Trojaner-Board - Windows 8: URLs/Subdomains können temporär nicht erreicht werden

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 8: URLs/Subdomains können temporär nicht erreicht werden (https://www.trojaner-board.de/171782-windows-8-urls-subdomains-temporaer-erreicht.html)

Windows 8: URLs/Subdomains können temporär nicht erreicht werden

Hallo,

leider kann ich mit meinem Rechner einige URLs temporär nicht erreichen. Der Browser spielt hier wohl keine Rolle.
Manchmal sind ganze Seiten nicht erreichbar, und manchmal nur Subdomains wie rover.eb**y.de. Alles ist aber nur temporär.
Mit einem Proxy habe ich übrigens gar keine Probleme.

Ich habe mir mal meine "hosts"-Datei angeschaut, aber die ist sauber. Sonst hat meine Avira-Firewall auch einen (Port?)-Scan gemeldet, aber die Meldung ist leider nicht im Log hängen geblieben.

Vorab schonmal vielen Dank für Eure Hilfe hier!!!!

Ich habe die Anleitung einmal durchgearbeitet:

Defogger:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 11:00 on 03/10/2015 (N***)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST:

FRST.txt

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-09-2015

Ran by N*** (administrator) on S****** (03-10-2015 11:07:14)

Running from C:\Users\M*\Desktop

Loaded Profiles: N*** &  (Available Profiles: N***)

Platform: Windows 8.1 Pro (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(ACD Systems) D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(CyberGhost S.R.L.) C:\Program Files\CyberGhost 5\CyberGhost.exe

() D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe

(Suunto) C:\Users\M*\AppData\Local\Apps\2.0\MAHMQXVP.AEE\8B91HD6N.209\move..tion_391e8feca7b0cf78_0001.0003_5445a9a08ee15d6c\Moveslink2.exe

(Learnpulse) C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Nullsoft) D:\Program Files (x86)\Winamp\winamp.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(The OpenVPN Project) C:\Program Files\CyberGhost 5\Data\OpenVPN\openvpn.exe

(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\System32\calc.exe

() C:\Users\M*\Desktop\Defogger.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe
 
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)

HKLM\...\Run: [ACPW08DE] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe [1813776 2014-09-17] (ACD Systems)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-03] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [avgnt] => D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737712 2015-08-26] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Moveslink2] => C:\Users\M*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Screenpresso] => C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Moveslink2] => C:\Users\M*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Screenpresso] => C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Moveslink2] => C:\Users\M*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Screenpresso] => C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

ProxyEnable: [S-1-5-21-750122456-1480246655-3734385838-1001] => Proxy is enabled.

ProxyServer: [S-1-5-21-750122456-1480246655-3734385838-1001] => http=127.0.0.1:8887;https=127.0.0.1:8887

ProxyEnable: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => Proxy is enabled.

ProxyServer: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => http=127.0.0.1:8887;https=127.0.0.1:8887

ProxyEnable: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1] => Proxy is enabled.

ProxyServer: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1] => http=127.0.0.1:8887;https=127.0.0.1:8887

Tcpip\Parameters: [DhcpNameServer] 95.169.183.219 89.41.60.38 37.221.175.198

Tcpip\..\Interfaces\{07206F4B-DD46-4FF7-8312-D22C976ECBD4}: [NameServer] 95.169.183.219,89.41.60.38

Tcpip\..\Interfaces\{07206F4B-DD46-4FF7-8312-D22C976ECBD4}: [DhcpNameServer] 95.169.183.219 89.41.60.38 37.221.175.198

Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [NameServer] 95.169.183.219,89.41.60.38

Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [DhcpNameServer] 192.168.0.1 192.168.0.2
 

Internet Explorer:

==================

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-10-15] (Oracle Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
 

FireFox:

========

FF ProfilePath: C:\Users\M*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-21] ()

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> d:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-09-19] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-21] ()

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-07] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-07] (NVIDIA Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-09-19] (Adobe Systems)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\M*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\M*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\M*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Extension: Delete Bookmark Icons - C:\Users\M*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{04514a2c-a3ab-4f47-8688-55f911b0fe75}.xpi [2015-03-05]

FF Extension: Adblock Plus - C:\Users\M*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-07]

StartMenuInternet: FIREFOX.EXE - d:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirFirewallService; D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1054976 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirMailService; D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [835616 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [456528 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [456528 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1013264 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [63968 2015-05-21] (CyberGhost S.R.L)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-23] (NVIDIA Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

S2 MBAMService; d:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-06-03] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-03] (NVIDIA Corporation)

S2 SkypeUpdate; D:\Program Files (x86)\Skype\Updater\Updater.exe [327296 2015-06-03] (Skype Technologies)

R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 avfwim; C:\Windows\system32\DRIVERS\avfwim.sys [114608 2014-12-08] (Avira GmbH)

R1 avfwot; C:\Windows\system32\DRIVERS\avfwot.sys [141376 2014-12-08] (Avira GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137288 2015-08-26] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-08-26] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-03] (Avira Operations GmbH & Co. KG)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-10-03] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

S3 nuviocir; C:\Windows\system32\DRIVERS\nuviocir_x64.sys [39704 2013-07-15] (Nuvoton Technology Corp.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-03] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-04-03] (NVIDIA Corporation)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-10-03 11:07 - 2015-10-03 11:07 - 00019905 _____ C:\Users\M*\Desktop\FRST.txt

2015-10-03 11:07 - 2015-10-03 11:07 - 00000000 ____D C:\FRST

2015-10-03 11:05 - 2015-10-03 11:05 - 02192384 _____ (Farbar) C:\Users\M*\Desktop\FRST64.exe

2015-10-03 11:00 - 2015-10-03 11:00 - 00000470 _____ C:\Users\M*\Desktop\defogger_disable.log

2015-10-03 10:59 - 2015-10-03 10:59 - 00000470 _____ C:\Users\M*\Downloads\defogger_disable.log

2015-10-03 10:59 - 2015-10-03 10:59 - 00000000 _____ C:\Users\M*\defogger_reenable

2015-10-03 10:59 - 2015-10-03 10:58 - 00050477 _____ C:\Users\M*\Desktop\Defogger.exe

2015-09-22 18:34 - 2015-08-22 15:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-09-22 18:34 - 2015-08-10 20:15 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2015-09-22 18:34 - 2015-08-10 20:15 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2015-09-22 18:34 - 2015-08-10 20:06 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2015-09-22 18:34 - 2015-08-10 19:49 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2015-09-22 18:34 - 2015-08-10 18:56 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2015-09-22 18:34 - 2015-08-10 18:46 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2015-09-22 18:34 - 2015-08-07 23:41 - 07460168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-09-22 18:34 - 2015-08-07 23:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll

2015-09-22 18:34 - 2015-08-07 16:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2015-09-22 18:34 - 2015-08-06 21:15 - 01658544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-09-22 18:34 - 2015-08-06 21:15 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-09-22 18:34 - 2015-08-06 21:15 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-09-22 18:34 - 2015-08-06 21:15 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-09-22 18:34 - 2015-08-06 19:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx

2015-09-22 18:34 - 2015-08-06 18:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2015-09-22 18:34 - 2015-08-06 18:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx

2015-09-22 18:34 - 2015-08-06 18:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2015-09-22 18:34 - 2015-07-16 20:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll

2015-09-08 22:16 - 2015-09-03 04:18 - 02531400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

2015-09-08 22:16 - 2015-09-03 04:17 - 01903848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2015-09-08 22:16 - 2015-09-02 20:48 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-09-08 22:16 - 2015-09-02 19:09 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-09-08 22:16 - 2015-08-27 04:48 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-09-08 22:16 - 2015-08-26 20:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-09-08 22:16 - 2015-08-26 20:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-09-08 22:16 - 2015-08-26 20:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-09-08 22:16 - 2015-08-26 20:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-09-08 22:16 - 2015-08-26 16:46 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-09-08 22:16 - 2015-08-26 16:29 - 02240512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-09-08 22:16 - 2015-08-26 16:27 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-09-08 22:16 - 2015-08-26 16:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-09-08 22:16 - 2015-08-26 16:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-09-08 22:16 - 2015-08-26 16:26 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-09-08 22:16 - 2015-08-26 16:26 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-09-08 22:16 - 2015-08-22 20:19 - 25188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-09-08 22:16 - 2015-08-22 19:35 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-09-08 22:16 - 2015-08-22 19:34 - 00585216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-09-08 22:16 - 2015-08-22 19:22 - 19856384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-09-08 22:16 - 2015-08-22 19:21 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-09-08 22:16 - 2015-08-22 19:20 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-09-08 22:16 - 2015-08-22 18:55 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-09-08 22:16 - 2015-08-22 18:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-09-08 22:16 - 2015-08-22 18:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-09-08 22:16 - 2015-08-22 18:45 - 00665600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-09-08 22:16 - 2015-08-22 18:44 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-09-08 22:16 - 2015-08-22 18:41 - 14451712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-09-08 22:16 - 2015-08-22 18:41 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-09-08 22:16 - 2015-08-22 18:41 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-09-08 22:16 - 2015-08-22 18:41 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-09-08 22:16 - 2015-08-22 18:39 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-09-08 22:16 - 2015-08-22 18:28 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-09-08 22:16 - 2015-08-22 18:26 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-09-08 22:16 - 2015-08-22 18:23 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-09-08 22:16 - 2015-08-22 18:22 - 12857344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-09-08 22:16 - 2015-08-22 18:20 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-09-08 22:16 - 2015-08-22 18:18 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-09-08 22:16 - 2015-08-22 18:18 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-09-08 22:16 - 2015-08-22 18:18 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-09-08 22:16 - 2015-08-22 18:14 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-09-08 22:16 - 2015-08-22 18:01 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-09-08 22:16 - 2015-08-22 18:00 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-09-08 22:16 - 2015-08-22 17:56 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-09-08 22:16 - 2015-08-22 17:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-09-08 22:16 - 2015-07-30 19:18 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\InkEd.dll

2015-09-08 22:16 - 2015-07-30 18:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InkEd.dll

2015-09-08 22:15 - 2015-09-02 04:56 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-09-08 22:15 - 2015-09-02 04:55 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-09-08 22:15 - 2015-09-02 04:50 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-09-08 22:15 - 2015-09-02 04:17 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-09-08 22:15 - 2015-09-02 04:13 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-09-08 22:15 - 2015-08-03 23:15 - 00074928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll

2015-09-08 22:15 - 2015-08-03 23:15 - 00065600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll

2015-09-08 22:15 - 2015-08-01 16:22 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidsvc.dll

2015-09-08 22:15 - 2015-08-01 05:47 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\schtasks.exe

2015-09-08 22:15 - 2015-08-01 05:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schtasks.exe

2015-09-08 22:15 - 2015-08-01 05:38 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2015-09-08 22:15 - 2015-08-01 05:37 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskeng.exe

2015-09-08 22:15 - 2015-08-01 05:37 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskeng.exe

2015-09-08 22:15 - 2015-07-22 16:34 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-09-08 22:15 - 2015-07-22 16:33 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll

2015-09-08 22:15 - 2015-07-22 16:25 - 02461184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-09-08 22:15 - 2015-07-22 16:25 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll

2015-09-08 22:15 - 2015-07-18 20:31 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll

2015-09-08 22:15 - 2015-07-18 20:29 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll

2015-09-08 22:15 - 2015-07-18 20:29 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll

2015-09-08 22:15 - 2015-07-18 20:27 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-10-03 11:06 - 2014-11-18 00:07 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-10-03 11:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-10-03 10:59 - 2013-08-23 00:08 - 00000000 ____D C:\Users\M*

2015-10-03 10:36 - 2013-08-23 00:19 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-750122456-1480246655-3734385838-1001

2015-10-03 10:31 - 2015-03-03 20:43 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-10-03 10:30 - 2015-03-03 20:41 - 00000826 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-03 10:30 - 2015-03-03 20:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-03 09:45 - 2015-03-14 20:56 - 00000000 ____D C:\Users\M*\AppData\Local\Deployment

2015-10-02 20:16 - 2015-02-15 12:10 - 01823445 _____ C:\WINDOWS\WindowsUpdate.log

2015-09-29 22:03 - 2014-08-27 21:19 - 00000000 ____D C:\Users\M*\AppData\Roaming\vlc

2015-09-29 18:48 - 2013-08-23 00:14 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-09-29 18:41 - 2015-05-29 20:39 - 00000000 ____D C:\ProgramData\NVIDIA

2015-09-29 18:41 - 2015-03-15 11:58 - 00033720 _____ C:\WINDOWS\setupact.log

2015-09-29 18:41 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-09-27 17:47 - 2014-10-20 20:41 - 00000000 ____D C:\Users\M*\AppData\Local\CyberGhost

2015-09-24 10:20 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache

2015-09-22 18:35 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-09-21 22:06 - 2014-11-18 00:07 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-09-15 03:18 - 2013-08-22 17:38 - 00812008 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-09-15 03:18 - 2013-08-22 17:38 - 00178152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-09-13 00:07 - 2015-07-31 23:17 - 00000000 ____D C:\Users\M*\AppData\Roaming\Bioshock

2015-09-09 19:59 - 2015-03-15 12:39 - 00362792 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-09-09 19:56 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2015-09-08 22:20 - 2013-08-22 21:11 - 00000000 ____D C:\Program Files\Windows Journal

2015-09-08 22:19 - 2014-08-27 20:54 - 00000000 ____D C:\WINDOWS\system32\M*T
 

Some files in TEMP:

====================

C:\Users\M*\AppData\Local\Temp\avgnt.exe

C:\Users\M*\AppData\Local\Temp\AZxfyihpcsUxOPURbdOO.DLL

C:\Users\M*\AppData\Local\Temp\i4jdel0.exe

C:\Users\M*\AppData\Local\Temp\iSNYcLSqMQ.DLL

C:\Users\M*\AppData\Local\Temp\mExgeeVDIOvSblHxCxIx.DLL

C:\Users\M*\AppData\Local\Temp\nvStInst.exe

C:\Users\M*\AppData\Local\Temp\OXTqqBUkQIvbJHJNpPST.DLL

C:\Users\M*\AppData\Local\Temp\proxy_vole6515560313283769685.dll

C:\Users\M*\AppData\Local\Temp\RzhqfrvaIb.DLL

C:\Users\M*\AppData\Local\Temp\SkypeSetup.exe

C:\Users\M*\AppData\Local\Temp\TJcqOEiClNxNAIzFTyeb.DLL

C:\Users\M*\AppData\Local\Temp\ueoHSLTboj.DLL

C:\Users\M*\AppData\Local\Temp\VtAERJvAFreCvAWmdjwz.DLL

C:\Users\M*\AppData\Local\Temp\ZojWDFQuKnPGaJNelZXo.DLL
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-09-26 01:48
 

==================== End of FRST.txt ============================

Additions.txt:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:30-09-2015

Ran by N*** (2015-10-03 11:08:05)

Running from C:\Users\M*\Desktop

Windows 8.1 Pro (X64) (2013-08-22 22:11:16)

Boot Mode: Normal

==========================================================
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-750122456-1480246655-3734385838-500 - Administrator - Disabled)

Guest (S-1-5-21-750122456-1480246655-3734385838-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-750122456-1480246655-3734385838-1007 - Limited - Enabled)

N*** (S-1-5-21-750122456-1480246655-3734385838-1001 - Administrator - Enabled) => C:\Users\M*
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: FireWall (Enabled) {753F9273-B322-2907-AC37-03D0F1702F22}
 

==================== Installed Programs ======================
 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

ACDSee Pro 8 (64-bit) (HKLM\...\{F84CE839-8CDD-4DC1-9A05-FA93BEA8B63D}) (Version: 8.1.0.270 - ACD Systems International Inc.)

Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)

Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.0 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)

Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.12.264 - Avira Operations GmbH & Co. KG)

BioShock version 1.1 (HKLM-x32\...\{4AA8D978-38C1-475B-936C-C79143624B61}_is1) (Version: 1.1 - 2K Games)

BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 - BlueJ Team)

CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)

CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)

ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)

Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)

Java SE Development Kit 8 Update 20 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180200}) (Version: 8.0.200.26 - Oracle Corporation)

JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)

Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Moveslink2 (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\09caaf8ee8bfbd57) (Version: 1.3.23.5732 - Suunto)

Moveslink2 (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\09caaf8ee8bfbd57) (Version: 1.3.23.5732 - Suunto)

Moveslink2 (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\09caaf8ee8bfbd57) (Version: 1.3.23.5732 - Suunto)

Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)

Mozilla Firefox 41.0.1 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)

Mozilla Firefox 41.0.1 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)

Mozilla Firefox 41.0.1 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)

Mozilla Thunderbird 38.3.0 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)

Mozilla Thunderbird 38.3.0 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)

Mozilla Thunderbird 38.3.0 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)

NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 353.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 353.82 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.4.5.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.5.28 - NVIDIA Corporation)

NVIDIA Graphics Driver 353.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.82 - NVIDIA Corporation)

NVIDIA Miracast Virtual Audio 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 352.86 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)

NZB Download App (x64) (HKLM\...\NZB Download - NzbLoad) (Version:  - AnryNet Development)

OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)

PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)

Portal 2 (HKLM-x32\...\Postal 2_is1) (Version:  - )

QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)

Screenpresso (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Screenpresso) (Version: 1.5.6.0 - Learnpulse)

Screenpresso (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Screenpresso) (Version: 1.5.6.0 - Learnpulse)

Screenpresso (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Screenpresso) (Version: 1.5.6.0 - Learnpulse)

SHIELD Streaming (Version: 4.1.2000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 2.4.5.28 - NVIDIA Corporation) Hidden

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)

Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)

TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )

TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.41459 - TeamViewer)

The Elder Scrolls V Skyrim - Legendary Edition (HKLM-x32\...\The Elder Scrolls V Skyrim - Legendary Edition_is1) (Version:  - )

The Witcher 3 - Wild Hunt (HKLM-x32\...\1207664643_is1) (Version: 1.0.0.0 - GOG.com)

Tomb Raider (HKLM-x32\...\Tomb Raider_is1) (Version:  - )

Unity Web Player (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)

Unity Web Player (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)

Unity Web Player (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)

VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
 

==================== Custom CLSID (Whitelisted): ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== Restore Points =========================
 

16-09-2015 07:44:37 Scheduled Checkpoint

22-09-2015 18:34:53 Windows Update

01-10-2015 08:28:25 Scheduled Checkpoint
 

==================== Hosts content: ===============================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (Whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

Task: {A58526E5-7415-4D54-B983-9A73E1E34234} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)

Task: {BA093601-5168-45C7-9AF8-5A54B81F4F54} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-21] (Adobe Systems Incorporated)

Task: {C0D2DE04-A65C-42ED-9013-1F88CC36EB50} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser

Task: {D42178DF-38A8-48D5-8DEE-46EFD01860DD} - System32\Tasks\Microsoft\Windows\RemovalTools\M*T_HB => C:\WINDOWS\system32\M*T.exe [2015-08-26] (Microsoft Corporation)

Task: {FF70EB16-78B1-420D-89FD-38574F85D2DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (Whitelisted) ==============
 

2015-05-29 20:39 - 2015-08-07 02:44 - 00116528 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-01-29 23:02 - 2015-06-01 21:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll

2014-12-17 15:15 - 2014-12-17 15:15 - 02141192 _____ () D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe

2015-02-19 23:40 - 2015-02-19 23:40 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-10-03 10:59 - 2015-10-03 10:58 - 00050477 _____ () C:\Users\M*\Desktop\Defogger.exe

2015-05-29 20:47 - 2015-06-03 23:06 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll

2014-10-20 20:34 - 2015-05-21 14:27 - 00032768 _____ () C:\Program Files\CyberGhost 5\de\CyberGhost.resources.dll

2014-11-12 20:44 - 2015-05-21 14:48 - 01427424 _____ () C:\Program Files\CyberGhost 5\Geckofx-Core.dll

2015-06-24 19:54 - 2015-06-24 19:54 - 08524856 _____ () C:\Users\M*\AppData\Local\Apps\2.0\MAHMQXVP.AEE\8B91HD6N.209\move..tion_391e8feca7b0cf78_0001.0003_5445a9a08ee15d6c\BLLWrapper.DLL

2013-08-13 20:42 - 2002-04-29 13:12 - 00069632 _____ () D:\Program Files (x86)\Winamp\Plugins\in_cdda.dll

2013-08-13 20:42 - 2003-05-06 01:37 - 00096768 _____ () D:\Program Files (x86)\Winamp\Plugins\in_flac.dll

2013-08-13 20:42 - 2002-03-20 12:43 - 00114688 _____ () D:\Program Files (x86)\Winamp\Plugins\in_midi.dll

2013-08-13 20:42 - 2002-04-27 09:14 - 00093696 _____ () D:\Program Files (x86)\Winamp\Plugins\read_file.dll

2013-08-13 20:42 - 2002-04-27 09:12 - 00151040 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mod.dll

2013-08-13 20:42 - 2002-04-24 23:56 - 00188928 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mp3.dll

2013-08-13 20:42 - 2005-09-05 07:27 - 00077824 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mpc.dll

2013-08-13 20:42 - 2002-04-29 12:44 - 00221696 _____ () D:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll

2013-08-13 20:42 - 2002-04-17 01:18 - 00035328 _____ () D:\Program Files (x86)\Winamp\Plugins\in_wave.dll

2013-08-13 20:42 - 2002-01-15 01:01 - 00102400 _____ () D:\Program Files (x86)\Winamp\Plugins\in_wm.dll

2013-08-13 20:42 - 2001-12-30 17:08 - 00015360 _____ () D:\Program Files (x86)\Winamp\Plugins\out_disk.dll

2013-08-13 20:42 - 2002-04-28 22:03 - 00023552 _____ () D:\Program Files (x86)\Winamp\Plugins\out_ds.dll

2013-08-13 20:42 - 2002-04-27 07:38 - 00011776 _____ () D:\Program Files (x86)\Winamp\Plugins\out_wave.dll

2015-10-02 23:13 - 2015-10-02 23:13 - 00153768 _____ () D:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll

2015-10-02 23:13 - 2015-10-02 23:13 - 00023208 _____ () D:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
 

==================== Alternate Data Streams (Whitelisted) =========
 

(If an entry is included in the fixlist, only the ADS will be removed.)
 

AlternateDataStreams: C:\Users\M*\Desktop\install-tl.exe:BDU

AlternateDataStreams: C:\Users\M*\Desktop\R-3.0.2-win.exe:BDU

AlternateDataStreams: C:\Users\M*\Desktop\TeamViewer_Setup_de.exe:BDU
 

==================== Safe Mode (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (Whitelisted) ===============
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 

==================== Internet Explorer trusted/restricted ===============
 

(If an entry is included in the fixlist, it will be removed from the registry.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\M*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\M*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper -> C:\Users\M*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 95.169.183.219 - 89.41.60.38

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is disabled.
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== FirewallRules (Whitelisted) ===============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [TCP Query User{9C1BB2C8-3EFA-4CC3-A6E1-E6DFB25E7528}D:\program files (x86)\skype\phone\skype.exe] => (Allow) D:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{3C87A92E-E92E-45C4-BCDF-000EEDBEE095}D:\program files (x86)\skype\phone\skype.exe] => (Allow) D:\program files (x86)\skype\phone\skype.exe

FirewallRules: [TCP Query User{B43E508A-DC32-4B9F-AA23-7F3251DBF6B3}D:\program files (x86)\skype\phone\skype.exe] => (Block) D:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{0883E134-46A9-4A49-856C-22629481C00B}D:\program files (x86)\skype\phone\skype.exe] => (Block) D:\program files (x86)\skype\phone\skype.exe

FirewallRules: [TCP Query User{1C08E0E9-6BBB-496C-BD52-D8649C4BF443}E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe] => (Allow) E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe

FirewallRules: [UDP Query User{2EEF00BD-61DD-4F21-80D3-265669C14E68}E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe] => (Allow) E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe

FirewallRules: [TCP Query User{CEF265D4-D61D-4CD1-AE92-F22E8C3099ED}C:\program files\java\jre1.8.0_25\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_25\bin\javaw.exe

FirewallRules: [UDP Query User{F1365788-B030-412F-9A2A-24DC77B54E80}C:\program files\java\jre1.8.0_25\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_25\bin\javaw.exe

FirewallRules: [{EC188990-B99E-4E9C-B8EF-1CC39C3ADC9E}] => (Block) C:\program files\java\jre1.8.0_25\bin\javaw.exe

FirewallRules: [{941230A0-6B19-43DE-8654-E5789044F9D1}] => (Block) C:\program files\java\jre1.8.0_25\bin\javaw.exe

FirewallRules: [{C36744A3-CFEF-461D-A416-92B800B8D457}] => (Allow) d:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{84FACE51-17DA-4F4C-ADA7-4B550E0AD54C}] => (Allow) d:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{E8585E2C-A0F6-432C-908C-3928B863BA74}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe

FirewallRules: [{ABED24DC-A42E-43B5-8C5F-3ACA97F57E17}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe

FirewallRules: [{14414FB6-BE12-4D18-B227-BB94E0522862}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

FirewallRules: [{0642C44C-743E-4A2A-BDB6-4F14674038B8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

FirewallRules: [{5FAB11A5-32D7-433A-BC79-6BB6825F4072}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{D619AEAE-11F1-4D19-8986-2A38A38DF0D7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{0C43F043-E77F-422C-B95B-5044C010696D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{DDCBA8E8-7385-42FC-A544-C9D72FA3845F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{44D17559-82C8-49B1-AA4B-08081883B74B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{85F22C8F-12A1-4EED-9FFC-4140FF8E9385}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/03/2015 10:57:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*******)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/03/2015 10:42:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/03/2015 10:12:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/03/2015 09:55:12 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/03/2015 09:55:12 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/02/2015 11:28:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/02/2015 11:13:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/02/2015 11:13:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/02/2015 10:58:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 

Error: (10/02/2015 10:28:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)

Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
 

System errors:

=============

Error: (10/03/2015 09:56:13 AM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (10/03/2015 09:55:43 AM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (10/02/2015 08:47:20 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.
 

Error: (10/02/2015 06:53:53 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )

Description: 4
 

Error: (10/02/2015 05:49:30 PM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (10/02/2015 05:49:00 PM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (10/01/2015 08:27:46 AM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (10/01/2015 08:27:16 AM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (09/30/2015 11:00:09 AM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (09/30/2015 10:59:39 AM) (Source: DCOM) (EventID: 10010) (User: S*********)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz

Percentage of memory in use: 34%

Total physical RAM: 8104.57 MB

Available physical RAM: 5337.7 MB

Total Virtual: 9448.57 MB

Available Virtual: 5904.54 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:149.14 GB) (Free:63.72 GB) NTFS

Drive d: (Install) (Fixed) (Total:750 GB) (Free:562.03 GB) NTFS

Drive e: () (Fixed) (Total:1746.82 GB) (Free:518.87 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: ADCE52A5)
 

Partition: GPT.
 

==================== End of Addition.txt ============================

GMER:
Als ich GMER gestartete habe, erschien eine Systemmeldung, die sich während des Scans mit ähnlicher Mittleiung wiederholte

1. Beim Start:
"C:\Windows\system32\config\system: The process cannot acces the file becaus it is being used by another process"
2. Während des Scans_
"c:\USERS\**\ntuser.dat: The process cannot acces the file becaus it is being used by another process"

Die Log sieht wie folgt aus:

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2015-10-03 11:30:26

Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000031 ST3000DM001-1CH166 rev.CC24 2794,52GB

Running: Gmer-19357.exe; Driver: C:\Users\**\AppData\Local\Temp\kxlcrpow.sys
 
 

---- Threads - GMER 2.1 ----
 

Thread  C:\WINDOWS\system32\csrss.exe [644:2092]    fffff960008a12d0

Thread  C:\WINDOWS\system32\svchost.exe [680:6096]  00007ff9a6f339b0
 

---- EOF - GMER 2.1 ----

hi,

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Hi Schrauber,

danke für die schnelle Rückmeldung und Deine Hilfe! Rootkits konnten nicht gefunden werden und ich konnte somit auch nichts säubern.
Hier ist der log von mbar:

Code:

Malwarebytes Anti-Rootkit BETA 1.9.3.1001

www.malwarebytes.org
 

Database version:

  main:    v2015.10.04.02

  rootkit: v2015.10.02.01
 

Windows 8.1 x64 NTFS

Internet Explorer 11.0.9600.18036

N*** :: S***** [administrator]
 

04.10.2015 13:15:38

mbar-log-2015-10-04 (13-15-38).txt
 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 359975

Time elapsed: 14 minute(s), 40 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

Physical Sectors Detected: 0

(No malicious items detected)
 

(end)

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Konnte nun endlich weiter machen:

MBAM
hat etwas gefunden und Antivir hat augenscheinlich die Änderungen beim quaräntieren geblockt. Daher habe ich einen zweiten Lauf ohne Echtzeit-Scanner durchgeführt und es wurde nix gefunden. Ja es war etwas doof, aber da im zweiten Lauf nichts gefunden wurde, hoffe ich mal das ein Trojaner oÄ nichts zurückgesetzt hat. Die Einträge in der Quarantäne sind auch vorhanden. Auch ein dritter Lauf hat nichts mehr gefunden und ich glaube die Schadsoftware hat nivhts mehr nachträglich verändert.
Hier ist der erste LOg:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlaufdatum: 05.10.2015

Suchlaufzeit: 18:07

Protokolldatei: mbam.txt

Administrator: Ja
 

Version: 2.1.8.1057

Malware-Datenbank: v2015.10.05.05

Rootkit-Datenbank: v2015.10.02.01

Lizenz: Testversion

Malware-Schutz: Aktiviert

Schutz vor bösartigen Websites: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 8.1

CPU: x64

Dateisystem: NTFS

Benutzer: N***
 

Suchlauftyp: Bedrohungssuchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 360324

Abgelaufene Zeit: 13 Min., 3 Sek.
 

Speicher: Aktiviert

Start: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(keine bösartigen Elemente erkannt)
 

Module: 0

(keine bösartigen Elemente erkannt)
 

Registrierungsschlüssel: 0

(keine bösartigen Elemente erkannt)
 

Registrierungswerte: 0

(keine bösartigen Elemente erkannt)
 

Registrierungsdaten: 0

(keine bösartigen Elemente erkannt)
 

Ordner: 2

PUP.Optional.OpenCandy, C:\Users\M*\AppData\Roaming\OpenCandy, , [85d4a9aaf09b88ae7cce9971d72cc838], 

PUP.Optional.OpenCandy, C:\Users\M*\AppData\Roaming\OpenCandy\859D2C49CD0F4526A69F8D700F91F446, , [85d4a9aaf09b88ae7cce9971d72cc838], 
 

Dateien: 1

PUP.Optional.OpenCandy, C:\Users\M*\AppData\Roaming\OpenCandy\859D2C49CD0F4526A69F8D700F91F446\TuneUpUtilities2014_de-DE_2200571.exe, , [85d4a9aaf09b88ae7cce9971d72cc838], 
 

Physische Sektoren: 0

(keine bösartigen Elemente erkannt)
 
 

(end)

ADW hat nichts gefunden:

Code:

# AdwCleaner v5.010 - Logfile created 05/10/2015 at 18:46:24

# Updated 04/10/2015 by Xplode

# Database : 2015-10-05.1 [Server]

# Operating system : Windows 8.1 Pro  (x64)

# Username : N*** - S******

# Running from : C:\Users\M*\Desktop\Trojan\AdwCleaner_5.010.exe

# Option : Scan

# Support : hxxp://toolslib.net/forum
 

***** [ Services ] *****
 
 

***** [ Folders ] *****
 
 

***** [ Files ] *****
 
 

***** [ DLLs ] *****
 
 

***** [ Shortcuts ] *****
 
 

***** [ Scheduled tasks ] *****
 
 

***** [ Registry ] *****
 
 

***** [ Web browsers ] *****
 
 

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [572 bytes] ##########

Und am Ende noch JRT ausgeführt:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.6.4 (09.28.2015:1)

OS: Windows 8.1 Pro x64

Ran by N**** on 05.10.2015 at 18:49:48,60

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Tasks
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 05.10.2015 at 18:51:09,51

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Das frische FRST log fehlt noch. Was machen die Probleme?

Ich glaube die Schadsoftware ist nun wohl weg. Keines der hiewr verwendeten Programme kann nun irgendwas finden :)

Danke für die Hilfe!!!!!!! :taenzer:

Das frische Log ist hier:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-10-2015

Ran by N**** (administrator) on SUPERN**** (07-10-2015 20:14:17)

Running from C:\Users\m*\Desktop\Trojan

Loaded Profiles: N*** (Available Profiles: N***)

Platform: Windows 8.1 Pro (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(ACD Systems) D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(CyberGhost S.R.L.) C:\Program Files\CyberGhost 5\CyberGhost.exe

() D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe

(Suunto) C:\Users\m*\AppData\Local\Apps\2.0\MAHMQXVP.AEE\8B91HD6N.209\move..tion_391e8feca7b0cf78_0001.0003_3bc622373ad2c5ec\Moveslink2.exe

(Learnpulse) C:\Users\m*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_185.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_185.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe
 
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)

HKLM\...\Run: [ACPW08DE] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe [1813776 2014-09-17] (ACD Systems)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-03] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [avgnt] => D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737712 2015-08-26] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Moveslink2] => C:\Users\m*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Screenpresso] => C:\Users\m*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

Tcpip\..\Interfaces\{07206F4B-DD46-4FF7-8312-D22C976ECBD4}: [NameServer] 95.169.183.219,89.41.60.38

Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [NameServer] 95.169.183.219,89.41.60.38

Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [DhcpNameServer] 192.168.0.1 192.168.0.2
 

Internet Explorer:

==================

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-10-15] (Oracle Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
 

FireFox:

========

FF ProfilePath: C:\Users\m*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-21] ()

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> d:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-09-19] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-21] ()

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-07] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-07] (NVIDIA Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-09-19] (Adobe Systems)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\m*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Extension: Delete Bookmark Icons - C:\Users\m*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{04514a2c-a3ab-4f47-8688-55f911b0fe75}.xpi [2015-03-05]

FF Extension: Adblock Plus - C:\Users\m*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-07]

StartMenuInternet: FIREFOX.EXE - d:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirFirewallService; D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1054976 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirMailService; D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [835616 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [456528 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [456528 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1013264 2015-08-26] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [63968 2015-05-21] (CyberGhost S.R.L)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-23] (NVIDIA Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-06-03] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-03] (NVIDIA Corporation)

S2 SkypeUpdate; D:\Program Files (x86)\Skype\Updater\Updater.exe [327296 2015-06-03] (Skype Technologies)

R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 avfwim; C:\Windows\system32\DRIVERS\avfwim.sys [114608 2014-12-08] (Avira GmbH)

R1 avfwot; C:\Windows\system32\DRIVERS\avfwot.sys [141376 2014-12-08] (Avira GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137288 2015-08-26] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-08-26] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-03] (Avira Operations GmbH & Co. KG)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-10-07] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

S3 nuviocir; C:\Windows\system32\DRIVERS\nuviocir_x64.sys [39704 2013-07-15] (Nuvoton Technology Corp.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-03] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-04-03] (NVIDIA Corporation)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-10-05 18:51 - 2015-10-05 18:51 - 00000597 _____ C:\Users\m*\Desktop\JRT.txt

2015-10-05 18:06 - 2015-10-07 19:57 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-10-05 18:06 - 2015-10-05 18:06 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-05 18:06 - 2015-10-05 18:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-05 18:06 - 2015-10-05 18:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-05 18:06 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-10-05 18:06 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-10-05 18:06 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-10-04 12:36 - 2015-10-04 13:36 - 00000000 ____D C:\Users\m*\Desktop\mbar

2015-10-04 12:36 - 2015-10-04 13:36 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-10-03 11:37 - 2015-10-03 11:37 - 00000000 _____ C:\Users\m*\Desktop\Gmer-19357.exe

2015-10-03 11:32 - 2015-10-07 20:14 - 00000000 ____D C:\Users\m*\Desktop\Trojan

2015-10-03 11:07 - 2015-10-07 20:14 - 00000000 ____D C:\FRST

2015-10-03 10:59 - 2015-10-03 10:59 - 00000470 _____ C:\Users\m*\Downloads\defogger_disable.log

2015-10-03 10:59 - 2015-10-03 10:59 - 00000000 _____ C:\Users\m*\defogger_reenable

2015-09-22 18:34 - 2015-08-22 15:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-09-22 18:34 - 2015-08-10 20:15 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2015-09-22 18:34 - 2015-08-10 20:15 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2015-09-22 18:34 - 2015-08-10 20:06 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2015-09-22 18:34 - 2015-08-10 19:49 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2015-09-22 18:34 - 2015-08-10 18:56 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2015-09-22 18:34 - 2015-08-10 18:46 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2015-09-22 18:34 - 2015-08-07 23:41 - 07460168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-09-22 18:34 - 2015-08-07 23:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll

2015-09-22 18:34 - 2015-08-07 16:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2015-09-22 18:34 - 2015-08-06 21:15 - 01658544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-09-22 18:34 - 2015-08-06 21:15 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-09-22 18:34 - 2015-08-06 21:15 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-09-22 18:34 - 2015-08-06 21:15 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-09-22 18:34 - 2015-08-06 19:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx

2015-09-22 18:34 - 2015-08-06 18:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2015-09-22 18:34 - 2015-08-06 18:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx

2015-09-22 18:34 - 2015-08-06 18:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2015-09-22 18:34 - 2015-07-16 20:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll

2015-09-08 22:16 - 2015-09-03 04:18 - 02531400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

2015-09-08 22:16 - 2015-09-03 04:17 - 01903848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2015-09-08 22:16 - 2015-09-02 20:48 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-09-08 22:16 - 2015-09-02 19:09 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-09-08 22:16 - 2015-08-27 04:48 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-09-08 22:16 - 2015-08-26 20:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-09-08 22:16 - 2015-08-26 20:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-09-08 22:16 - 2015-08-26 20:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-09-08 22:16 - 2015-08-26 20:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-09-08 22:16 - 2015-08-26 16:46 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-09-08 22:16 - 2015-08-26 16:29 - 02240512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-09-08 22:16 - 2015-08-26 16:27 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-09-08 22:16 - 2015-08-26 16:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-09-08 22:16 - 2015-08-26 16:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-09-08 22:16 - 2015-08-26 16:26 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-09-08 22:16 - 2015-08-26 16:26 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-09-08 22:16 - 2015-08-22 20:19 - 25188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-09-08 22:16 - 2015-08-22 19:35 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-09-08 22:16 - 2015-08-22 19:34 - 00585216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-09-08 22:16 - 2015-08-22 19:22 - 19856384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-09-08 22:16 - 2015-08-22 19:21 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-09-08 22:16 - 2015-08-22 19:20 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-09-08 22:16 - 2015-08-22 18:55 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-09-08 22:16 - 2015-08-22 18:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-09-08 22:16 - 2015-08-22 18:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-09-08 22:16 - 2015-08-22 18:45 - 00665600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-09-08 22:16 - 2015-08-22 18:44 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-09-08 22:16 - 2015-08-22 18:41 - 14451712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-09-08 22:16 - 2015-08-22 18:41 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-09-08 22:16 - 2015-08-22 18:41 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-09-08 22:16 - 2015-08-22 18:41 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-09-08 22:16 - 2015-08-22 18:39 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-09-08 22:16 - 2015-08-22 18:28 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-09-08 22:16 - 2015-08-22 18:26 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-09-08 22:16 - 2015-08-22 18:23 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-09-08 22:16 - 2015-08-22 18:22 - 12857344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-09-08 22:16 - 2015-08-22 18:20 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-09-08 22:16 - 2015-08-22 18:18 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-09-08 22:16 - 2015-08-22 18:18 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-09-08 22:16 - 2015-08-22 18:18 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-09-08 22:16 - 2015-08-22 18:14 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-09-08 22:16 - 2015-08-22 18:01 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-09-08 22:16 - 2015-08-22 18:00 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-09-08 22:16 - 2015-08-22 17:56 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-09-08 22:16 - 2015-08-22 17:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-09-08 22:16 - 2015-07-30 19:18 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\InkEd.dll

2015-09-08 22:16 - 2015-07-30 18:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InkEd.dll

2015-09-08 22:15 - 2015-09-02 04:56 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-09-08 22:15 - 2015-09-02 04:55 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-09-08 22:15 - 2015-09-02 04:50 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-09-08 22:15 - 2015-09-02 04:17 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-09-08 22:15 - 2015-09-02 04:13 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-09-08 22:15 - 2015-08-03 23:15 - 00074928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll

2015-09-08 22:15 - 2015-08-03 23:15 - 00065600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll

2015-09-08 22:15 - 2015-08-01 16:22 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidsvc.dll

2015-09-08 22:15 - 2015-08-01 05:47 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\schtasks.exe

2015-09-08 22:15 - 2015-08-01 05:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schtasks.exe

2015-09-08 22:15 - 2015-08-01 05:38 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2015-09-08 22:15 - 2015-08-01 05:37 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskeng.exe

2015-09-08 22:15 - 2015-08-01 05:37 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskeng.exe

2015-09-08 22:15 - 2015-07-22 16:34 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-09-08 22:15 - 2015-07-22 16:33 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll

2015-09-08 22:15 - 2015-07-22 16:25 - 02461184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-09-08 22:15 - 2015-07-22 16:25 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll

2015-09-08 22:15 - 2015-07-18 20:31 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll

2015-09-08 22:15 - 2015-07-18 20:29 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll

2015-09-08 22:15 - 2015-07-18 20:29 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll

2015-09-08 22:15 - 2015-07-18 20:27 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-10-07 20:06 - 2014-11-18 00:07 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-10-07 20:05 - 2015-02-15 12:10 - 02038685 _____ C:\WINDOWS\WindowsUpdate.log

2015-10-07 20:02 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-10-07 19:47 - 2013-08-23 00:14 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-10-07 19:43 - 2015-03-14 20:56 - 00000000 ____D C:\Users\m*\AppData\Local\Deployment

2015-10-07 19:41 - 2015-05-29 20:39 - 00000000 ____D C:\ProgramData\NVIDIA

2015-10-07 19:41 - 2015-03-15 11:58 - 00035460 _____ C:\WINDOWS\setupact.log

2015-10-07 19:41 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-10-06 20:28 - 2015-04-21 22:08 - 00006212 _____ C:\WINDOWS\PFRO.log

2015-10-05 23:22 - 2013-08-23 00:08 - 00000000 ____D C:\Users\m*

2015-10-05 19:11 - 2013-08-23 00:19 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-750122456-1480246655-3734385838-1001

2015-10-05 18:46 - 2015-03-07 01:32 - 00000000 ____D C:\AdwCleaner

2015-10-03 11:13 - 2015-04-26 21:24 - 735144719 _____ C:\WINDOWS\MEMORY.DMP

2015-10-03 11:13 - 2014-09-13 11:34 - 00000000 ____D C:\WINDOWS\Minidump

2015-09-29 22:03 - 2014-08-27 21:19 - 00000000 ____D C:\Users\m*\AppData\Roaming\vlc

2015-09-27 17:47 - 2014-10-20 20:41 - 00000000 ____D C:\Users\m*\AppData\Local\CyberGhost

2015-09-24 10:20 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache

2015-09-22 18:35 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-09-21 22:06 - 2014-11-18 00:07 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-09-15 03:18 - 2013-08-22 17:38 - 00812008 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-09-15 03:18 - 2013-08-22 17:38 - 00178152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-09-13 00:07 - 2015-07-31 23:17 - 00000000 ____D C:\Users\m*\AppData\Roaming\Bioshock

2015-09-09 19:59 - 2015-03-15 12:39 - 00362792 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-09-09 19:56 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

2015-09-08 22:20 - 2013-08-22 21:11 - 00000000 ____D C:\Program Files\Windows Journal

2015-09-08 22:19 - 2014-08-27 20:54 - 00000000 ____D C:\WINDOWS\system32\m*T
 

Some files in TEMP:

====================

C:\Users\m*\AppData\Local\Temp\avgnt.exe

C:\Users\m*\AppData\Local\Temp\AZxfyihpcsUxOPURbdOO.DLL

C:\Users\m*\AppData\Local\Temp\i4jdel0.exe

C:\Users\m*\AppData\Local\Temp\iSNYcLSqMQ.DLL

C:\Users\m*\AppData\Local\Temp\mExgeeVDIOvSblHxCxIx.DLL

C:\Users\m*\AppData\Local\Temp\nvStInst.exe

C:\Users\m*\AppData\Local\Temp\OXTqqBUkQIvbJHJNpPST.DLL

C:\Users\m*\AppData\Local\Temp\proxy_vole6515560313283769685.dll

C:\Users\m*\AppData\Local\Temp\RzhqfrvaIb.DLL

C:\Users\m*\AppData\Local\Temp\SkypeSetup.exe

C:\Users\m*\AppData\Local\Temp\sqlite3.dll

C:\Users\m*\AppData\Local\Temp\TJcqOEiClNxNAIzFTyeb.DLL

C:\Users\m*\AppData\Local\Temp\ueoHSLTboj.DLL

C:\Users\m*\AppData\Local\Temp\VtAERJvAFreCvAWmdjwz.DLL

C:\Users\m*\AppData\Local\Temp\ZojWDFQuKnPGaJNelZXo.DLL
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-10-06 09:29
 

==================== End of FRST.txt ============================

--- --- ---

--- --- ---

Noch eine Rückmeldung zum Sachstand:

Das Problem scheint wirklich behoben. Probleme beim Zugriff auf das Internet kann ich nicht mehr ausmachen .

Machen wir noch einen Kontrollscan :)

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Da bin ich wieder :sleepy:
Der Scan dauert etwas länger mit ESET - ich melde mich sobald der durch ist

Sooo, alles fertig!

ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=c605492a6f3a93489c58966c1ccb6ff6

# end=init

# utc_time=2015-10-19 07:42:07

# local_time=2015-10-19 09:42:07 (+0100, W. Europe Daylight Time)

# country="Germany"

# osver=6.2.9200 NT 

Update Init

Update Download

Update Finalize

Updated modules version: 26312

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=c605492a6f3a93489c58966c1ccb6ff6

# end=updated

# utc_time=2015-10-19 07:45:01

# local_time=2015-10-19 09:45:01 (+0100, W. Europe Daylight Time)

# country="Germany"

# osver=6.2.9200 NT 

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=c605492a6f3a93489c58966c1ccb6ff6

# engine=26312

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-10-20 06:11:06

# local_time=2015-10-20 08:11:06 (+0100, W. Europe Daylight Time)

# country="Germany"

# lang=1031

# osver=6.2.9200 NT 

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1805 16777213 100 99 90877 28547266 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 5866295 30466207 0 0

# scanned=435598

# found=0

# cleaned=0

# scan_time=80765

Sec_Check:

Code:

 Results of screen317's Security Check version 1.009  

   x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Disabled!  

Avira Desktop      

Windows Defender   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Java version 32-bit out of Date! 

 Adobe Flash Player         19.0.0.226  

 Adobe Reader XI  

 Mozilla Firefox 36.0.1 Firefox out of Date!  
 ````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avguard.exe 

 ESET ESET Online Scanner OnlineScannerApp.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

Und FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-10-2015

Ran by N****** (administrator) on S*********** (20-10-2015 20:21:06)

Running from C:\Users\****\Desktop\Trojan

Loaded Profiles: N****** &  (Available Profiles: N******)

Platform: Windows 8.1 Pro (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(ACD Systems) D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(CyberGhost S.R.L.) C:\Program Files\CyberGhost 5\CyberGhost.exe

(Suunto) C:\Users\****\AppData\Local\Apps\2.0\MAHMQXVP.AEE\8B91HD6N.209\move..tion_391e8feca7b0cf78_0001.0003_3bc622373ad2c5ec\Moveslink2.exe

() D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe

(Learnpulse) C:\Users\****\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Nullsoft) D:\Program Files (x86)\Winamp\winamp.exe

(Don HO don.h@free.fr) D:\Program Files (x86)\Notepadplusplus\notepad++.exe

(Igor Pavlov) D:\Program Files\7-Zip\7zFM.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe
 
 

==================== Registry (Whitelisted) ===========================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)

HKLM\...\Run: [ACPW08DE] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe [1813776 2014-09-17] (ACD Systems)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-03] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [avgnt] => D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [738224 2015-10-13] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Moveslink2] => C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Screenpresso] => C:\Users\****\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Moveslink2] => C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Screenpresso] => C:\Users\****\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Moveslink2] => C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Screenpresso] => C:\Users\****\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Moveslink2] => C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Screenpresso] => C:\Users\****\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\Run: [Moveslink2] => C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] ()

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\Run: [Screenpresso] => C:\Users\****\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse)

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" 

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2

Tcpip\..\Interfaces\{07206F4B-DD46-4FF7-8312-D22C976ECBD4}: [NameServer] 95.169.183.219,89.41.60.38

Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [NameServer] 95.169.183.219,89.41.60.38

Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [DhcpNameServer] 192.168.0.1 192.168.0.2
 

Internet Explorer:

==================

HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-10-15] (Oracle Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
 

FireFox:

========

FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-19] ()

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> d:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-09-19] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-19] ()

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-25] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-25] (NVIDIA Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-09-19] (Adobe Systems)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS)

FF Extension: Delete Bookmark Icons - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{04514a2c-a3ab-4f47-8688-55f911b0fe75}.xpi [2015-03-05]

FF Extension: Adblock Plus - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-07]

StartMenuInternet: FIREFOX.EXE - d:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Services (Whitelisted) ========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirFirewallService; D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1054976 2015-10-13] (Avira Operations GmbH & Co. KG)

R2 AntiVirMailService; D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [835616 2015-10-13] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [456528 2015-10-13] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [456528 2015-10-13] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1014288 2015-10-13] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [63968 2015-05-21] (CyberGhost S.R.L)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-23] (NVIDIA Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-06-03] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-03] (NVIDIA Corporation)

S2 SkypeUpdate; D:\Program Files (x86)\Skype\Updater\Updater.exe [327296 2015-06-03] (Skype Technologies)

R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
 

===================== Drivers (Whitelisted) ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 avfwim; C:\Windows\system32\DRIVERS\avfwim.sys [114608 2014-12-08] (Avira GmbH)

R1 avfwot; C:\Windows\system32\DRIVERS\avfwot.sys [141376 2014-12-08] (Avira GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137800 2015-10-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-08-26] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-03] (Avira Operations GmbH & Co. KG)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

S3 nuviocir; C:\Windows\system32\DRIVERS\nuviocir_x64.sys [39704 2013-07-15] (Nuvoton Technology Corp.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-03] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-04-03] (NVIDIA Corporation)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-10-19 21:41 - 2015-10-19 21:41 - 00000000 ____D C:\Program Files (x86)\ESET

2015-10-14 23:40 - 2015-10-14 23:40 - 00362792 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-10-14 23:22 - 2015-10-14 23:22 - 00002077 _____ C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk

2015-10-14 23:22 - 2015-08-25 16:08 - 00574072 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe

2015-10-14 23:20 - 2015-10-14 23:42 - 00002100 _____ C:\WINDOWS\setupact.log

2015-10-14 23:20 - 2015-10-14 23:20 - 00000000 _____ C:\WINDOWS\setuperr.log

2015-10-14 23:16 - 2015-09-19 05:18 - 00035384 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2015-10-14 23:16 - 2015-09-18 15:42 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2015-10-14 23:16 - 2015-09-18 15:42 - 01163776 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2015-10-14 23:16 - 2015-09-18 15:42 - 00766464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2015-10-14 23:16 - 2015-09-18 15:42 - 00699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2015-10-14 23:16 - 2015-09-18 15:42 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2015-10-14 23:16 - 2015-09-18 15:42 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-14 23:16 - 2015-08-27 04:43 - 22372152 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-14 23:16 - 2015-08-27 04:42 - 19795904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-14 23:15 - 2015-09-30 01:42 - 01658536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-14 23:15 - 2015-09-30 01:42 - 01519584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-14 23:15 - 2015-09-30 01:42 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-14 23:15 - 2015-09-30 01:42 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-14 23:15 - 2015-09-29 14:31 - 07457624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-14 23:15 - 2015-09-29 14:29 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-10-14 23:15 - 2015-09-28 20:45 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-10-14 23:15 - 2015-09-28 20:26 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-10-14 23:15 - 2015-09-28 20:25 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-10-14 23:15 - 2015-09-28 20:25 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-10-14 23:15 - 2015-09-28 20:25 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-10-14 23:15 - 2015-09-28 20:22 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-10-14 23:15 - 2015-09-28 20:22 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-10-14 23:15 - 2015-09-28 20:22 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-10-14 23:15 - 2015-09-28 20:15 - 02243072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-10-14 23:15 - 2015-09-28 20:13 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-10-14 23:15 - 2015-09-28 20:12 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-10-14 23:15 - 2015-09-24 19:51 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfg.exe

2015-10-14 23:15 - 2015-09-24 19:38 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll

2015-10-14 23:15 - 2015-09-24 19:30 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll

2015-10-14 23:15 - 2015-09-24 18:42 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll

2015-10-14 23:15 - 2015-09-24 18:40 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-14 23:15 - 2015-09-10 20:02 - 25851392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-14 23:15 - 2015-09-10 19:19 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-14 23:15 - 2015-09-10 19:18 - 02886656 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-14 23:15 - 2015-09-10 19:18 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-10-14 23:15 - 2015-09-10 19:14 - 05990400 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-14 23:15 - 2015-09-10 19:09 - 20358144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-14 23:15 - 2015-09-10 19:06 - 00616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-10-14 23:15 - 2015-09-10 19:04 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-14 23:15 - 2015-09-10 18:51 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-10-14 23:15 - 2015-09-10 18:39 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-14 23:15 - 2015-09-10 18:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-10-14 23:15 - 2015-09-10 18:37 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-10-14 23:15 - 2015-09-10 18:35 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-10-14 23:15 - 2015-09-10 18:33 - 02279936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-14 23:15 - 2015-09-10 18:28 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-10-14 23:15 - 2015-09-10 18:28 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-10-14 23:15 - 2015-09-10 18:27 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-14 23:15 - 2015-09-10 18:24 - 14456832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-14 23:15 - 2015-09-10 18:21 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-10-14 23:15 - 2015-09-10 18:19 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-10-14 23:15 - 2015-09-10 18:19 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-10-14 23:15 - 2015-09-10 18:19 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-10-14 23:15 - 2015-09-10 18:17 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-10-14 23:15 - 2015-09-10 18:17 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-10-14 23:15 - 2015-09-10 18:07 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-10-14 23:15 - 2015-09-10 18:05 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-10-14 23:15 - 2015-09-10 18:02 - 04527616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-14 23:15 - 2015-09-10 18:01 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-10-14 23:15 - 2015-09-10 18:00 - 12853760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-14 23:15 - 2015-09-10 17:57 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-10-14 23:15 - 2015-09-10 17:57 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-10-14 23:15 - 2015-09-10 17:55 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-10-14 23:15 - 2015-09-10 17:55 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-10-14 23:15 - 2015-09-10 17:55 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-10-14 23:15 - 2015-09-10 17:45 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-14 23:15 - 2015-09-10 17:34 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-10-14 23:15 - 2015-09-10 17:31 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-10-14 23:15 - 2015-09-10 17:27 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-14 23:15 - 2015-09-10 17:26 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-10-10 15:26 - 2015-10-10 15:26 - 00003370 _____ C:\Users\****\Desktop\metro.html

2015-10-05 18:51 - 2015-10-05 18:51 - 00000597 _____ C:\Users\****\Desktop\JRT.txt

2015-10-05 18:06 - 2015-10-19 20:23 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-10-05 18:06 - 2015-10-15 19:34 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-05 18:06 - 2015-10-15 19:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-05 18:06 - 2015-10-15 19:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-05 18:06 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-10-05 18:06 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-10-05 18:06 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2015-10-04 12:36 - 2015-10-04 13:36 - 00000000 ____D C:\Users\****\Desktop\mbar

2015-10-04 12:36 - 2015-10-04 13:36 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-10-03 11:37 - 2015-10-03 11:37 - 00000000 _____ C:\Users\****\Desktop\Gmer-19357.exe

2015-10-03 11:32 - 2015-10-20 20:20 - 00000000 ____D C:\Users\****\Desktop\Trojan

2015-10-03 11:07 - 2015-10-20 20:21 - 00000000 ____D C:\FRST

2015-10-03 10:59 - 2015-10-03 10:59 - 00000470 _____ C:\Users\****\Downloads\defogger_disable.log

2015-10-03 10:59 - 2015-10-03 10:59 - 00000000 _____ C:\Users\****\defogger_reenable

2015-09-22 18:34 - 2015-08-22 15:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-09-22 18:34 - 2015-08-10 20:15 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL

2015-09-22 18:34 - 2015-08-10 20:15 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL

2015-09-22 18:34 - 2015-08-10 20:06 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL

2015-09-22 18:34 - 2015-08-10 19:49 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll

2015-09-22 18:34 - 2015-08-10 18:56 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

2015-09-22 18:34 - 2015-08-10 18:46 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll

2015-09-22 18:34 - 2015-08-07 23:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll

2015-09-22 18:34 - 2015-08-07 16:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2015-09-22 18:34 - 2015-08-06 19:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx

2015-09-22 18:34 - 2015-08-06 18:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2015-09-22 18:34 - 2015-08-06 18:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx

2015-09-22 18:34 - 2015-08-06 18:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2015-09-22 18:34 - 2015-07-16 20:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-10-20 20:06 - 2014-11-18 00:07 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-10-20 20:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-10-20 19:24 - 2015-02-15 12:10 - 01607787 _____ C:\WINDOWS\WindowsUpdate.log

2015-10-20 18:56 - 2015-03-14 20:56 - 00000000 ____D C:\Users\****\AppData\Local\Deployment

2015-10-19 20:38 - 2015-03-07 01:32 - 00000000 ____D C:\AdwCleaner

2015-10-19 09:22 - 2014-11-18 00:07 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-10-15 19:46 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache

2015-10-15 19:43 - 2013-08-23 00:19 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-750122456-1480246655-3734385838-1001

2015-10-14 23:57 - 2014-08-27 21:19 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc

2015-10-14 23:51 - 2015-04-07 20:36 - 00000000 ___SD C:\WINDOWS\system32\GWX

2015-10-14 23:46 - 2013-08-23 00:14 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-10-14 23:40 - 2015-05-29 20:39 - 00000000 ____D C:\ProgramData\NVIDIA

2015-10-14 23:40 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-10-14 23:37 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData

2015-10-14 23:22 - 2015-05-29 20:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2015-10-14 23:22 - 2015-05-29 20:39 - 00000000 ____D C:\ProgramData\NVIDIA Corporation

2015-10-14 23:22 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-10-14 23:19 - 2015-04-07 20:36 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX

2015-10-14 23:19 - 2014-08-27 20:54 - 00000000 ____D C:\WINDOWS\system32\****T

2015-10-14 23:17 - 2014-08-27 20:54 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\****T.exe

2015-10-14 23:16 - 2015-04-21 22:06 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-10-14 23:16 - 2014-12-01 20:51 - 00000000 ___SD C:\WINDOWS\system32\CompatTel

2015-10-14 20:16 - 2014-09-13 15:34 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-10-14 20:13 - 2014-12-09 21:28 - 00000000 ____D C:\Users\****\AppData\Roaming\TeamViewer

2015-10-14 20:12 - 2014-09-13 11:34 - 00000000 ____D C:\WINDOWS\Minidump

2015-10-14 20:09 - 2014-12-26 15:19 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-13 09:30 - 2014-12-08 10:37 - 00137800 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

2015-10-10 12:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF

2015-10-08 11:30 - 2013-08-23 00:08 - 00000000 ____D C:\Users\****

2015-10-02 16:24 - 2013-08-22 17:38 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-02 16:24 - 2013-08-22 17:38 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-09-27 17:47 - 2014-10-20 20:41 - 00000000 ____D C:\Users\****\AppData\Local\CyberGhost
 

Some files in TEMP:

====================

C:\Users\****\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-10-15 19:43
 

==================== End of FRST.txt ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Bis jetzt sieht es wirklich gut aus. Habe die letzten Tage keine Probleme mehr gehabt. :taenzer:

Sehr merkwürdig, dass mit Firefox. Ich habe eine aktuelle Version und Java (64bit) ist eigentlich auch ziemlich aktuell.

Nachtrag:
Nachdem ich nun gesehen habe, dass in der Uninstall-Liste zwei Versionen von Firefox angegeben waren, habe ich nun beide deinstallieren müssen und habe Firefox neu installiert.
Nun fragt mich der Browser bei jedem Start, ob er als Standard eingerichtet werden soll, und die Probleme sind scheinbar wieder da :-\

Bin grad mit dem VPN drin. Konnte hier noch lesen, aber beim Antworten ist der Server nicht mehr erreichbar.
Fange ich nochmal von vorne an? :(
Soll ich Java ggf auch komplett entfernen?

21.10. Weiteres Vorgehen:

Ich habe den Standard nun über die Systemeinstellungen von Windows hergestellt und es bleibt nun bestehen. Nach dem Ausschalten der Proxy-Einstellungen in Firefox scheint nun auch alles wieder zu laufen. Ich muss es nochmal beobachten.
Wo das Problem mit Java besteht kann ich noch nicht sagen - Updates über die interne Funktion schlagen wegen Zugriffsproblemen fehl.
Ich installiere das heute Abend mal neu.

Zitat:

G:\iLinker.exe

Kennst Du das?

Laufwerk G:\ stammt von meiner Samsung Camera und ist Teil eines "i-Launcher" Laufwerks. Die war aber schon ein paar Tage/Wochen nicht mehr angeschlossen, bis ich das eben gerpüft habe. Ich kann auf das Laufwerk wohl erst zugreifen, wenn ich I-Launcher installiere und die exe startet im "Autostart" wenn ich das Laufwerk öffnen möchte.
Mach ich die Cam aus ist auch das Laufwerk g:\ weg.

Die Probleme sind zwar stark zurückgegangen. Derzeit betrifft es anscheinend nur das große Auktionshaus im Internet.... dort kann ich keine Beschreibungen lesen. Die Subdomain ist laut diversen Diensten im Netz nur für mich nicht erreichbar. Und VPN behebt das Problem direkt.

Also über deinen Router geht nix, aber über VPN?

Trenn den Router mal 30 min vom Strom.

Der Router selbst wird fast jeden Tag bis in den späten Nachmittag hinaus ausgeschaltet.
Ich habe noch einmal etwas getestet:

Ich habe beobachtet, dass die Seiten teilweise keine von Subdomains unterstütze Inhalte, (wie zB Artikelbeschreibungen anzeigen), in Firefox anzeigen im Internet Explorer gar nicht geladen werden. IE meldet die komplette Nicherreichbarkeit (This page can’t be displayed).

Andere Endgeräte wie zB das Tablett haben keine Probleme mit der Anzeige. (Browser im Desktop-Modus)

Werde wohl das Sytem komplett neu aufsetzen, auch wenn es eine Menge arbeit sein wird....

Ich hab spontan absolut keine Idee.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

cmd: ipconfig /flushdns

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Danke für Deine Geduld mit mir, schrauber!!!!

Habe mal eben den Fix gestartet und hier ist das Log

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:25-10-2015 02

Ran by ****** (2015-10-26 19:05:31) Run:1

Running from C:\Users\****\Desktop\Trojan

Loaded Profiles: ******* (Available Profiles: ******

Boot Mode: Normal

==============================================
 

fixlist content:

*****************

cmd: ipconfig /flushdns

*****************
 
 

=========  ipconfig /flushdns =========
 
 

Windows IP Configuration
 

Successfully flushed the DNS Resolver Cache.
 

========= End of CMD: =========
 
 

==== End of Fixlog 19:05:31 ====

Nachtrag: Habe derzeit keine Probleme.
Mein VPN-Client findet nun funktionierendes IPv6. Werde es aber noch beobachten!