16 - 16852144 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Control Panel\Desktop\\Wallpaper -> C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-3572959257-616895921-2767358109-1001 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3572959257-616895921-2767358109-500 - Administrator - Disabled)
Gast (S-1-5-21-3572959257-616895921-2767358109-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (02/10/2015 11:26:17 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-05-13 14:30:37.730
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-13 14:30:37.714
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 91%
Total physical RAM: 8154.33 MB
Available physical RAM: 686.36 MB
Total Pagefile: 16306.84 MB
Available Pagefile: 8371.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.8 GB) (Free:8.51 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:465.76 GB) (Free:292.43 GB) NTFS
Drive g: (kollmerdaten) (Network) (Total:557.75 GB) (Free:237.16 GB) NTFS
Drive r: (Daten) (Network) (Total:309.4 GB) (Free:203.57 GB) NTFS
Drive u: (Daten) (Network) (Total:309.4 GB) (Free:203.57 GB) NTFS
Drive y: () (Network) (Total:400.19 GB) (Free:180.18 GB)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E3B0152C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 495EDE2A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 11.02.2015 07:00
Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\andreas.chudalla\AppData\Local\winengine
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.







ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

chudi24 11.02.2015 12:37
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=78bdae2ecd92f941bb92f212f5777c25
# engine=22413
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-11 10:39:21
# local_time=2015-02-11 11:39:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 18184 175281011 0 0
# scanned=169145
# found=68
# cleaned=0
# scan_time=9574
sh=3A98B1087D11276060234780DCDE594AD2FF4C8D ft=1 fh=c71c00110323fa64 vn="Variante von Win32/Adware.MultiPlug.EG Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceLess\Ko5y8SjbCHqsm2.dll.vir"
sh=95A589A7D2122A246A8E04D9203EB3F09ECF3843 ft=1 fh=c71c001162fe094b vn="Variante von Win32/BHOUninstaller.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceLess\Ko5y8SjbCHqsm2.exe.vir"
sh=90276B4EDA085BCA5AE849EE6D9B023FEF4E2DFD ft=1 fh=4abd756ef96aff89 vn="Variante von Win64/Adware.MultiPlug.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceLess\Ko5y8SjbCHqsm2.x64.dll.vir"
sh=497D88F38E21229D95650E02708207190CB6849E ft=1 fh=64a74ba51bf40770 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=5468230F587DE9F869DB9E22083131DCFD9451F2 ft=1 fh=07a842c13464288e vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=599F4EB498D7C05A680386C1D3E1FC3DD68A8FA9 ft=1 fh=bd87bce3b868a7f1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=6F2DDAFE7B526A4CC60D75CCB1D4EBEA6F5D0DDC ft=1 fh=a836ee7136df2313 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=1DFF39C0F7B7617C8292510F1833B282CD0A1F21 ft=1 fh=18ddbd645dd0ae9c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=DF7B974F73F65FDF917E9C3AB8B8EC9FD97FC2A0 ft=1 fh=0e3a711fc1c46ea8 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=2064A54DEB0868BF95B3AAE00CD45B61D2A13657 ft=0 fh=0000000000000000 vn="Win32/bProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx.vir"
sh=83862B51062A3A5F521BCE6AFB8228AF44B87BA1 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content\BrowserProtect.js.vir"
sh=623DCDBE02F2B896F433A908CD92E2DC80D41728 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\oallcokhekhjjhidieejaohbiiknjimk\CkZtLPosKS.js.vir"
sh=79B4812E218D35CFF7C81E41B626D1B33258CA37 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\oallcokhekhjjhidieejaohbiiknjimk\content.js.vir"
sh=8643CD47EC247BDA2902E35EA04870B94A8639C6 ft=1 fh=2985cf3bb513ce78 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\andrea.hafner\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir"
sh=E8F9D00FF0D357E30520D93C7B658E475B7E75FD ft=1 fh=33524083d80a17da vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\andrea.hafner\AppData\Roaming\BabSolution\Shared\BUSolution.dll.vir"
sh=E898CD8D3E06A6EB37B0EEE2DF0EE9682987E751 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\g0ooz0hy.default\Extensions\M5mbK@eAg.com\content\bg.js.vir"
sh=FF248C16DCFFC741CA41405F485D48A6A9279D3F ft=1 fh=96dff0079a3b2066 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe"
sh=FF248C16DCFFC741CA41405F485D48A6A9279D3F ft=1 fh=96dff0079a3b2066 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe"
sh=BCF43267B4416C6DDEFAAD5AE0A63E3F682C5BB0 ft=1 fh=905be375e5c80006 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001c7a"
sh=AA98F356B8133538069C86CFA6A46FFB18C5F4D3 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5FJ8OAA\pack[1].7z"
sh=8643CD47EC247BDA2902E35EA04870B94A8639C6 ft=1 fh=2985cf3bb513ce78 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BabMaint.exe"
sh=DED201AE02FB9EA3646489AFEDA49270C4620D9C ft=1 fh=c71c001196f8c3ac vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BExternal.dll"
sh=E8F9D00FF0D357E30520D93C7B658E475B7E75FD ft=1 fh=33524083d80a17da vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BUSolution.dll"
sh=007A216C06954B0B18ECFF4950D444BE678E495B ft=1 fh=c37a103a45831e9a vn="Variante von Win32/Toolbar.Babylon.Z evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\CrxInstaller.dll"
sh=6DA4BDCFB260CD03020AA6144565B766D9E3AB58 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\delta.crx"
sh=7759A3318DE2ABC3755EBB7F50322C6D586B5286 ft=1 fh=e3d39714b3bfb2a0 vn="Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\IEHelper.dll"
sh=730970F5946FBAD6B127C41A8C224AE2D2335F48 ft=1 fh=e3b7f7ac4b096ca3 vn="Win32/Toolbar.Montiera.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\MyBabylonTB.exe"
sh=CAE38F7984A73FA129EB5FD190410A68C81350C2 ft=1 fh=b629c1bd568509dc vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\Setup.exe"
sh=6DA4BDCFB260CD03020AA6144565B766D9E3AB58 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\CR\Delta.crx"
sh=8643CD47EC247BDA2902E35EA04870B94A8639C6 ft=1 fh=2985cf3bb513ce78 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\Shared\BabMaint.exe"
sh=E8F9D00FF0D357E30520D93C7B658E475B7E75FD ft=1 fh=33524083d80a17da vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\Shared\BUSolution.dll"
sh=829D808C091045F45C513A6E4AB17055A52A9320 ft=1 fh=282fb76e1825b814 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andrea.hafner\Desktop\AppData\Roaming\OpenCandy\6DCCF8E2E0764F6F9C355F37FC9D78FE\DeltaTB.exe"
sh=333BEB35A70772F1757E99F0154D59964B921D3F ft=1 fh=534a19fe0349cbc1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\andreas.chudalla\AppData\Local\Temp\DMR\dmr_72.exe"
sh=F9AC56FB9F583C9288AA63EA7067A302E8AB4AF6 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 1.zip"
sh=59DD71DDE170C4BEE15B70501B76D0B2EB178CDD ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 21.zip"
sh=4DB12A9D83C6A03C828233309897D7532FCE5485 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 5.zip"
sh=38B101FFF98E189020EDE20F5DFEBF449840BA30 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 7.zip"
sh=5E84BE063DF847DC4734FEA3E07D08B5F98C11C6 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 8.zip"
sh=1A324D43C47D0286ABF85279DEF794B43C702691 ft=0 fh=0000000000000000 vn="Win32/bProtector.D evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2014-03-04 073341\Backup files 1.zip"
sh=45EC4FFB607E9F64C3F0A1BDE50C3D42C85C7989 ft=0 fh=0000000000000000 vn="Win32/bProtector.D evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 1.zip"
sh=94E7AB0537E9DEFF0B0F965F58C5D7BAD0703733 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 2.zip"
sh=844C1552AE70B21DCA53970B1ECA07CD7AF9DE22 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 31.zip"
sh=982179FE1F18EBCE4C1968954423D08B49570198 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 6.zip"
sh=CBE3AB1EFD1D654C75AC806D0A9A044B4B89F6EF ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 8.zip"
sh=DA5E9965D3EA6E727CCA3D58FCECC8F15ADF11C0 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 9.zip"
sh=455F1ACA9EB95314FFA77DCE8446ED7C58FDC49B ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 32.zip"
sh=322B246567BDB505A3F8C51AFEE662BED6CBD315 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 6.zip"
sh=D161E3AB57D8351023B7719C0502326A0DCF9E35 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 7.zip"
sh=4088B29EE8817E9C8879E9445978F1A0BE9EA0E7 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 9.zip"
sh=F4EF69E0C7FE3058893B782328743875CD73EF9C ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 33.zip"
sh=79C08B0C9192AC5A61D5B15370A6A70F91DE711D ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 6.zip"
sh=49291F67B9818BD83352D8AB305E94307C56287B ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 7.zip"
sh=6102C77CBF7274D80C93022DC7A323A7B3043B57 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 9.zip"
sh=96B9BD1E7CD4E63A6DCCA2771D41533E0BF42C89 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 35.zip"
sh=5E79B02B79661D0C71AC652D3E44135DCF97168F ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 7.zip"
sh=3A5FF50CF328A97FD8FC8559D38019A237AC0573 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 8.zip"
sh=D183CEDCBC4B2A0CE23EA13CC147B8B9CBADA57A ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 9.zip"
sh=DDE30B83025F7C9A4C3639D675C9E11868637E24 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 35.zip"
sh=DAD7446888643D56D492CE01143B5E0EFB65AF61 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 7.zip"
sh=6791C5A41BE58AB183FD1E37BA25C6CBC2105BD9 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 8.zip"
sh=EBF94AEDD7F61B9FFC37117753C47437BCCA4F3E ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 9.zip"
sh=9D091CEEFD96327E262049B1B92D7E491D323B24 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 25.zip"
sh=03F6152329F5ABBD7F0AFF3B26CD5956FC62FCC8 ft=0 fh=0000000000000000 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 7.zip"
sh=9287D294544C4A5B8789612BC897DC6738A84A8E ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 8.zip"
sh=6FFC43AB08504E4686E0907C048DBDDF58138901 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 9.zip"
sh=7CE14ACFA84C8EC32448BFBDAC978CD5779A6048 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-02-09 074010\Backup files 1.zip"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung" ac=I fn="${Memory}"
Code:
Results of screen317's Security Check version 0.99.96 
 Windows 7 Service Pack 1 x64 (UAC is disabled!) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Trend Micro Security Agent 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 25 
 Java version 32-bit out of Date!
  Java 64-bit 8 Update 31 
 Adobe Flash Player 16.0.0.305 
 Adobe Reader 10.1.11 Adobe Reader out of Date! 
 Mozilla Firefox (35.0.1)
````````Process Check: objlist.exe by Laurent```````` 
 Trend Micro OfficeScan Client pccntmon.exe
 Trend Micro Security Agent ntrtscan.exe 
 Trend Micro Security Agent tmlisten.exe 
 Trend Micro Security Agent CCSF TmCCSF.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by andreas.chudalla at 2015-02-11 11:49:25
Running from C:\Users\andreas.chudalla\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Security Agent (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Trend Micro Security Agent Anti-Spyware (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
AutoCAD LT 2013 - Deutsch (German) (HKLM\...\AutoCAD LT 2013 - Deutsch (German)) (Version: 19.0.55.0 - Autodesk)
AutoCAD LT 2013 - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD LT 2013 Language Pack - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
browsersupport (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 Version: 5 - ${CompanyName}) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DigiTrakLWD (HKLM-x32\...\{D16E1774-E054-4684-815E-1D7E652327EF}) (Version: 2.012.00.000 - Digital-Control, Inc.)
ESS Energie Indikator (HKLM-x32\...\{6E83470B-5EE2-407D-ABFC-CC87E070ED8C}) (Version: 20.13.0 - Nemetschek Allplan GmbH)
ESTOS ProCall (HKLM-x32\...\{F2D50027-E910-4C2C-AC57-E7D806AAE64E}) (Version: 4.1.10.20036 - ESTOS)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM-x32\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{6BC1F8BE-E812-43FC-B648-90770D1C8F34}) (Version: 6.3a - Silicon Laboratories, Inc.)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 19.0.1240 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 9.0 - Trend Micro Inc.) Hidden
Windows Small Business Server 2008 ClientAgent (HKLM\...\{E4FF4DF1-F99C-49AC-B398-BE0887432846}) (Version: 6.0.5601.6 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
winengine (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\winengine) (Version: 20.020 - Ad business Crown Solutions)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\de-DE\acadltficn.dll (Autodesk, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-13 13:31 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {309DDB9E-E5B2-49C4-A862-37419536E206} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {386DF147-2C4A-43F7-BFBA-74BEECE839E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {39CCE3F9-BEB4-4791-85E6-1F7E953517E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3DBC1268-8B24-4A0D-B3C9-B0D747045405} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {462282DE-B532-47A9-9088-E092C9F7DD9B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E144FE06-4742-4F39-904C-BCC78CF23486} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F561A6DF-A3DF-43D0-87F0-D328B86A4C31} - System32\Tasks\sondhschedule => C:\Users\andreas.chudalla\AppData\Roaming\browsersupport\browsersupport-Installer.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-31 09:03 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-08-31 12:55 - 2011-08-31 12:55 - 00801792 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\sqlite3.dll
2009-07-02 15:32 - 2009-07-02 15:32 - 00089088 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\zlibwapi.dll
2013-01-16 09:19 - 2013-01-16 09:19 - 00048128 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_date_time-vc110-mt-1_49.dll
2013-04-02 11:25 - 2013-04-02 11:25 - 00675840 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\sqlite3.dll
2013-01-16 09:23 - 2013-01-16 09:23 - 00058368 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_thread-vc110-mt-1_49.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\windows\system32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\windows\system32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\windows\system32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\windows\system32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\windows\system32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\windows\system32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\windows\system32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\windows\system32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\windows\system32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\windows\system32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\windows\system32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\windows\system32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\windows\system32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\windows\system32\xi.dll
2013-04-17 14:32 - 2010-09-16 15:34 - 00146176 _____ () C:\Windows\System32\xdnorbgnd.exe
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\Windows\System32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\Windows\System32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\Windows\System32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\Windows\System32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\Windows\System32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\Windows\System32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\Windows\System32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\Windows\System32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\Windows\System32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\Windows\System32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\Windows\System32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\Windows\System32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\Windows\System32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\Windows\System32\xi.dll
2014-11-22 01:03 - 2014-11-22 01:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-12 13:34 - 2014-12-12 13:34 - 00511416 _____ () C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
2012-02-07 06:10 - 2012-02-07 06:10 - 00755624 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acapp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00184744 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accloudconnect.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00181672 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acismui.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 01382312 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acvmtools.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00826280 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accmmgr.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00111016 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acparameter.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00973736 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acdim.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00339880 _____ () c:\program files\autodesk\autocad lt 2013\acfdeval.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00225704 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accalcengine.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 02391976 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\aceplotx.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00162728 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acpltstamp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00246184 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acdatalink.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00359336 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\actable.crx
2011-04-29 20:23 - 2011-04-29 20:23 - 00125376 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axutil.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00385984 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_engine.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00158144 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axiom.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00034752 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_parser.dll
2011-04-29 20:27 - 2011-04-29 20:27 - 01315264 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\libxml2.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00103360 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\neethi.dll
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-02-10 07:46 - 2015-01-23 11:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Control Panel\Desktop\\Wallpaper -> C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-3572959257-616895921-2767358109-1001 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3572959257-616895921-2767358109-500 - Administrator - Disabled)
Gast (S-1-5-21-3572959257-616895921-2767358109-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/11/2015 11:43:39 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/11/2015 08:57:19 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/11/2015 08:57:17 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/11/2015 08:57:16 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)


System errors:
=============
Error: (02/11/2015 07:23:50 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (02/11/2015 07:23:20 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/11/2015 07:23:20 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (02/10/2015 03:52:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/10/2015 03:52:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (02/10/2015 03:52:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/10/2015 03:52:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (02/10/2015 03:52:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/10/2015 03:52:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (02/10/2015 03:52:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office Sessions:
=========================
Error: (02/11/2015 11:43:39 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (02/11/2015 08:57:19 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\andreas.chudalla\Desktop\esetsmartinstaller_deu.exe

Error: (02/11/2015 08:57:17 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\andreas.chudalla\Desktop\esetsmartinstaller_deu.exe

Error: (02/11/2015 08:57:16 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\andreas.chudalla\Desktop\esetsmartinstaller_deu.exe

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (02/11/2015 07:23:20 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
        Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)


CodeIntegrity Errors:
===================================
  Date: 2014-05-13 14:30:37.730
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-13 14:30:37.714
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 36%
Total physical RAM: 8154.33 MB
Available physical RAM: 5162.62 MB
Total Pagefile: 16306.84 MB
Available Pagefile: 13228.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.8 GB) (Free:0.97 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:465.76 GB) (Free:300.39 GB) NTFS
Drive g: (kollmerdaten) (Network) (Total:557.75 GB) (Free:236.18 GB) NTFS
Drive r: (Daten) (Network) (Total:309.4 GB) (Free:203.53 GB) NTFS
Drive u: (Daten) (Network) (Total:309.4 GB) (Free:203.53 GB) NTFS
Drive y: () (Network) (Total:400.19 GB) (Free:180.18 GB)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E3B0152C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 495EDE2A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by andreas.chudalla (administrator) on PC-0406 on 11-02-2015 11:48:52
Running from C:\Users\andreas.chudalla\Desktop
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-11 11:48 - 2015-02-11 11:49 - 00015338 _____ () C:\Users\andreas.chudalla\Desktop\FRST.txt
2015-02-11 11:48 - 2015-02-11 11:48 - 02132992 _____ (Farbar) C:\Users\andreas.chudalla\Desktop\FRST64.exe
2015-02-11 08:57 - 2015-02-11 08:57 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-11 08:36 - 2015-02-11 11:45 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-11 07:54 - 2015-02-11 07:54 - 00141312 _____ () C:\Users\andreas.chudalla\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-11 07:21 - 2015-02-11 07:21 - 00482080 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-11 07:21 - 2015-02-11 07:21 - 00000168 _____ () C:\windows\setupact.log
2015-02-11 07:21 - 2015-02-11 07:21 - 00000000 _____ () C:\windows\setuperr.log
2015-02-10 16:04 - 2015-02-11 08:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Mozilla
2015-02-10 07:46 - 2015-02-10 07:46 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-06 12:26 - 2015-02-06 12:26 - 00018431 _____ () C:\ComboFix.txt
2015-02-05 14:13 - 2015-02-11 11:48 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-05 12:55 - 2015-02-06 07:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:52 - 2015-02-11 11:40 - 00405675 _____ () C:\windows\WindowsUpdate.log
2015-02-05 09:47 - 2015-02-10 07:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-09 16:18 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-11 11:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-11 11:20 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-11 11:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-11 11:00 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-11 09:45 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-11 09:11 - 2014-02-11 09:08 - 00037610 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-11 07:28 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-11 07:28 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-11 07:25 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-11 07:25 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-11 07:25 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-11 07:23 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-11 07:21 - 2014-08-18 11:10 - 01004800 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-11 07:21 - 2014-08-18 11:10 - 00555604 _____ () C:\windows\system32\TmInstall.log
2015-02-11 07:21 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-11 07:21 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-10 15:51 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-10 15:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-06 12:27 - 2014-05-13 13:25 - 00000000 ____D () C:\Qoobox
2015-02-06 12:25 - 2009-07-14 03:34 - 00000215 ____N () C:\windows\system.ini
2015-02-06 11:40 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-02-06 08:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 08:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 08:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-16 12:10 - 2015-01-08 07:56 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Some content of TEMP:
====================
C:\Users\andreas.chudalla\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
--- --- ---

--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:35 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131