Trojaner-Board - fbDownloader vollständig entfernen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - fbDownloader vollständig entfernen (https://www.trojaner-board.de/138654-fbdownloader-vollstaendig-entfernen.html)

fbDownloader vollständig entfernen

Hallo!

Ich habe mir schon einige Beiträge zu dem Problem mit dem fbDownloader (auch in anderen Foren) durchgelesen und es schien mir so, als müsse dieses Problem individuell gelöst werden.

Seit heute morgen öffnen sich bei mir im FireFox Werbeanzeigen für PC-Spiele auf dafür unüblichen Seiten (bsp. Uni-Webseite). Außerdem wurde die Startseite von fbDownloader ausgetauscht.

Es wäre wirklich toll, wenn mir jemand helfen könnte, diesen Quatsch vollständig zu entfernen.

Liebe Grüße und schon mal danke für die Hilfe,
Fridde

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hier sind die Logdateien:

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013

Ran by Fridde (administrator) on 23-07-2013 17:57:12

Running from C:\Users\Fridde\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

() C:\Program Files (x86)\watchmi\TvdService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\PHotkey.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\PHotkey\ATouch64.exe

() C:\Program Files (x86)\PHotkey\PVDesktop.exe

() C:\Program Files (x86)\PHotkey\PVDAgent.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe

(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe

() C:\Users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

() C:\Program Files (x86)\watchmi\TvdTray.exe

(Dropbox, Inc.) C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11817576 2011-04-19] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2209896 2011-04-18] (Realtek Semiconductor)

HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [x]

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)

HKCU\...\Run: [SSync] - C:\Users\Fridde\AppData\Roaming\SSync\SSync.exe [36864 2013-04-10] ()

HKCU\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()

HKCU\...\Run: [SCheck] - C:\Users\Fridde\AppData\Roaming\SCheck\SCheck.exe [36864 2013-04-10] ()

HKCU\...\Run: [Snoozer] - C:\Users\Fridde\AppData\Roaming\Snz\Snz.exe [1137673 2013-07-23] ()

HKCU\...\Run: [DataMgr] - C:\Users\Fridde\AppData\Roaming\DataMgr\DataMgr.exe [168848 2013-05-20] (HTTO Group, Ltd.)

HKCU\...\Run: [Intermediate] - C:\Users\Fridde\AppData\Roaming\Intermediate\Intermediate.exe [36864 2013-04-10] ()

HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2011-04-14] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] - "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart [506712 2011-02-03] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)

HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [EEventManager] - "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]

HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [239720 2011-06-12] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [200808 2011-06-12] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk

ShortcutTarget: watchmi tray.lnk -> C:\Windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe (Acresso Software Inc.)

Startup: C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}

SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://searchqm.com/?channel=sfde203fbdgy21

FF Keyword.URL: hxxp://searchqm.com/search.php?channel=sfde203fbdgy21&q=

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF SearchPlugin: C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\searchplugins\fbdownloader_search.xml

FF SearchPlugin: C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\searchplugins\search.xml

FF Extension: om - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\om@offermosquito.com.xpi

FF Extension: No Name - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-06-04] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()

R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-10-07] ()

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-12-14] ()

R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [62464 2010-12-06] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-08] (Avira Operations GmbH & Co. KG)

R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

S1 HWiNFO32; \??\F:\DIAG\HWINFO64\HWiNFO64A.SYS [x]

S3 RSUSBVSTOR; System32\Drivers\RTSUVSTOR.sys [x]

S3 uxddrv; \??\F:\uxddrv64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 17:47 - 2013-07-23 17:47 - 00000000 ____D C:\Users\Fridde\AppData\Local\{B325BB13-B068-4CB3-8BAC-12B192AB6704}

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-23 15:27 - 2013-07-23 17:50 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Users\Fridde\AppData\Local\PackageAware

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 17:13 - 2013-07-21 18:09 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-18 20:01 - 2013-07-18 20:01 - 00755618 _____ C:\Users\Fridde\Desktop\rose-elifc.psd

2013-07-18 20:01 - 2013-07-18 20:01 - 00657727 _____ C:\Users\Fridde\Desktop\martha-elifc.psd

2013-07-18 20:01 - 2013-07-18 20:01 - 00603255 _____ C:\Users\Fridde\Desktop\psd#36_multifandom_naiveastronaut.psd

2013-07-16 20:42 - 2013-07-16 20:45 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:42 - 2013-07-16 20:44 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:11 - 2013-07-16 19:12 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 21:00 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 19:09 - 2013-07-16 19:46 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 22:20 - 2013-07-19 00:14 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-14 23:08 - 2013-07-14 23:08 - 00000000 ____D C:\Users\Fridde\AppData\Local\{EA88746F-09C0-415C-BBAB-3F5EDBDF1B38}

2013-07-12 00:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 00:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 00:33 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 00:33 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 16:03 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 16:03 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 16:03 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 16:03 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 16:03 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 16:02 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 16:02 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-30 12:55 - 2013-06-30 12:55 - 00000000 ____D C:\Users\Fridde\AppData\Local\{8B5970FC-0692-4026-A362-0C5AF3E10592}

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung

2013-06-28 15:40 - 2013-06-28 15:40 - 00000000 ____D C:\Users\Fridde\AppData\Local\{4817E962-C589-49E2-B678-DF3D1C84F533}

2013-06-23 13:05 - 2013-06-23 13:10 - 00001456 _____ C:\Users\Fridde\AppData\Local\Adobe Save for Web 12.0 Prefs
 

==================== One Month Modified Files and Folders =======
 

2013-07-23 17:55 - 2013-05-08 19:22 - 00000000 ___RD C:\Users\Fridde\Dropbox

2013-07-23 17:55 - 2013-05-08 19:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Dropbox

2013-07-23 17:52 - 2013-05-08 18:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-23 17:52 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-23 17:52 - 2009-07-14 06:51 - 00051626 _____ C:\Windows\setupact.log

2013-07-23 17:51 - 2013-05-08 18:38 - 01220581 _____ C:\Windows\WindowsUpdate.log

2013-07-23 17:51 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-23 17:51 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-23 17:50 - 2013-07-23 15:27 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 17:47 - 2013-07-23 17:47 - 00000000 ____D C:\Users\Fridde\AppData\Local\{B325BB13-B068-4CB3-8BAC-12B192AB6704}

2013-07-23 17:15 - 2013-05-08 20:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-23 17:03 - 2013-05-08 18:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 11:06 - 2011-06-19 19:00 - 00654166 _____ C:\Windows\system32\perfh007.dat

2013-07-23 11:06 - 2011-06-19 19:00 - 00130006 _____ C:\Windows\system32\perfc007.dat

2013-07-23 11:06 - 2009-07-14 07:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-23 10:21 - 2013-06-07 18:31 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\DataMgr

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Users\Fridde\AppData\Local\PackageAware

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 18:09 - 2013-07-21 17:13 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-19 00:14 - 2013-07-15 22:20 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-19 00:14 - 2013-05-08 19:08 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Adobe

2013-07-19 00:14 - 2011-06-19 17:04 - 00000000 ____D C:\ProgramData\Adobe

2013-07-18 20:01 - 2013-07-18 20:01 - 00755618 _____ C:\Users\Fridde\Desktop\rose-elifc.psd

2013-07-18 20:01 - 2013-07-18 20:01 - 00657727 _____ C:\Users\Fridde\Desktop\martha-elifc.psd

2013-07-18 20:01 - 2013-07-18 20:01 - 00603255 _____ C:\Users\Fridde\Desktop\psd#36_multifandom_naiveastronaut.psd

2013-07-18 11:18 - 2013-06-04 23:20 - 00000000 ____D C:\Users\Fridde\AppData\Local\Adobe

2013-07-18 11:13 - 2013-05-08 20:37 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-18 11:13 - 2013-05-08 20:37 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-18 11:13 - 2011-06-19 17:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-18 11:07 - 2009-07-14 07:08 - 00032574 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-16 21:00 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 20:45 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:44 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:46 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:16 - 2013-05-08 18:56 - 00000000 ____D C:\Users\Fridde

2013-07-16 19:12 - 2013-07-16 19:11 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 19:58 - 2013-05-08 18:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-15 19:58 - 2013-05-08 18:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-14 23:08 - 2013-07-14 23:08 - 00000000 ____D C:\Users\Fridde\AppData\Local\{EA88746F-09C0-415C-BBAB-3F5EDBDF1B38}

2013-07-12 08:08 - 2009-07-14 06:45 - 00441800 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-12 08:06 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-12 00:40 - 2013-06-03 20:47 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-12 00:35 - 2011-06-19 14:08 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-03 17:33 - 2013-05-08 19:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-30 12:55 - 2013-06-30 12:55 - 00000000 ____D C:\Users\Fridde\AppData\Local\{8B5970FC-0692-4026-A362-0C5AF3E10592}

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung

2013-06-28 15:40 - 2013-06-28 15:40 - 00000000 ____D C:\Users\Fridde\AppData\Local\{4817E962-C589-49E2-B678-DF3D1C84F533}

2013-06-27 10:22 - 2013-05-13 11:14 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-06-23 13:10 - 2013-06-23 13:05 - 00001456 _____ C:\Users\Fridde\AppData\Local\Adobe Save for Web 12.0 Prefs
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-23 17:30
 

==================== End Of Log ============================

--- --- ---

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2013

Ran by Fridde at 2013-07-23 17:58:33

Running from C:\Users\Fridde\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212)

Adobe AIR (x32 Version: 2.7.0.19480)

Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)

Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)

Adobe Photoshop CS (x32 Version: CS)

Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)

Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18)

AMI VR-pulse OS Switcher (Version: 1.1)

Apple Application Support (x32 Version: 2.3.4)

Apple Mobile Device Support (Version: 6.1.0.13)

Apple Software Update (x32 Version: 2.1.3.127)

Avira Free Antivirus (x32 Version: 13.0.0.3884)

Bonjour (Version: 3.0.0.10)

Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2)

Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)

Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)

Corel Graphics - Windows Shell Extension (x32 Version: 15.1.0.588)

Corel Graphics - Windows Shell Extension (x32 Version: 15.1.588)

CorelDRAW Essentials X5 - Common (x32 Version: 15.0)

CorelDRAW Essentials X5 - Connect (x32 Version: 15.0)

CorelDRAW Essentials X5 - Custom Data (x32 Version: 15.0)

CorelDRAW Essentials X5 - DE (x32 Version: 15.0)

CorelDRAW Essentials X5 - Draw (x32 Version: 15.0)

CorelDRAW Essentials X5 - EN (x32 Version: 15.0)

CorelDRAW Essentials X5 - ES (x32 Version: 15.0)

CorelDRAW Essentials X5 - Extra Content (x32 Version: 15.0)

CorelDRAW Essentials X5 - Extra Content (x32)

CorelDRAW Essentials X5 - Filters (x32 Version: 15.0)

CorelDRAW Essentials X5 - FR (x32 Version: 15.0)

CorelDRAW Essentials X5 - IPM (x32 Version: 15.0)

CorelDRAW Essentials X5 - IT (x32 Version: 15.0)

CorelDRAW Essentials X5 - PHOTO-PAINT (x32 Version: 15.0)

CorelDRAW Essentials X5 - Redist (x32 Version: 15.0)

CorelDRAW Essentials X5 - Setup Files (x32 Version: 15.0)

CorelDRAW Essentials X5 - WT (x32 Version: 15.0)

CorelDRAW Essentials X5 (x32 Version: 15.0)

CorelDRAW Essentials X5 (x32 Version: 15.1.0.588)

CorelDRAW Graphics Suite X5 - Windows Shell Extension 64 Bit (Version: 15.1.588)

CyberLink LabelPrint (x32 Version: 2.5.3624)

CyberLink MediaEspresso (x32 Version: 6.5.1508_36229)

CyberLink MediaShow (x32 Version: 5.1.2414)

CyberLink PhotoNow (x32 Version: 1.1.0.6904)

CyberLink Power2Go (x32 Version: 7.0.0.1327)

CyberLink PowerDirector (x32 Version: 8.0.4020)

CyberLink PowerDVD 10 (x32 Version: 10.0.2930.52)

CyberLink PowerDVD Copy (x32 Version: 1.5.1306)

CyberLink PowerProducer (x32 Version: 5.0.2.3503)

CyberLink YouCam (x32 Version: 3.1.4013)

D3DX10 (x32 Version: 15.4.2368.0902)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)

Dolby Home Theater v4 (x32 Version: 7.2.7000.4)

Download Navigator (x32 Version: 1.1.0)

Dropbox (HKCU Version: 2.0.22)

Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000)

Epson Event Manager (x32 Version: 2.50.0000)

EPSON Scan (x32)

EpsonNet Print (x32 Version: 2.5.00)

Free M4a to MP3 Converter 7.2 (x32)

Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)

Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)

Google Chrome (x32 Version: 7.0.517.43)

Google Update Helper (x32 Version: 1.3.21.153)

Intel PROSet Wireless

Intel PROSet Wireless (x32)

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2418)

Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (Version: 1.1.0.0157)

Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 1.0.2.0518)

Intel(R) PROSet/Wireless WiFi Software (Version: 14.01.1000)

Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026)

Intel(R) WiDi (x32 Version: 2.1.39.0)

Intel(R) Wireless Display

iTunes (Version: 11.0.4.4)

Java 7 Update 21 (64-bit) (Version: 7.0.210)

Java Auto Updater (x32 Version: 2.0.5.1)

Java(TM) 6 Update 26 (64-bit) (Version: 6.0.260)

Java(TM) 6 Update 26 (x32 Version: 6.0.260)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

Medion Home Cinema (x32 Version: 8.0.2608)

Mesh Runtime (x32 Version: 15.4.5722.2)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Mathematics (64-Bit) (Version: 4.0)

Microsoft Office 2010 Service Pack 1 (SP1) (x32)

Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)

Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)

Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)

Mozilla Maintenance Service (x32 Version: 22.0)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

Netzwerkhandbuch EPSON SX440 Series (x32)

Notepad++ (x32 Version: 6.3.3)

NVIDIA Control Panel 275.48 (Version: 275.48)

NVIDIA Graphics Driver 275.48 (Version: 275.48)

NVIDIA Install Application (Version: 2.275.81.0)

NVIDIA Optimus 1.3.6 (Version: 1.3.6)

NVIDIA PhysX (x32 Version: 9.10.0513)

NVIDIA Update Components (Version: 1.3.6)

PHotkey (x32 Version: 1.00.0032)

PlayReady PC Runtime amd64 (Version: 1.3.0)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)

Realtek Ethernet Controller Driver (x32 Version: 7.41.216.2011)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6353)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30127)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.16.0)

RINGFOTO FOTOWELT (x32 Version: 5.0.1)

rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Spelling Dictionaries Support For Adobe Reader X (x32 Version: 10.0.0)

Synaptics Pointing Device Driver (Version: 15.0.4.0)

Topaz Clean 3 (64-bit) (Version: 3.0.2)

Topaz Clean 3 (64-bit) (x32 Version: 3.0.2)

Topaz Clean 3 (x32 Version: 3.0.2)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft Office 2010 (KB2553065) (x32)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2566458) (x32)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)

Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)

Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)

Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)

Versandhelfer (x32 Version: 0.9.511)

VR-pulse Installer (Version: 1.5.2.0)

watchmi (x32 Version: 2.5.0)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3508.1109)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3508.1109)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)

Windows Live Mesh (x32 Version: 15.4.3502.0922)

Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)

Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)

Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)

Windows Live Messenger (x32 Version: 15.4.3502.0922)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

WinRAR 4.20 (64-Bit) (Version: 4.20.0)
 

==================== Restore Points  =========================
 

22-06-2013 11:34:18 Windows Update

23-06-2013 19:21:06 Windows-Sicherung

25-06-2013 14:32:29 Windows Update

30-06-2013 17:00:37 Windows-Sicherung

02-07-2013 18:09:03 Windows Update

09-07-2013 13:19:37 Windows Update

11-07-2013 22:25:16 Windows Update

14-07-2013 17:52:41 Windows-Sicherung

16-07-2013 13:21:31 Windows Update

21-07-2013 17:01:08 Windows-Sicherung

23-07-2013 08:27:49 Windows Update

23-07-2013 13:27:16 Installed SpyHunter

23-07-2013 15:42:01 Removed SpyHunter

23-07-2013 15:49:30 Removed SpyHunter
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {04746343-B513-484C-B380-4B8728056B4D} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)

Task: {0E738BBC-F979-46B1-9C35-BE23CA3900C1} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {2AD574FC-435F-43DF-9B7D-184772D39E9F} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2285485550-2583769962-1094795555-1002 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)

Task: {2C51ECC6-8790-41D0-AAE0-25F9C7A01D79} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)

Task: {820EF158-93EC-400E-8DF5-EB0ED046FE8B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-08] (Google Inc.)

Task: {9535CEAD-1544-4FA9-BE33-69621A96DF49} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {B84CA889-3E60-4B7B-B3DB-CC11F3496F44} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-08] (Google Inc.)

Task: {C2B6F857-74DF-4458-8505-B8EE1F5B3689} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-18] (Adobe Systems Incorporated)

Task: {E7FC890A-C7B4-4BD9-86CC-999F92C29A0D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)

Task: {FB754468-D29A-4EC5-A394-6D371B430A9F} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Faulty Device Manager Devices =============
 

Name: HWiNFO32/64 Kernel Driver

Description: HWiNFO32/64 Kernel Driver

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: HWiNFO32

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/22/2013 00:16:41 PM) (Source: Microsoft-Windows-Defrag) (User: )

Description: Volume "Boot (C:)" wurde aufgrund eines Fehlers nicht defragmentiert: Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
 

Error: (07/21/2013 10:10:07 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 277292
 

Error: (07/21/2013 10:10:07 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 277292
 

Error: (07/21/2013 10:10:07 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (07/21/2013 10:05:37 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 7004
 

Error: (07/21/2013 10:05:37 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 7004
 

Error: (07/21/2013 10:05:37 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (07/21/2013 10:05:36 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6006
 

Error: (07/21/2013 10:05:36 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6006
 

Error: (07/21/2013 10:05:36 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

System errors:

=============

Error: (07/23/2013 05:53:56 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)

Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007041d
 

Error: (07/23/2013 05:53:55 PM) (Source: DCOM) (User: )

Description: 1053TrustedInstaller{752073A1-23F2-4396-85F0-8FDB879ED0ED}
 

Error: (07/23/2013 05:53:55 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (07/23/2013 05:53:55 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Modules Installer erreicht.
 

Error: (07/23/2013 05:53:03 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

HWiNFO32
 

Error: (07/23/2013 03:17:13 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (07/23/2013 03:17:13 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.
 

Error: (07/23/2013 03:15:34 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

HWiNFO32
 

Error: (07/23/2013 03:15:21 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Bluetooth OBEX Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1083
 

Error: (07/23/2013 10:22:39 AM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

HWiNFO32
 
 

Microsoft Office Sessions:

=========================

Error: (07/22/2013 00:16:41 PM) (Source: Microsoft-Windows-Defrag)(User: )

Description: Boot (C:)Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
 

Error: (07/21/2013 10:10:07 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 277292
 

Error: (07/21/2013 10:10:07 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledEvent 277292
 

Error: (07/21/2013 10:10:07 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (07/21/2013 10:05:37 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 7004
 

Error: (07/21/2013 10:05:37 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledEvent 7004
 

Error: (07/21/2013 10:05:37 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (07/21/2013 10:05:36 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6006
 

Error: (07/21/2013 10:05:36 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6006
 

Error: (07/21/2013 10:05:36 PM) (Source: Bonjour Service)(User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 40%

Total physical RAM: 6055.05 MB

Available physical RAM: 3605.89 MB

Total Pagefile: 12108.29 MB

Available Pagefile: 9553.58 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (Boot) (Fixed) (Total:657.54 GB) (Free:597.74 GB) NTFS (Disk=0 Partition=2)

Drive d: (Recover) (Fixed) (Total:37.99 GB) (Free:14.61 GB) NTFS (Disk=0 Partition=4)

Drive f: (INTENSO) (Fixed) (Total:931.51 GB) (Free:601.92 GB) NTFS (Disk=1 Partition=1)
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 699 GB) (Disk ID: 2BD2C32A)

Partition 1: (Active) - (Size=101 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=658 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=40 GB) - (Type=OF Extended)

Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
 

========================================================

Disk: 1 (Size: 932 GB) (Disk ID: 3BCB7771)

Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hab alles gemacht, es ist keine Fehlermeldung gekommen.

Code:

ComboFix 13-07-23.01 - Fridde 23.07.2013  21:37:04.1.8 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6055.4115 [GMT 2:00]

ausgeführt von:: c:\users\Fridde\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Roaming

c:\users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe

c:\users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\searchplugins\search.xml

c:\windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-06-23 bis 2013-07-23  ))))))))))))))))))))))))))))))

.

.

2013-07-23 19:42 . 2013-07-23 19:42        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-07-23 19:42 . 2013-07-23 19:42        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-07-23 16:46 . 2013-07-23 16:46        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{76CF2538-A247-4ABD-986B-D1F892B31C74}\offreg.dll

2013-07-23 15:49 . 2013-07-23 15:49        --------        d-----w-        C:\FRST

2013-07-23 13:27 . 2013-07-23 13:27        --------        d-----w-        c:\program files\Enigma Software Group

2013-07-23 13:27 . 2013-07-23 15:50        --------        d-----w-        c:\windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 13:27 . 2013-07-23 13:27        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard

2013-07-23 08:28 . 2013-07-02 08:34        9460976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{76CF2538-A247-4ABD-986B-D1F892B31C74}\mpengine.dll

2013-07-23 08:23 . 2013-07-23 08:23        --------        d-----w-        c:\users\Fridde\AppData\Roaming\Snz

2013-07-22 12:27 . 2013-07-22 12:27        --------        dc-h--w-        c:\programdata\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 12:27 . 2013-07-22 12:27        --------        d-----w-        c:\program files\Common Files\Topaz Labs

2013-07-22 12:27 . 2013-07-22 12:27        --------        dc-h--w-        c:\programdata\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 12:27 . 2013-07-22 12:27        --------        d-----w-        c:\program files (x86)\Common Files\Topaz Labs

2013-07-22 12:27 . 2013-07-22 12:27        --------        d-----w-        c:\program files (x86)\Topaz Labs

2013-07-22 12:27 . 2013-07-22 12:27        --------        d-----w-        c:\users\Fridde\AppData\Local\PackageAware

2013-07-16 17:16 . 2013-07-16 17:16        --------        d-----w-        c:\users\Fridde\restore

2013-07-16 17:09 . 2013-07-16 19:00        --------        d-----w-        c:\programdata\tmp

2013-07-16 17:09 . 2013-07-16 17:46        --------        d-----w-        c:\programdata\hps

2013-07-16 17:04 . 2013-07-16 17:04        --------        d-----w-        c:\program files (x86)\CEWE COLOR

2013-07-11 14:03 . 2013-05-27 05:50        1011712        ----a-w-        c:\program files\Windows Defender\MpSvc.dll

2013-07-11 14:02 . 2013-04-09 23:34        1247744        ----a-w-        c:\windows\SysWow64\DWrite.dll

2013-07-11 14:02 . 2013-04-02 22:51        1643520        ----a-w-        c:\windows\system32\DWrite.dll

2013-06-29 14:20 . 2013-06-29 14:20        --------        d-----w-        c:\users\Fridde\AppData\Roaming\Amazon

2013-06-29 14:20 . 2013-06-29 14:20        --------        d-----w-        c:\users\Fridde\AppData\Local\Program Files

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-18 09:13 . 2013-05-08 18:37        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-07-18 09:13 . 2011-06-19 15:04        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-07-11 22:35 . 2011-06-19 12:08        78185248        ----a-w-        c:\windows\system32\MRT.exe

2013-06-27 08:22 . 2013-05-13 09:14        83672        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-06-16 08:30 . 2010-06-24 18:33        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-06-04 07:15 . 2013-06-04 07:15        103448        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2013-06-04 07:15 . 2013-06-04 07:15        203672        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

2013-06-03 16:39 . 2013-06-03 16:39        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-06-03 16:39 . 2013-06-03 16:39        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-06-03 16:39 . 2013-06-03 16:39        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-06-03 16:39 . 2013-06-03 16:39        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-06-03 16:39 . 2013-06-03 16:39        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-06-03 16:39 . 2013-06-03 16:39        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-06-03 16:39 . 2013-06-03 16:39        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-06-03 16:39 . 2013-06-03 16:39        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-06-03 16:39 . 2013-06-03 16:39        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-06-03 16:39 . 2013-06-03 16:39        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-06-03 16:39 . 2013-06-03 16:39        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-06-03 16:39 . 2013-06-03 16:39        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-06-03 16:39 . 2013-06-03 16:39        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-06-03 16:39 . 2013-06-03 16:39        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-06-03 16:39 . 2013-06-03 16:39        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-06-03 16:39 . 2013-06-03 16:39        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-06-03 16:39 . 2013-06-03 16:39        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-06-03 16:39 . 2013-06-03 16:39        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-06-03 16:39 . 2013-06-03 16:39        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-06-03 16:39 . 2013-06-03 16:39        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-06-03 16:39 . 2013-06-03 16:39        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-06-03 16:39 . 2013-06-03 16:39        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-06-03 16:39 . 2013-06-03 16:39        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-06-03 16:39 . 2013-06-03 16:39        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-06-03 16:39 . 2013-06-03 16:39        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-06-03 16:39 . 2013-06-03 16:39        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-06-03 16:39 . 2013-06-03 16:39        441856        ----a-w-        c:\windows\system32\html.iec

2013-06-03 16:39 . 2013-06-03 16:39        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-06-03 16:39 . 2013-06-03 16:39        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-06-03 16:39 . 2013-06-03 16:39        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-06-03 16:39 . 2013-06-03 16:39        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-06-03 16:39 . 2013-06-03 16:39        235008        ----a-w-        c:\windows\system32\url.dll

2013-06-03 16:39 . 2013-06-03 16:39        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-06-03 16:39 . 2013-06-03 16:39        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-06-03 16:39 . 2013-06-03 16:39        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-06-03 16:39 . 2013-06-03 16:39        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-06-03 16:39 . 2013-06-03 16:39        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-06-03 16:39 . 2013-06-03 16:39        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-06-03 16:39 . 2013-06-03 16:39        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-06-03 16:39 . 2013-06-03 16:39        149504        ----a-w-        c:\windows\system32\occache.dll

2013-06-03 16:39 . 2013-06-03 16:39        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-06-03 16:39 . 2013-06-03 16:39        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-06-03 16:39 . 2013-06-03 16:39        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-06-03 16:39 . 2013-06-03 16:39        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-06-03 16:39 . 2013-06-03 16:39        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-06-03 16:39 . 2013-06-03 16:39        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-06-03 16:39 . 2013-06-03 16:39        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-06-03 16:39 . 2013-06-03 16:39        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-06-03 16:39 . 2013-06-03 16:39        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-06-03 16:38 . 2013-06-03 16:38        9728        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        648192        ----a-w-        c:\windows\system32\d3d10level9.dll

2013-06-03 16:38 . 2013-06-03 16:38        604160        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2013-06-03 16:38 . 2013-06-03 16:38        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        522752        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2013-06-03 16:38 . 2013-06-03 16:38        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-06-03 16:38 . 2013-06-03 16:38        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-06-03 16:38 . 2013-06-03 16:38        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        3928064        ----a-w-        c:\windows\system32\d2d1.dll

2013-06-03 16:38 . 2013-06-03 16:38        364544        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2013-06-03 16:38 . 2013-06-03 16:38        363008        ----a-w-        c:\windows\system32\dxgi.dll

2013-06-03 16:38 . 2013-06-03 16:38        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        3584        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        3419136        ----a-w-        c:\windows\SysWow64\d2d1.dll

2013-06-03 16:38 . 2013-06-03 16:38        333312        ----a-w-        c:\windows\system32\d3d10_1core.dll

2013-06-03 16:38 . 2013-06-03 16:38        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        296960        ----a-w-        c:\windows\system32\d3d10core.dll

2013-06-03 16:38 . 2013-06-03 16:38        293376        ----a-w-        c:\windows\SysWow64\dxgi.dll

2013-06-03 16:38 . 2013-06-03 16:38        2776576        ----a-w-        c:\windows\system32\msmpeg2vdec.dll

2013-06-03 16:38 . 2013-06-03 16:38        2565120        ----a-w-        c:\windows\system32\d3d10warp.dll

2013-06-03 16:38 . 2013-06-03 16:38        2560        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        2560        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-06-03 16:38 . 2013-06-03 16:38        249856        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll

2013-06-03 16:38 . 2013-06-03 16:38        245248        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2013-06-03 16:38 . 2013-06-03 16:38        2284544        ----a-w-        c:\windows\SysWow64\msmpeg2vdec.dll

2013-06-03 16:38 . 2013-06-03 16:38        221184        ----a-w-        c:\windows\system32\UIAnimation.dll

2013-06-03 16:38 . 2013-06-03 16:38        220160        ----a-w-        c:\windows\SysWow64\d3d10core.dll

2013-06-03 16:38 . 2013-06-03 16:38        207872        ----a-w-        c:\windows\SysWow64\WindowsCodecsExt.dll

2013-06-03 16:38 . 2013-06-03 16:38        1988096        ----a-w-        c:\windows\SysWow64\d3d10warp.dll

2013-06-03 16:38 . 2013-06-03 16:38        194560        ----a-w-        c:\windows\system32\d3d10_1.dll

2013-06-03 16:38 . 2013-06-03 16:38        187392        ----a-w-        c:\windows\SysWow64\UIAnimation.dll

2013-06-03 16:38 . 2013-06-03 16:38        1682432        ----a-w-        c:\windows\system32\XpsPrint.dll

2013-06-03 16:38 . 2013-06-03 16:38        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll

2013-06-03 16:38 . 2013-06-03 16:38        1238528        ----a-w-        c:\windows\system32\d3d10.dll

2013-06-03 16:38 . 2013-06-03 16:38        1175552        ----a-w-        c:\windows\system32\FntCache.dll

2013-06-03 16:38 . 2013-06-03 16:38        1158144        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        130736        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        130736        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        130736        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SSync"="c:\users\Fridde\AppData\Roaming\SSync\SSync.exe" [2013-04-09 36864]

"SCheck"="c:\users\Fridde\AppData\Roaming\SCheck\SCheck.exe" [2013-04-09 36864]

"Snoozer"="c:\users\Fridde\AppData\Roaming\Snz\Snz.exe" [2013-07-23 1137673]

"DataMgr"="c:\users\Fridde\AppData\Roaming\DataMgr\DataMgr.exe" [2013-05-20 168848]

"Intermediate"="c:\users\Fridde\AppData\Roaming\Intermediate\Intermediate.exe" [2013-04-09 36864]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-04-14 113288]

"Dolby Home Theater v4"="c:\program files (x86)\Dolby Home Theater v4\pcee4.exe" [2011-02-03 506712]

"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2010-08-03 107816]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-27 345144]

"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]

.

c:\users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2013-6-4 113664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

R1 HWiNFO32;HWiNFO32/64 Kernel Driver;f:\diag\HWINFO64\HWiNFO64A.SYS;f:\diag\HWINFO64\HWiNFO64A.SYS [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 AMPPALP;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]

R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]

R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\DRIVERS\fspad_wlh64.sys;c:\windows\SYSNATIVE\DRIVERS\fspad_wlh64.sys [x]

R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]

R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys;c:\windows\SYSNATIVE\Drivers\RTSUVSTOR.sys [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 uxddrv;Dynamically loaded UxdDrv;f:\uxddrv64.sys;f:\uxddrv64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]

S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]

S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]

S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]

S2 GFNEXSrv;GFNEX Service;c:\program files (x86)\PHotkey\GFNEXSrv.exe;c:\program files (x86)\PHotkey\GFNEXSrv.exe [x]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 PEGAGFN;PEGAGFN;c:\program files (x86)\PHotkey\PEGAGFN.sys;c:\program files (x86)\PHotkey\PEGAGFN.sys [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe;c:\program files (x86)\watchmi\TvdService.exe [x]

S3 AMPPAL;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]

S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\drivers\iwdbus.sys;c:\windows\SYSNATIVE\drivers\iwdbus.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-07-23 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-08 09:13]

.

2013-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-08 16:42]

.

2013-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-08 16:42]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        164016        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        164016        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        164016        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-04-24 17:59        164016        ----a-w-        c:\users\Fridde\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-04-19 11817576]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-04-18 2209896]

"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-02-11 10361616]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-06-17 392472]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-06-17 416024]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\

FF - prefs.js: browser.search.defaulturl - hxxp://searchqm.com/search.php?channel=sfde203fbdgy21&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://searchqm.com/?channel=sfde203fbdgy21

FF - prefs.js: keyword.URL - hxxp://searchqm.com/search.php?channel=sfde203fbdgy21&q=

FF - ExtSQL: 2013-07-19 20:54; om@offermosquito.com; c:\users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\extensions\om@offermosquito.com.xpi

FF - ExtSQL: 2013-07-23 10:57; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-AmazonMP3DownloaderHelper - c:\users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk - c:\windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-07-23  21:45:21

ComboFix-quarantined-files.txt  2013-07-23 19:45

.

Vor Suchlauf: 9 Verzeichnis(se), 641.257.402.368 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 642.292.563.968 Bytes frei

.

- - End Of File - - C729931873C2055DCB3890C56E2586EF

D41D8CD98F00B204E9800998ECF8427E

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Code:

# AdwCleaner v2.306 - Datei am 25/07/2013 um 12:46:23 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Fridde - FRIDDE-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Fridde\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\searchplugins\fbdownloader_search.xml

Ordner Gelöscht : C:\ProgramData\Partner

Ordner Gelöscht : C:\Users\Fridde\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\Fridde\AppData\Roaming\DataMgr

Ordner Gelöscht : C:\Users\Fridde\AppData\Roaming\fbDownloader
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\APN PIP

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKLM\Software\PIP

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DataMgr]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16635
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v22.0 (de)
 

Datei : C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\prefs.js
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [1477 octets] - [25/07/2013 12:46:23]
 

########## EOF - C:\AdwCleaner[S1].txt - [1537 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.2.2 (07.22.2013:2)

OS: Windows 7 Home Premium x64

Ran by Fridde on 25.07.2013 at 13:21:47,55

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{321C2487-9D5E-4847-A3C6-523467DF4EBD}

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{4817E962-C589-49E2-B678-DF3D1C84F533}

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{5C30D21F-E995-4104-A9A4-9DE302F6CB5A}

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{8B5970FC-0692-4026-A362-0C5AF3E10592}

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{A429B991-8056-4A85-BB5F-812EED17E283}

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{B325BB13-B068-4CB3-8BAC-12B192AB6704}

Successfully deleted: [Empty Folder] C:\Users\Fridde\appdata\local\{EA88746F-09C0-415C-BBAB-3F5EDBDF1B38}
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Fridde\AppData\Roaming\mozilla\firefox\profiles\mnxumjjy.default\prefs.js
 

user_pref("extensions.crossrider.bic", "13f1f7a7adfa6a0d7212338ce28e266c");

user_pref("om.config", "{\"active\":true,\"name\":\"de\",\"id\":11,\"dispId\":\"CH-11\",\"aboutLink\":\"\",\"trackingGeneral\":true,\"gaAccount\":\"UA-39484183-1\",\"gaDomain\

Emptied folder: C:\Users\Fridde\AppData\Roaming\mozilla\firefox\profiles\mnxumjjy.default\minidumps [10 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 25.07.2013 at 13:26:18,76

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013

Ran by Fridde (administrator) on 25-07-2013 13:28:14

Running from C:\Users\Fridde\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

() C:\Program Files (x86)\watchmi\TvdService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\PHotkey.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe

() C:\Program Files (x86)\PHotkey\ATouch64.exe

() C:\Program Files (x86)\PHotkey\PVDesktop.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe

() C:\Program Files (x86)\PHotkey\PVDAgent.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe

(Dropbox, Inc.) C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11817576 2011-04-19] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2209896 2011-04-18] (Realtek Semiconductor)

HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [x]

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)

HKCU\...\Run: [SSync] - C:\Users\Fridde\AppData\Roaming\SSync\SSync.exe [36864 2013-04-10] ()

HKCU\...\Run: [SCheck] - C:\Users\Fridde\AppData\Roaming\SCheck\SCheck.exe [36864 2013-04-10] ()

HKCU\...\Run: [Snoozer] - C:\Users\Fridde\AppData\Roaming\Snz\Snz.exe [1137673 2013-07-23] ()

HKCU\...\Run: [Intermediate] - C:\Users\Fridde\AppData\Roaming\Intermediate\Intermediate.exe [36864 2013-04-10] ()

HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2011-04-14] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] - "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart [506712 2011-02-03] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)

HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [EEventManager] - "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [239720 2011-06-12] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [200808 2011-06-12] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://searchqm.com/?channel=sfde203fbdgy21

FF Keyword.URL: hxxp://searchqm.com/search.php?channel=sfde203fbdgy21&q=

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF Extension: om - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\om@offermosquito.com.xpi

FF Extension: No Name - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-06-04] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()

R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-10-07] ()

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-12-14] ()

R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [62464 2010-12-06] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-08] (Avira Operations GmbH & Co. KG)

R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

S1 HWiNFO32; \??\F:\DIAG\HWINFO64\HWiNFO64A.SYS [x]

S3 RSUSBVSTOR; System32\Drivers\RTSUVSTOR.sys [x]

S3 uxddrv; \??\F:\uxddrv64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-25 13:26 - 2013-07-25 13:26 - 00002094 _____ C:\Users\Fridde\Desktop\JRT.txt

2013-07-25 13:21 - 2013-07-25 13:21 - 00000000 ____D C:\Windows\ERUNT

2013-07-25 12:46 - 2013-07-25 12:46 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\Fridde\Desktop\JRT.exe

2013-07-25 12:46 - 2013-07-25 12:46 - 00001604 _____ C:\AdwCleaner[S1].txt

2013-07-25 12:45 - 2013-07-25 12:45 - 00666633 _____ C:\Users\Fridde\Desktop\adwcleaner.exe

2013-07-23 21:45 - 2013-07-23 21:45 - 00033152 _____ C:\ComboFix.txt

2013-07-23 21:36 - 2013-07-23 21:45 - 00000000 ____D C:\Qoobox

2013-07-23 21:36 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-07-23 21:36 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-07-23 21:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-07-23 21:35 - 2013-07-23 21:44 - 00000000 ____D C:\Windows\erdnt

2013-07-23 21:33 - 2013-07-23 21:33 - 05092552 ____R (Swearware) C:\Users\Fridde\Desktop\ComboFix.exe

2013-07-23 17:58 - 2013-07-23 17:58 - 00021372 _____ C:\Users\Fridde\Desktop\Addition.txt

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-23 15:27 - 2013-07-23 17:50 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 17:13 - 2013-07-21 18:09 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-16 20:42 - 2013-07-16 20:45 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:42 - 2013-07-16 20:44 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:11 - 2013-07-16 19:12 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 21:00 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 19:09 - 2013-07-16 19:46 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 22:20 - 2013-07-19 00:14 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-12 00:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 00:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 00:33 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 00:33 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 16:03 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 16:03 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 16:03 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 16:03 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 16:03 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 16:02 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 16:02 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung
 

==================== One Month Modified Files and Folders =======
 

2013-07-25 13:26 - 2013-07-25 13:26 - 00002094 _____ C:\Users\Fridde\Desktop\JRT.txt

2013-07-25 13:21 - 2013-07-25 13:21 - 00000000 ____D C:\Windows\ERUNT

2013-07-25 13:15 - 2013-05-08 20:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-25 13:03 - 2013-05-08 18:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-25 12:56 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-25 12:56 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-25 12:52 - 2013-05-08 18:38 - 01301794 _____ C:\Windows\WindowsUpdate.log

2013-07-25 12:50 - 2013-05-08 19:22 - 00000000 ___RD C:\Users\Fridde\Dropbox

2013-07-25 12:50 - 2013-05-08 19:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Dropbox

2013-07-25 12:49 - 2013-05-08 18:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-25 12:47 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-25 12:47 - 2009-07-14 06:51 - 00051738 _____ C:\Windows\setupact.log

2013-07-25 12:46 - 2013-07-25 12:46 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\Fridde\Desktop\JRT.exe

2013-07-25 12:46 - 2013-07-25 12:46 - 00001604 _____ C:\AdwCleaner[S1].txt

2013-07-25 12:45 - 2013-07-25 12:45 - 00666633 _____ C:\Users\Fridde\Desktop\adwcleaner.exe

2013-07-25 12:35 - 2010-11-21 05:47 - 00060360 _____ C:\Windows\PFRO.log

2013-07-23 21:45 - 2013-07-23 21:45 - 00033152 _____ C:\ComboFix.txt

2013-07-23 21:45 - 2013-07-23 21:36 - 00000000 ____D C:\Qoobox

2013-07-23 21:45 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default

2013-07-23 21:44 - 2013-07-23 21:35 - 00000000 ____D C:\Windows\erdnt

2013-07-23 21:43 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2013-07-23 21:33 - 2013-07-23 21:33 - 05092552 ____R (Swearware) C:\Users\Fridde\Desktop\ComboFix.exe

2013-07-23 17:58 - 2013-07-23 17:58 - 00021372 _____ C:\Users\Fridde\Desktop\Addition.txt

2013-07-23 17:50 - 2013-07-23 15:27 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 11:06 - 2011-06-19 19:00 - 00654166 _____ C:\Windows\system32\perfh007.dat

2013-07-23 11:06 - 2011-06-19 19:00 - 00130006 _____ C:\Windows\system32\perfc007.dat

2013-07-23 11:06 - 2009-07-14 07:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 18:09 - 2013-07-21 17:13 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-19 00:14 - 2013-07-15 22:20 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-19 00:14 - 2013-05-08 19:08 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Adobe

2013-07-19 00:14 - 2011-06-19 17:04 - 00000000 ____D C:\ProgramData\Adobe

2013-07-18 11:18 - 2013-06-04 23:20 - 00000000 ____D C:\Users\Fridde\AppData\Local\Adobe

2013-07-18 11:13 - 2013-05-08 20:37 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-18 11:13 - 2013-05-08 20:37 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-18 11:13 - 2011-06-19 17:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-18 11:07 - 2009-07-14 07:08 - 00032574 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-16 21:00 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 20:45 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:44 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:46 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:16 - 2013-05-08 18:56 - 00000000 ____D C:\Users\Fridde

2013-07-16 19:12 - 2013-07-16 19:11 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 19:58 - 2013-05-08 18:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-15 19:58 - 2013-05-08 18:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-12 08:08 - 2009-07-14 06:45 - 00441800 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-12 08:06 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-12 00:40 - 2013-06-03 20:47 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-12 00:35 - 2011-06-19 14:08 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-03 17:33 - 2013-05-08 19:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung

2013-06-27 10:22 - 2013-05-13 11:14 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-23 17:30
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

ESET

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=320125faa6ee09479140ab9976deecda

# engine=14527

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-07-25 11:06:00

# local_time=2013-07-26 01:06:00 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 96 182401 6755675 175189 0

# compatibility_mode=5893 16776573 100 94 41645 126423410 0 0

# scanned=217338

# found=0

# cleaned=0

# scan_time=28214

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=320125faa6ee09479140ab9976deecda

# engine=14530

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-07-26 01:23:54

# local_time=2013-07-26 03:23:54 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 96 53213 6807149 45992 0

# compatibility_mode=5893 16776573 100 94 93119 126474884 0 0

# scanned=594589

# found=0

# cleaned=0

# scan_time=26485

Code:

 Results of screen317's Security Check version 0.99.70  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Java(TM) 6 Update 26  

 Java version out of Date! 

 Adobe Flash Player 11.8.800.94  

 Adobe Reader XI  

 Mozilla Firefox (22.0) 

 Google Chrome 7.0.517.43  
 ````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013

Ran by Fridde (administrator) on 26-07-2013 17:15:06

Running from C:\Users\Fridde\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

() C:\Program Files (x86)\watchmi\TvdService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Dropbox, Inc.) C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\PHotkey.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe

(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe

() C:\Program Files (x86)\PHotkey\PVDesktop.exe

() C:\Program Files (x86)\PHotkey\PVDAgent.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11817576 2011-04-19] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2209896 2011-04-18] (Realtek Semiconductor)

HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [x]

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)

HKCU\...\Run: [SSync] - C:\Users\Fridde\AppData\Roaming\SSync\SSync.exe [36864 2013-04-10] ()

HKCU\...\Run: [SCheck] - C:\Users\Fridde\AppData\Roaming\SCheck\SCheck.exe [36864 2013-04-10] ()

HKCU\...\Run: [Snoozer] - C:\Users\Fridde\AppData\Roaming\Snz\Snz.exe [1137673 2013-07-23] ()

HKCU\...\Run: [Intermediate] - C:\Users\Fridde\AppData\Roaming\Intermediate\Intermediate.exe [36864 2013-04-10] ()

HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2011-04-14] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] - "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart [506712 2011-02-03] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)

HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [EEventManager] - "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [239720 2011-06-12] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [200808 2011-06-12] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://searchqm.com/?channel=sfde203fbdgy21

FF Keyword.URL: hxxp://searchqm.com/search.php?channel=sfde203fbdgy21&q=

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF Extension: om - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\om@offermosquito.com.xpi

FF Extension: No Name - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-06-04] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()

R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-10-07] ()

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-12-14] ()

R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [62464 2010-12-06] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-08] (Avira Operations GmbH & Co. KG)

R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

S1 HWiNFO32; \??\F:\DIAG\HWINFO64\HWiNFO64A.SYS [x]

S3 RSUSBVSTOR; System32\Drivers\RTSUVSTOR.sys [x]

S3 uxddrv; \??\F:\uxddrv64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-26 17:00 - 2013-07-26 17:10 - 00891062 _____ C:\Users\Fridde\Desktop\SecurityCheck.exe

2013-07-25 15:18 - 2013-07-25 15:19 - 11275376 _____ C:\Users\Fridde\Desktop\chaoticroad_texturespack8_by_sodamnreckless-d6c6iuq.zip

2013-07-25 13:26 - 2013-07-25 13:26 - 00002094 _____ C:\Users\Fridde\Desktop\JRT.txt

2013-07-25 13:21 - 2013-07-25 13:21 - 00000000 ____D C:\Windows\ERUNT

2013-07-25 12:46 - 2013-07-25 12:46 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\Fridde\Desktop\JRT.exe

2013-07-25 12:46 - 2013-07-25 12:46 - 00001604 _____ C:\AdwCleaner[S1].txt

2013-07-25 12:45 - 2013-07-25 12:45 - 00666633 _____ C:\Users\Fridde\Desktop\adwcleaner.exe

2013-07-23 21:45 - 2013-07-23 21:45 - 00033152 _____ C:\ComboFix.txt

2013-07-23 21:36 - 2013-07-23 21:45 - 00000000 ____D C:\Qoobox

2013-07-23 21:36 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-07-23 21:36 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-07-23 21:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-07-23 21:35 - 2013-07-23 21:44 - 00000000 ____D C:\Windows\erdnt

2013-07-23 21:33 - 2013-07-23 21:33 - 05092552 ____R (Swearware) C:\Users\Fridde\Desktop\ComboFix.exe

2013-07-23 17:58 - 2013-07-23 17:58 - 00021372 _____ C:\Users\Fridde\Desktop\Addition.txt

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-23 15:27 - 2013-07-23 17:50 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 17:13 - 2013-07-21 18:09 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-16 20:42 - 2013-07-16 20:45 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:42 - 2013-07-16 20:44 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:11 - 2013-07-16 19:12 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 21:00 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 19:09 - 2013-07-16 19:46 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 22:20 - 2013-07-25 16:01 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-12 00:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 00:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 00:33 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 00:33 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 16:03 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 16:03 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 16:03 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 16:03 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 16:03 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 16:02 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 16:02 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung
 

==================== One Month Modified Files and Folders =======
 

2013-07-26 17:15 - 2013-05-08 20:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-26 17:10 - 2013-07-26 17:00 - 00891062 _____ C:\Users\Fridde\Desktop\SecurityCheck.exe

2013-07-26 17:03 - 2013-05-08 18:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-26 16:30 - 2013-05-08 18:38 - 01556315 _____ C:\Windows\WindowsUpdate.log

2013-07-26 13:31 - 2013-06-23 13:05 - 00001456 _____ C:\Users\Fridde\AppData\Local\Adobe Save for Web 12.0 Prefs

2013-07-26 07:49 - 2013-05-08 19:22 - 00000000 ___RD C:\Users\Fridde\Dropbox

2013-07-26 07:49 - 2013-05-08 19:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Dropbox

2013-07-26 07:48 - 2013-05-08 18:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-26 07:48 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-26 07:48 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-26 07:45 - 2011-06-19 19:00 - 00654166 _____ C:\Windows\system32\perfh007.dat

2013-07-26 07:45 - 2011-06-19 19:00 - 00130006 _____ C:\Windows\system32\perfc007.dat

2013-07-26 07:45 - 2009-07-14 07:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-26 07:40 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-26 07:40 - 2009-07-14 06:51 - 00051794 _____ C:\Windows\setupact.log

2013-07-25 16:01 - 2013-07-15 22:20 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-25 16:01 - 2013-05-08 19:08 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Adobe

2013-07-25 16:01 - 2011-06-19 17:04 - 00000000 ____D C:\ProgramData\Adobe

2013-07-25 15:19 - 2013-07-25 15:18 - 11275376 _____ C:\Users\Fridde\Desktop\chaoticroad_texturespack8_by_sodamnreckless-d6c6iuq.zip

2013-07-25 13:26 - 2013-07-25 13:26 - 00002094 _____ C:\Users\Fridde\Desktop\JRT.txt

2013-07-25 13:21 - 2013-07-25 13:21 - 00000000 ____D C:\Windows\ERUNT

2013-07-25 12:46 - 2013-07-25 12:46 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\Fridde\Desktop\JRT.exe

2013-07-25 12:46 - 2013-07-25 12:46 - 00001604 _____ C:\AdwCleaner[S1].txt

2013-07-25 12:45 - 2013-07-25 12:45 - 00666633 _____ C:\Users\Fridde\Desktop\adwcleaner.exe

2013-07-25 12:35 - 2010-11-21 05:47 - 00060360 _____ C:\Windows\PFRO.log

2013-07-23 21:45 - 2013-07-23 21:45 - 00033152 _____ C:\ComboFix.txt

2013-07-23 21:45 - 2013-07-23 21:36 - 00000000 ____D C:\Qoobox

2013-07-23 21:45 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default

2013-07-23 21:44 - 2013-07-23 21:35 - 00000000 ____D C:\Windows\erdnt

2013-07-23 21:43 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2013-07-23 21:33 - 2013-07-23 21:33 - 05092552 ____R (Swearware) C:\Users\Fridde\Desktop\ComboFix.exe

2013-07-23 17:58 - 2013-07-23 17:58 - 00021372 _____ C:\Users\Fridde\Desktop\Addition.txt

2013-07-23 17:50 - 2013-07-23 15:27 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 18:09 - 2013-07-21 17:13 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-18 11:18 - 2013-06-04 23:20 - 00000000 ____D C:\Users\Fridde\AppData\Local\Adobe

2013-07-18 11:13 - 2013-05-08 20:37 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-18 11:13 - 2013-05-08 20:37 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-18 11:13 - 2011-06-19 17:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-18 11:07 - 2009-07-14 07:08 - 00032574 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-16 21:00 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 20:45 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:44 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:46 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:16 - 2013-05-08 18:56 - 00000000 ____D C:\Users\Fridde

2013-07-16 19:12 - 2013-07-16 19:11 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 19:58 - 2013-05-08 18:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-15 19:58 - 2013-05-08 18:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-12 08:08 - 2009-07-14 06:45 - 00441800 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-12 08:06 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-12 00:40 - 2013-06-03 20:47 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-12 00:35 - 2011-06-19 14:08 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-03 17:33 - 2013-05-08 19:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung

2013-06-27 10:22 - 2013-05-13 11:14 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-23 17:30
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Ich habe den Laptop gerade einmal herunterfahren und neu gestartet und leider ist das Problem noch nicht behoben.

Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKCU\...\Run: [SSync] - C:\Users\Fridde\AppData\Roaming\SSync\SSync.exe [36864 2013-04-10] ()

HKCU\...\Run: [SCheck] - C:\Users\Fridde\AppData\Roaming\SCheck\SCheck.exe [36864 2013-04-10] ()

HKCU\...\Run: [Snoozer] - C:\Users\Fridde\AppData\Roaming\Snz\Snz.exe [1137673 2013-07-23] ()

HKCU\...\Run: [Intermediate] - C:\Users\Fridde\AppData\Roaming\Intermediate\Intermediate.exe [36864 2013-04-10] ()

C:\Users\Fridde\AppData\Roaming\SSync

C:\Users\Fridde\AppData\Roaming\SCheck

C:\Users\Fridde\AppData\Roaming\Snz

C:\Users\Fridde\AppData\Roaming\Intermediate

HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]

C:\Windows\Web\Wallpaper\MEDION\start.vbs

FF Homepage: hxxp://searchqm.com/?channel=sfde203fbdgy21

FF Keyword.URL: hxxp://searchqm.com/search.php?channel=sfde203fbdgy21&q=

2013-07-23 15:27 - 2013-07-23 17:50 - 00000000 ____D C:\Windows\67E1227ED5534A6A96CD40CCBBC705D8.TMP

2013-07-23 15:27 - 2013-07-23 15:27 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-07-23 10:23 - 2013-07-23 10:23 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Snz

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{AB404F93-CDCE-40D9-8D4E-8606C84D368C}

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 __HDC C:\ProgramData\{16996CC6-7043-45AD-9C8D-A784409115E4}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Frisches FRST log bitte. Noch Probleme?

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013

Ran by Fridde (administrator) on 27-07-2013 11:56:01

Running from C:\Users\Fridde\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

() C:\Program Files (x86)\watchmi\TvdService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\PHotkey.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe

() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

() C:\Program Files (x86)\PHotkey\ATouch64.exe

() C:\Program Files (x86)\PHotkey\PVDesktop.exe

() C:\Program Files (x86)\PHotkey\PVDAgent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Dropbox, Inc.) C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\system32\msiexec.exe

(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11817576 2011-04-19] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2209896 2011-04-18] (Realtek Semiconductor)

HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [x]

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)

HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2011-04-14] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] - "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart [506712 2011-02-03] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)

HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [EEventManager] - "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [239720 2011-06-12] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [200808 2011-06-12] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Fridde\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default

FF SelectedSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Fridde\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF Extension: om - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\om@offermosquito.com.xpi

FF Extension: No Name - C:\Users\Fridde\AppData\Roaming\Mozilla\Firefox\Profiles\mnxumjjy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-06-04] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)

R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()

R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-10-07] ()

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-12-14] ()

R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [62464 2010-12-06] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-05-08] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-08] (Avira Operations GmbH & Co. KG)

R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

S1 HWiNFO32; \??\F:\DIAG\HWINFO64\HWiNFO64A.SYS [x]

S3 RSUSBVSTOR; System32\Drivers\RTSUVSTOR.sys [x]

S3 uxddrv; \??\F:\uxddrv64.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-27 11:53 - 2013-07-27 11:52 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll

2013-07-27 11:53 - 2013-07-27 11:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-07-27 11:53 - 2013-07-27 11:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-07-27 11:53 - 2013-07-27 11:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-07-27 11:53 - 2013-07-27 11:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-07-27 11:50 - 2013-07-27 11:50 - 00903080 _____ (Oracle Corporation) C:\Users\Fridde\Downloads\jxpiinstall.exe

2013-07-26 17:00 - 2013-07-26 17:10 - 00891062 _____ C:\Users\Fridde\Desktop\SecurityCheck.exe

2013-07-25 15:18 - 2013-07-25 15:19 - 11275376 _____ C:\Users\Fridde\Desktop\chaoticroad_texturespack8_by_sodamnreckless-d6c6iuq.zip

2013-07-25 13:26 - 2013-07-25 13:26 - 00002094 _____ C:\Users\Fridde\Desktop\JRT.txt

2013-07-25 13:21 - 2013-07-25 13:21 - 00000000 ____D C:\Windows\ERUNT

2013-07-25 12:46 - 2013-07-25 12:46 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\Fridde\Desktop\JRT.exe

2013-07-25 12:46 - 2013-07-25 12:46 - 00001604 _____ C:\AdwCleaner[S1].txt

2013-07-25 12:45 - 2013-07-25 12:45 - 00666633 _____ C:\Users\Fridde\Desktop\adwcleaner.exe

2013-07-23 21:45 - 2013-07-23 21:45 - 00033152 _____ C:\ComboFix.txt

2013-07-23 21:36 - 2013-07-23 21:45 - 00000000 ____D C:\Qoobox

2013-07-23 21:36 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-07-23 21:36 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-07-23 21:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-07-23 21:36 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-07-23 21:35 - 2013-07-23 21:44 - 00000000 ____D C:\Windows\erdnt

2013-07-23 21:33 - 2013-07-23 21:33 - 05092552 ____R (Swearware) C:\Users\Fridde\Desktop\ComboFix.exe

2013-07-23 17:58 - 2013-07-23 17:58 - 00021372 _____ C:\Users\Fridde\Desktop\Addition.txt

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 17:13 - 2013-07-21 18:09 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-16 20:42 - 2013-07-16 20:45 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:42 - 2013-07-16 20:44 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:11 - 2013-07-16 19:12 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 21:00 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 19:09 - 2013-07-16 19:46 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 22:20 - 2013-07-25 16:01 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-12 00:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-12 00:33 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-12 00:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 00:33 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-12 00:33 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-12 00:33 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-12 00:33 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 16:03 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 16:03 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 16:03 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 16:03 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 16:03 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 16:02 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 16:02 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung
 

==================== One Month Modified Files and Folders =======
 

2013-07-27 11:53 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-27 11:53 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-27 11:52 - 2013-07-27 11:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll

2013-07-27 11:52 - 2013-07-27 11:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-07-27 11:52 - 2013-07-27 11:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-07-27 11:52 - 2013-07-27 11:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-07-27 11:52 - 2013-07-27 11:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-07-27 11:52 - 2011-06-19 17:04 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll

2013-07-27 11:52 - 2011-06-19 17:04 - 00000000 ____D C:\Program Files (x86)\Java

2013-07-27 11:50 - 2013-07-27 11:50 - 00903080 _____ (Oracle Corporation) C:\Users\Fridde\Downloads\jxpiinstall.exe

2013-07-27 11:50 - 2011-06-19 19:00 - 00654166 _____ C:\Windows\system32\perfh007.dat

2013-07-27 11:50 - 2011-06-19 19:00 - 00130006 _____ C:\Windows\system32\perfc007.dat

2013-07-27 11:50 - 2009-07-14 07:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-27 11:47 - 2013-05-08 19:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Dropbox

2013-07-27 11:46 - 2013-05-08 19:22 - 00000000 ___RD C:\Users\Fridde\Dropbox

2013-07-27 11:44 - 2013-05-08 18:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-27 11:44 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-27 11:44 - 2009-07-14 06:51 - 00051906 _____ C:\Windows\setupact.log

2013-07-26 19:19 - 2013-05-08 18:38 - 01621111 _____ C:\Windows\WindowsUpdate.log

2013-07-26 19:15 - 2013-05-08 20:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-26 19:03 - 2013-05-08 18:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-26 17:17 - 2010-11-21 05:47 - 00061194 _____ C:\Windows\PFRO.log

2013-07-26 17:10 - 2013-07-26 17:00 - 00891062 _____ C:\Users\Fridde\Desktop\SecurityCheck.exe

2013-07-26 13:31 - 2013-06-23 13:05 - 00001456 _____ C:\Users\Fridde\AppData\Local\Adobe Save for Web 12.0 Prefs

2013-07-25 16:01 - 2013-07-15 22:20 - 00000000 ____D C:\Users\Fridde\Desktop\Neuer Ordner

2013-07-25 16:01 - 2013-05-08 19:08 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Adobe

2013-07-25 16:01 - 2011-06-19 17:04 - 00000000 ____D C:\ProgramData\Adobe

2013-07-25 15:19 - 2013-07-25 15:18 - 11275376 _____ C:\Users\Fridde\Desktop\chaoticroad_texturespack8_by_sodamnreckless-d6c6iuq.zip

2013-07-25 13:26 - 2013-07-25 13:26 - 00002094 _____ C:\Users\Fridde\Desktop\JRT.txt

2013-07-25 13:21 - 2013-07-25 13:21 - 00000000 ____D C:\Windows\ERUNT

2013-07-25 12:46 - 2013-07-25 12:46 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\Fridde\Desktop\JRT.exe

2013-07-25 12:46 - 2013-07-25 12:46 - 00001604 _____ C:\AdwCleaner[S1].txt

2013-07-25 12:45 - 2013-07-25 12:45 - 00666633 _____ C:\Users\Fridde\Desktop\adwcleaner.exe

2013-07-23 21:45 - 2013-07-23 21:45 - 00033152 _____ C:\ComboFix.txt

2013-07-23 21:45 - 2013-07-23 21:36 - 00000000 ____D C:\Qoobox

2013-07-23 21:45 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default

2013-07-23 21:44 - 2013-07-23 21:35 - 00000000 ____D C:\Windows\erdnt

2013-07-23 21:43 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2013-07-23 21:33 - 2013-07-23 21:33 - 05092552 ____R (Swearware) C:\Users\Fridde\Desktop\ComboFix.exe

2013-07-23 17:58 - 2013-07-23 17:58 - 00021372 _____ C:\Users\Fridde\Desktop\Addition.txt

2013-07-23 17:49 - 2013-07-23 17:49 - 00000000 ____D C:\FRST

2013-07-23 17:48 - 2013-07-23 17:48 - 01779757 _____ (Farbar) C:\Users\Fridde\Desktop\FRST64.exe

2013-07-23 15:28 - 2013-07-23 15:28 - 00000000 _____ C:\autoexec.bat

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs

2013-07-22 14:27 - 2013-07-22 14:27 - 00000000 ____D C:\Program Files (x86)\Topaz Labs

2013-07-21 18:09 - 2013-07-21 17:13 - 00000000 ____D C:\Users\Fridde\Desktop\Britley

2013-07-18 11:18 - 2013-06-04 23:20 - 00000000 ____D C:\Users\Fridde\AppData\Local\Adobe

2013-07-18 11:13 - 2013-05-08 20:37 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-07-18 11:13 - 2013-05-08 20:37 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-18 11:13 - 2011-06-19 17:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-07-18 11:07 - 2009-07-14 07:08 - 00032574 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-16 21:00 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\tmp

2013-07-16 20:45 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf

2013-07-16 20:44 - 2013-07-16 20:42 - 00116564 _____ C:\Users\Fridde\Desktop\Felix.mcf~

2013-07-16 20:42 - 2013-07-16 20:42 - 00000000 ____D C:\Users\Fridde\Desktop\Felix_mcf-Dateien

2013-07-16 19:46 - 2013-07-16 19:09 - 00000000 ____D C:\ProgramData\hps

2013-07-16 19:16 - 2013-07-16 19:16 - 00000000 ____D C:\Users\Fridde\restore

2013-07-16 19:16 - 2013-05-08 18:56 - 00000000 ____D C:\Users\Fridde

2013-07-16 19:12 - 2013-07-16 19:11 - 00000000 ____D C:\Users\Fridde\Desktop\Roll

2013-07-16 19:09 - 2013-07-16 19:09 - 00001268 _____ C:\Users\Public\Desktop\RINGFOTO FOTOWELT.lnk

2013-07-16 19:04 - 2013-07-16 19:04 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR

2013-07-15 19:58 - 2013-05-08 18:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-15 19:58 - 2013-05-08 18:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-12 08:08 - 2009-07-14 06:45 - 00441800 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-12 08:06 - 2013-06-03 18:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-12 08:06 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-12 08:06 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-12 00:40 - 2013-06-03 20:47 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-12 00:35 - 2011-06-19 14:08 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-07 16:21 - 2013-07-07 16:21 - 00001304 _____ C:\Users\Fridde\Desktop\Notepad.lnk

2013-07-03 17:33 - 2013-05-08 19:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-02 21:51 - 2013-07-02 21:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\Documents\Amazon MP3

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2013-06-29 16:20 - 2013-06-29 16:20 - 00000000 ____D C:\Users\Fridde\AppData\Roaming\Amazon

2013-06-29 16:19 - 2013-06-29 16:19 - 02328864 _____ C:\Users\Fridde\Downloads\AmazonMP3DownloaderInstall._V383688031_.exe

2013-06-28 23:17 - 2013-06-28 23:17 - 00189269 _____ C:\Users\Fridde\Downloads\_Kompetenzeinschätzung

2013-06-27 10:22 - 2013-05-13 11:14 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-23 17:30
 

==================== End Of Log ============================

--- --- ---

Hat alles geklappt! Vielen, vielen lieben Dank für die Hilfe! :)

Meine Startseite ist wieder in Ordnung, diese komischen "Werbefenster" (im Moment sind die einfach nur weiß) sind allerdings noch da. Ich bin mir allerdings nicht sicher, ob es was mit dem fbDownloader zu tun hat.

Ich werde, sobald ein weiteres auftaucht, mal einen Screenshot davon machen.

In welchem Browser passiert das?

Im Mozilla Firefox, den Internet Explorer nutze ich nicht.

Hier ein Screenshot: hxxp://i40.tinypic.com/2hdv9km.png