Trojaner-Board - TR/Kazy.213830.5 vom KMPlayer CHIP Online/

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/Kazy.213830.5 vom KMPlayer CHIP Online/ (https://www.trojaner-board.de/139277-tr-kazy-213830-5-kmplayer-chip-online.html)

TR/Kazy.213830.5 vom KMPlayer CHIP Online/

TR/Kazy.213830.5 vom KMPlayer CHIP Online/

Grüß euch Leute ich bin neu und hab direkt mal ein Problem.

Hab mir den

Hab mir den mkplayer von Chip Online Heruntergeladen. Nach dem Interlieren habe ich von meinem Antivir die Meldung bekommen TR/Kazy.213830.5 in den Datein \kmp_3.6.0.87_20130803063949[1].exe und PIPInstaller_PTV_.exe. Beide sind im der Quarantäne.

Bin mir total unsicher, was ich nun machen soll, da mein PC auch keine mitgelieferte Windows 8 CD hat zum neu aufspielen.

Da ich neu bin, bin ich mir nich sicher, mit welchem Programm ich einen Systemscann ausführen soll. Braucht ihr auch eine HijacThis log ?

Antivir:

Exportierte Ereignisse:

03.08.2013 11:30 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\9CP40Y2O\kmp_3.6.0.87_20130803063949[1].exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Kazy.213830.5' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57765f19.qua'
verschoben!

03.08.2013 11:30 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\\AppData\Local\Temp\PIPInstaller_PTV_.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Kazy.213830.5' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4fc1709a.qua'
verschoben!

03.08.2013 11:29 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\\AppData\Local\Microsoft\Windows\Temporary
Internet Files\Content.IE5\9CP40Y2O\kmp_3.6.0.87_20130803063949[1].exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Kazy.213830.5' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner

03.08.2013 11:29 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\\AppData\Local\Temp\PIPInstaller_PTV_.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Kazy.213830.5' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner

03.08.2013 11:29 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\\AppData\Local\Temp\PIPInstaller_PTV_.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Kazy.213830.5' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

Anti Malewarebites

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.03.03

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16635
Shandy :: SANDOR [Administrator]

03.08.2013 14:42:45
mbam-log-2013-08-03 (14-42-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 361600
Laufzeit: 1 Stunde(n), 11 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Emsissoft Maleware

Emsisoft Anti-Malware - Version 8.0
Letztes Update: 03.08.2013 14:50:54
Benutzerkonto:

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn: 03.08.2013 14:52:31
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4fc1709a.qua -> (Quarantine-8) gefunden: Gen:Variant.Kazy.213830 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\57765f19.qua -> (Quarantine-8) gefunden: Gen:Variant.Kazy.213830 (B)

Gescannt 479202
Gefunden 2

Scan Ende: 03.08.2013 17:15:03
Scan Zeit: 2:22:32

Hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013

Ran by Shandy (administrator) on 03-08-2013 17:45:51

Running from C:\Users\

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe

(SMSC) C:\Program Files\SGFX\sgfxmgr.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

() C:\Program Files\SGFX\SgfxConfig.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

() C:\Users\Shandy\AppData\Roaming\ACEStream\updater\ace_update.exe

(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe

(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe

(Emsisoft GmbH) C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2guard.exe

() C:\Program Files (x86)\GRETECH\GomPlayer\GOM.EXE

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2013-04-24] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1664000 2000-01-01] (IDT, Inc.)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKCU\...\Run: [Spotify] - C:\Users\Shandy\AppData\Roaming\Spotify\Spotify.exe [4640768 2013-07-09] (Spotify Ltd)

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Shandy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-09] (Spotify Ltd)

HKCU\...\Run: [DriverTurbo] - C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6775400 2012-05-15] ()

MountPoints2: {d11f80aa-cdfe-11e2-be66-806e6f6e6963} - "G:\LaunchU3.exe" -a

HKLM-x32\...\Run: [BtTray] - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [371976 2012-09-19] (IVT Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-21] (Intel Corporation)

HKLM-x32\...\Run: [SgfxConfig] - C:\Program Files\SGFX\sgfxconfig.exe [2233592 2013-03-18] ()

HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [2928040 2013-07-02] (Emsisoft GmbH)

Startup: C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1261.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default

FF Homepage: Google

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @acestream.net/acestreamplugin,version=2.0.13.1 - C:\Users\Shandy\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies)

FF Extension: HP Detect - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKCU\...\Firefox\Extensions: [magicplayer@torrentstream.org] C:\Users\Shandy\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org

FF Extension: TS Magic Player - C:\Users\Shandy\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org
 

==================== Services (Whitelisted) =================
 

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2938408 2013-07-02] (Emsisoft GmbH)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)

R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1612552 2012-09-26] (IVT Corporation)

R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [146184 2012-09-19] (IVT Corporation)

S2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [38712 2013-01-10] (Hewlett-Packard)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)

R2 SGFXMgr; C:\Program Files\SGFX\sgfxmgr.exe [8481280 2013-03-15] (SMSC)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)

R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)

R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)

R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)

R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)

R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)

R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-06-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-06-05] (Avira Operations GmbH & Co. KG)

R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)

U4 BthHFEnum; 

R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-08-03] (Emsisoft GmbH)

R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-08-03] (Emsisoft GmbH)

S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)

R4 sgfxk; C:\Windows\System32\drivers\sgfxk64.sys [157432 2013-03-18] (SMSC)

R0 sgfxl; C:\Windows\System32\drivers\sgfxl64.sys [18168 2013-03-18] (SMSC)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-24] (Synaptics Incorporated)

S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-06-28] ()

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-03 17:44 - 2013-08-03 17:44 - 01781485 _____ (Farbar) C:\Users\Shandy\Downloads\FRST64.exe

2013-08-03 14:52 - 2013-08-03 15:46 - 798478207 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(2).flv

2013-08-03 14:42 - 2013-08-03 14:42 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Shandy\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-03 14:41 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-03 14:38 - 2013-08-03 17:34 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:38 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2013-08-03 14:38 - 2013-08-03 14:38 - 00000000 ____D C:\Users\Shandy\Documents\Anti-Malware

2013-08-03 14:36 - 2013-08-03 14:38 - 190490568 _____ (Emsisoft GmbH                                               ) C:\Users\Shandy\Downloads\EmsisoftAntiMalwareSetup_8.0.exe

2013-08-03 14:34 - 2013-08-03 14:34 - 00003444 _____ C:\Users\Shandy\Desktop\Ereignisse.txt

2013-08-03 14:30 - 2013-08-03 14:30 - 00020740 _____ C:\Users\Shandy\Downloads\BAR_SAN_2H_08022013.flv.html

2013-08-03 14:07 - 2013-08-03 14:25 - 269893632 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv.part

2013-08-03 14:07 - 2013-08-03 14:07 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv

2013-08-03 13:18 - 2013-08-03 13:56 - 562626560 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv.part

2013-08-03 13:18 - 2013-08-03 13:18 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv

2013-08-03 12:38 - 2013-08-03 13:01 - 00010565 _____ C:\Users\Shandy\Downloads\hijackthis.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000795 _____ C:\Windows\setupact.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000000 _____ C:\Windows\setuperr.log

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\GRETECH

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Program Files (x86)\GRETECH

2013-08-03 10:39 - 2013-08-03 11:25 - 865199442 _____ C:\Users\Shandy\Downloads\BAR SAN 1H 08022013.flv

2013-07-30 15:22 - 2013-07-30 15:22 - 00062388 _____ C:\Users\Shandy\Downloads\media(1).xav

2013-07-30 15:22 - 2013-07-30 15:22 - 00062379 _____ C:\Users\Shandy\Downloads\media(2).xav

2013-07-30 15:21 - 2013-07-30 15:21 - 00062387 _____ C:\Users\Shandy\Downloads\media.xav

2013-07-30 13:02 - 2013-07-30 13:02 - 00000307 _____ C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuletzt besucht.lnk

2013-07-27 13:34 - 2013-07-27 13:34 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-07-27 13:00 - 2013-08-01 13:16 - 00029516 _____ C:\Users\Shandy\Downloads\HA M13 endgültig - Kopie.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00089557 _____ C:\Users\Shandy\Downloads\HA M13 endgültig.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\OpenOffice

2013-07-25 17:44 - 2013-07-25 17:44 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk

2013-07-25 17:43 - 2013-07-25 17:43 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4

2013-07-25 17:30 - 2013-07-25 17:40 - 00000000 ____D C:\Users\Shandy\Downloads\fh

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Program Files\Unlocker

2013-07-25 15:11 - 2013-07-29 18:47 - 00000000 ____D C:\Users\Shandy\Desktop\Modul13

2013-07-24 13:35 - 2013-07-24 15:53 - 00000000 ____D C:\Users\Shandy\Documents\do

2013-07-23 21:34 - 2013-07-23 21:35 - 00000000 ____D C:\Windows\system32\MRT

2013-07-21 11:14 - 2013-07-21 11:14 - 00307904 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-18 16:59 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-18 16:58 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-18 16:58 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-18 16:58 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-18 16:58 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-18 16:57 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-18 16:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-18 16:57 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-18 16:56 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-18 16:56 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-17 09:18 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2013-07-17 09:18 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys

2013-07-17 09:18 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys

2013-07-17 09:18 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe

2013-07-17 09:18 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-07-17 09:18 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS

2013-07-17 09:18 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS

2013-07-17 09:18 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-07-17 09:18 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys

2013-07-17 09:18 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

2013-07-17 09:18 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll

2013-07-17 09:18 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll

2013-07-17 09:18 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2013-07-17 09:18 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe

2013-07-17 09:18 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe

2013-07-17 09:18 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll

2013-07-17 09:18 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll

2013-07-17 09:18 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2013-07-17 09:18 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll

2013-07-17 09:18 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys

2013-07-17 09:18 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2013-07-17 09:18 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2013-07-17 09:18 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2013-07-17 09:18 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2013-07-17 09:18 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml

2013-07-16 21:47 - 2013-07-16 21:47 - 00001122 _____ C:\Windows\PFRO.log

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\Users\####\AppData\Roaming\Canneverbe Limited

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\ProgramData\Canneverbe Limited

2013-07-08 15:50 - 2013-07-08 15:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP

184
 

==================== One Month Modified Files and Folders =======
 

2013-08-03 17:45 - 2013-08-03 17:45 - 00000000 ____D C:\FRST

2013-08-03 17:44 - 2013-08-03 17:44 - 01781485 _____ (Farbar) C:\Users\####\Downloads\FRST64.exe

2013-08-03 17:34 - 2013-08-03 14:38 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2013-08-03 17:14 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru

2013-08-03 15:55 - 2013-06-05 20:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-03 15:46 - 2013-08-03 14:52 - 798478207 _____ C:\Users\####\Downloads\BAR SAN 2H 08022013(2).flv

2013-08-03 14:42 - 2013-08-03 14:42 - 00000000 ____D C:\Users\####\AppData\Roaming\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Shandy\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:38 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2013-08-03 14:38 - 2013-08-03 14:38 - 00000000 ____D C:\Users\Shandy\Documents\Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:36 - 190490568 _____ (Emsisoft GmbH                                               ) C:\Users\###\Downloads\EmsisoftAntiMalwareSetup_8.0.exe

2013-08-03 14:34 - 2013-08-03 14:34 - 00003444 _____ C:\Users\\Desktop\Ereignisse.txt

2013-08-03 14:30 - 2013-08-03 14:30 - 00020740 _____ C:\Users\\Downloads\BAR_SAN_2H_08022013.flv.html

2013-08-03 14:25 - 2013-08-03 14:07 - 269893632 _____ C:\Users\\Downloads\BAR SAN 2H 08022013(1).flv.part

2013-08-03 14:07 - 2013-08-03 14:07 - 00000000 _____ C:\Users\\Downloads\BAR SAN 2H 08022013(1).flv

2013-08-03 13:56 - 2013-08-03 13:18 - 562626560 _____ C:\Users\\Downloads\BAR SAN 2H 08022013.flv.part

2013-08-03 13:18 - 2013-08-03 13:18 - 00000000 _____ C:\Users\\Downloads\BAR SAN 2H 08022013.flv

2013-08-03 13:01 - 2013-08-03 12:38 - 00010565 _____ C:\Users\Downloads\hijackthis.log

2013-08-03 12:35 - 2012-07-26 12:27 - 00754172 _____ C:\Windows\system32\perfh007.dat

2013-08-03 12:35 - 2012-07-26 12:27 - 00156362 _____ C:\Windows\system32\perfc007.dat

2013-08-03 12:35 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-03 12:27 - 2013-07-01 02:52 - 01353892 _____ C:\Windows\WindowsUpdate.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000795 _____ C:\Windows\setupact.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000000 _____ C:\Windows\setuperr.log

2013-08-03 11:34 - 2013-06-15 21:29 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\vlc

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\GRETECH

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Program Files (x86)\GRETECH

2013-08-03 11:25 - 2013-08-03 10:39 - 865199442 _____ C:\Users\Shandy\Downloads\BAR SAN 1H 08022013.flv

2013-08-02 17:46 - 2013-06-05 23:20 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Spotify

2013-08-02 16:33 - 2013-06-08 19:55 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-08-02 16:33 - 2013-06-08 19:55 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-08-01 13:16 - 2013-07-27 13:00 - 00029516 _____ C:\Users\Shandy\Downloads\HA M13 endgültig - Kopie.odt

2013-07-30 22:17 - 2013-06-06 17:26 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\.ACEStream

2013-07-30 15:22 - 2013-07-30 15:22 - 00062388 _____ C:\Users\Shandy\Downloads\media(1).xav

2013-07-30 15:22 - 2013-07-30 15:22 - 00062379 _____ C:\Users\Shandy\Downloads\media(2).xav

2013-07-30 15:21 - 2013-07-30 15:21 - 00062387 _____ C:\Users\Shandy\Downloads\media.xav

2013-07-30 13:02 - 2013-07-30 13:02 - 00000307 _____ C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuletzt besucht.lnk

2013-07-29 18:47 - 2013-07-25 15:11 - 00000000 ____D C:\Users\Shandy\Desktop\Modul13

2013-07-27 16:24 - 2013-06-05 18:46 - 00000000 ____D C:\Users\Shandy

2013-07-27 13:37 - 2013-06-05 20:12 - 00000000 ____D C:\Users\Shandy\AppData\Local\Adobe

2013-07-27 13:34 - 2013-07-27 13:34 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-07-27 13:34 - 2013-06-05 23:37 - 00000000 ____D C:\ProgramData\Adobe

2013-07-27 10:35 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2013-07-26 13:33 - 2013-07-26 13:33 - 00089557 _____ C:\Users\Shandy\Downloads\HA M13 endgültig.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\OpenOffice

2013-07-26 12:57 - 2013-06-05 18:52 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2511654649-832228088-3128315156-1001

2013-07-25 17:44 - 2013-07-25 17:44 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk

2013-07-25 17:43 - 2013-07-25 17:43 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4

2013-07-25 17:40 - 2013-07-25 17:30 - 00000000 ____D C:\Users\Shandy\Downloads\fh

2013-07-25 17:38 - 2013-06-05 18:46 - 00000000 ____D C:\Users\Shandy\AppData\Local\Packages

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Program Files\Unlocker

2013-07-24 15:53 - 2013-07-24 13:35 - 00000000 ____D C:\Users\Shandy\Documents\do

2013-07-23 21:35 - 2013-07-23 21:34 - 00000000 ____D C:\Windows\system32\MRT

2013-07-21 11:14 - 2013-07-21 11:14 - 00307904 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-21 11:14 - 2012-09-26 09:53 - 00000932 _____ C:\Windows\SysWOW64\bscs.ini

2013-07-21 11:14 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-21 11:14 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI

2013-07-19 00:09 - 2012-07-26 12:29 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-17 21:40 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe

2013-07-16 21:47 - 2013-07-16 21:47 - 00001122 _____ C:\Windows\PFRO.log

2013-07-16 21:47 - 2013-06-05 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-16 21:46 - 2012-07-26 07:37 - 00000000 ____D C:\Windows\servicing

2013-07-11 16:23 - 2013-06-05 20:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-11 11:26 - 2013-06-30 16:18 - 00026967 _____ C:\Users\Shandy\Documents\modul18.odt

2013-07-09 17:26 - 2013-06-05 23:20 - 00000000 ____D C:\Users\Shandy\AppData\Local\Spotify

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Canneverbe Limited

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\ProgramData\Canneverbe Limited

2013-07-08 15:50 - 2013-07-08 15:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP

2013-07-06 14:45 - 2013-06-19 13:58 - 00000298 _____ C:\Users\Shandy\Documents\Neues Textdokument.txt
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-22 11:13
 

==================== End Of Log ============================

--- --- ---

Und hier die Addition:FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013

Ran by Shandy at 2013-08-03 17:46:30

Running from C:\Users\Shandy\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

ACE Stream Media 2.0.13.1 (HKCU Version: 2.0.13.1)

Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)

Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)

Avira Free Antivirus (x32 Version: 13.0.0.3884)

CDBurnerXP (x32 Version: 4.5.1.4003)

Core Graphics Software (Version: 5.2.59.0297)

eaner (Version: 4.03)

Emsisoft Anti-Malware (x32 Version: 8.0)

GOM Player (x32 Version: 2.1.49.5139)

Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)

HP 3D DriveGuard (Version: 4.2.9.1)

HP Connected Remote (x32 Version: 1.7.271)

HP CoolSense (x32 Version: 2.10.51)

HP Port Replicator Software Installer (x32 Version: 1.2.19)

HP Product Detection (x32 Version: 11.15.0007)

HP Quick Launch (x32 Version: 3.0.6)

HP Support Assistant (x32 Version: 7.0.39.15)

HP Utility Center (Version: 2.1.6)

HP Wireless Button Driver (x32 Version: 1.0.6.1)

IDT Audio (x32 Version: 1.0.6433.0)

Intel(R) Control Center (x32 Version: 1.2.1.1008)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)

Intel(R) Processor Graphics (x32 Version: 9.18.10.3071)

Intel(R) Rapid Storage Technology (x32 Version: 11.6.2.1002)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 3.0.0.63463)

Intel® Trusted Connect Service Client (Version: 1.24.388.1)

Java 7 Update 25 (x32 Version: 7.0.250)

Java Auto Updater (x32 Version: 2.1.9.5)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Microsoft SQL Server Compact 3.5 SP2 ENU (x32 Version: 3.5.8080.0)

Microsoft SQL Server Compact 3.5 SP2 x64 ENU (Version: 3.5.8080.0)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)

Mozilla Maintenance Service (x32 Version: 22.0)

Mozilla Thunderbird 17.0.7 (x86 de) (x32 Version: 17.0.7)

OpenOffice 4.0.0 (x32 Version: 4.00.9702)

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)

Ralink Bluetooth Stack64 (Version: 9.0.725.0)

Ralink RT5390R 802.11bgn Wi-Fi Adapter (x32 Version: 5.0.5.0)

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)

Realtek PCIE Card Reader (x32 Version: 6.2.8400.29029)

Skype™ 6.5 (x32 Version: 6.5.158)

SMSC Core Graphics Software (x32 Version: 5.2.59.0297)

SMSC LAN9500 Device Driver (Version: 12.12.06.0)

Spotify (HKCU Version: 0.9.1.57.ge7405149)

Synaptics Pointing Device Driver (Version: 16.5.3.3)

System Requirements Lab for Intel (x32 Version: 4.5.13.0)

Unlocker 1.9.2 (Version: 1.9.2)

Veetle TV (x32 Version: 0.9.19)

ViewSpan (Version: 2.8.3.0)

VLC media player 2.0.7 (Version: 2.0.7)

WinRAR 4.20 (64-Bit) (Version: 4.20.0)
 

==================== Restore Points  =========================
 

23-07-2013 19:30:06 Windows Update

25-07-2013 15:34:17 Removed Adobe Reader XI (11.0.03) - Deutsch.

02-08-2013 15:42:54 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation)

Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical

Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)

Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents

Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance

Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation)

Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh

Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks

Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update

Task: {31D50235-3722-4F5F-8309-7235E214A3DC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {32E6B5FD-3FA1-4123-B08F-A05165C69BB1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator

Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask

Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem

Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance

Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage

Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation)

Task: {499F665D-9D96-44F6-B1A8-9921CBEFAC9F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-07-16] (Hewlett-Packard)

Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon

Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance

Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required

Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation)

Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation)

Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319

Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update

Task: {7BBF55EA-EFD3-4377-8C0B-7E2BC0D8773D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)

Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance

Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance

Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode)

Task: {8A1B90F1-A017-47E7-8638-1E20CAA28678} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)

Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses

Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime

Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64

Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic

Task: {9F93DEB9-4F9E-46BD-BA70-70E135535234} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup

Task: {A461B299-1E69-4DFD-916E-06B101FFFD7C} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation)

Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask

Task: {A8D4C86E-37CD-4985-9C8B-33B86F981AAB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh

Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask

Task: {AC8C1F1D-566B-4365-B2E4-4C8EAF113F99} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe [2012-08-15] (Microsoft Corporation)

Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask

Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan

Task: {B2B6C473-D5CD-4787-99F2-B1C36A79784B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-11] (Adobe Systems Incorporated)

Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific

Task: {BDF4753E-4406-4F72-90C6-A93CAE4D8914} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall

Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan

Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)

Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork

Task: {CF3DCC3C-6980-4041-B666-65022A09DBE6} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation)

Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical

Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery

Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation)

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)

Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM

Task: {F6DE2DB6-8ED0-46F0-8B2C-71A98F4AEF01} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect

Task: {FA41F000-EB5F-4EF2-A359-5CC965C7DE18} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2511654649-832228088-3128315156-1001

Task: {FFE3FD50-646E-4A64-913B-23C4187E6025} - System32\Tasks\Microsoft\Windows\File Classification Infrastructure\Property Definition Sync

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/02/2013 04:52:31 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
 

Error: (07/31/2013 01:06:39 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SANDOR)

Description: Bei der Aktivierung der App „Microsoft.BingNews_8wekyb3d8bbwe!AppexNews“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (07/31/2013 01:06:39 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SANDOR)

Description: Bei der Aktivierung der App „Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (07/30/2013 06:51:25 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
 

Error: (07/30/2013 06:51:10 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
 

Error: (07/29/2013 10:30:11 PM) (Source: ESENT) (User: )

Description: taskhostex (5604) Versuch, Datei "C:\Users\Shandy\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 

Error: (07/27/2013 10:47:32 AM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
 

Error: (07/26/2013 01:09:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
 

Error: (07/26/2013 01:09:25 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
 

Error: (07/25/2013 05:40:56 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: SANDOR)

Description: Die App „Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
 
 

System errors:

=============

Error: (08/02/2013 07:31:21 PM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "###" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/31/2013 01:06:39 AM) (Source: DCOM) (User: SANDOR)

Description: AppexNews.AppXm7hnj7tzqqzrmb6spmf0x4fb91edcc71.mca
 

Error: (07/31/2013 01:06:39 AM) (Source: DCOM) (User: SANDOR)

Description: AppexFinance.AppXt2b0qt8jwqketvnyx02s765gyw55jaq6.mca
 

Error: (07/31/2013 01:06:39 AM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/29/2013 01:48:51 PM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "#####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/29/2013 01:03:40 PM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "#####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/29/2013 00:37:50 PM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/28/2013 00:06:09 AM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/27/2013 10:14:01 PM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 

Error: (07/26/2013 10:12:35 PM) (Source: bowser) (User: )

Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "####" auf Transport "NetBT_Tcpip_{84C24F78-ECF7-4997-81B2-9042F6724DC2}". Das Datagramm steht in den Daten.

Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
 
 

Microsoft Office Sessions:

=========================

Error: (08/02/2013 04:52:31 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestc:\program files (x86)\ralink corporation\ralink bluetooth stack\BsSMSEditor.exe
 

Error: (07/31/2013 01:06:39 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SANDOR)

Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2144927141
 

Error: (07/31/2013 01:06:39 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SANDOR)

Description: Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance-2144927141
 

Error: (07/30/2013 06:51:25 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestc:\program files (x86)\ralink corporation\ralink bluetooth stack\BsSMSEditor.exe
 

Error: (07/30/2013 06:51:10 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestc:\program files (x86)\ralink corporation\ralink bluetooth stack\BsSMSEditor.exe
 

Error: (07/29/2013 10:30:11 PM) (Source: ESENT)(User: )

Description: taskhostex5604C:\Users\Shandy\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
 

Error: (07/27/2013 10:47:32 AM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestc:\program files (x86)\ralink corporation\ralink bluetooth stack\BsSMSEditor.exe
 

Error: (07/26/2013 01:09:43 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestc:\program files (x86)\ralink corporation\ralink bluetooth stack\BsSMSEditor.exe
 

Error: (07/26/2013 01:09:25 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestc:\program files (x86)\ralink corporation\ralink bluetooth stack\BsSMSEditor.exe
 

Error: (07/25/2013 05:40:56 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: )

Description: Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 60%

Total physical RAM: 3994.36 MB

Available physical RAM: 1593.07 MB

Total Pagefile: 5130.36 MB

Available Pagefile: 1758.23 MB

Total Virtual: 8192 MB

Available Virtual: 8191.77 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:326.15 GB) (Free:285.45 GB) NTFS (Disk=0 Partition=3)

Drive d: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.97 GB) FAT32 (Disk=0 Partition=4)

Drive e: () (Fixed) (Total:136.72 GB) (Free:136.21 GB) NTFS (Disk=0 Partition=2)
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: C499E06A)

Partition 1: (Active) - (Size=900 MB) - (Type=0B)

Partition 2: (Not Active) - (Size=137 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=326 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
 

==================== End Of Log ============================

--- --- ---

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

AdwCleaner Logfile:

Code:

# AdwCleaner v2.306 - Datei am 04/08/2013 um 13:22:11 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows 8 Pro  (64 bits)

# Benutzer : Shandy - SANDOR

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Shandy\Downloads\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Ordner Gelöscht : C:\ProgramData\APN
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16537
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v22.0 (de)
 

Datei : C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\prefs.js
 

Gelöscht : user_pref("extensions.SPCV7.domain", "\"www.search.ask.com\"");
 

*************************
 

AdwCleaner[S1].txt - [830 octets] - [04/08/2013 13:22:11]
 

########## EOF - C:\AdwCleaner[S1].txt - [889 octets] ##########

--- --- ---

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.3.2 (08.03.2013:1)
OS: Windows 8 Pro x64
Ran by Shandy on 04.08.2013 at 13:30:50,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ FireFox

Emptied folder: C:\Users\Shandy\AppData\Roaming\mozilla\firefox\profiles\se08g1e6.default\minidumps [3 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.08.2013 at 13:36:16,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013

Ran by Shandy (administrator) on 04-08-2013 13:39:54

Running from C:\Users\Shandy\Downloads

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe

(SMSC) C:\Program Files\SGFX\sgfxmgr.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

() C:\Program Files\SGFX\SgfxConfig.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2013-04-24] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1664000 2000-01-01] (IDT, Inc.)

HKCU\...\Run: [Spotify] - C:\Users\Shandy\AppData\Roaming\Spotify\Spotify.exe [4640768 2013-07-09] (Spotify Ltd)

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Shandy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-09] (Spotify Ltd)

HKCU\...\Run: [DriverTurbo] - C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6775400 2012-05-15] ()

MountPoints2: {d11f80aa-cdfe-11e2-be66-806e6f6e6963} - "G:\LaunchU3.exe" -a

HKLM-x32\...\Run: [BtTray] - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [371976 2012-09-19] (IVT Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-21] (Intel Corporation)

HKLM-x32\...\Run: [SgfxConfig] - C:\Program Files\SGFX\sgfxconfig.exe [2233592 2013-03-18] ()

HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [2928040 2013-07-02] (Emsisoft GmbH)

Startup: C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.

SearchScopes: HKLM - DefaultScope value is missing.

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1261.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default

FF Homepage: Google

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @acestream.net/acestreamplugin,version=2.0.13.1 - C:\Users\Shandy\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies)

FF Extension: HP Detect - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKCU\...\Firefox\Extensions: [magicplayer@torrentstream.org] C:\Users\Shandy\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org

FF Extension: TS Magic Player - C:\Users\Shandy\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org
 

==================== Services (Whitelisted) =================
 

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2938408 2013-07-02] (Emsisoft GmbH)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)

R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1612552 2012-09-26] (IVT Corporation)

R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [146184 2012-09-19] (IVT Corporation)

S2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [38712 2013-01-10] (Hewlett-Packard)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)

R2 SGFXMgr; C:\Program Files\SGFX\sgfxmgr.exe [8481280 2013-03-15] (SMSC)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)

R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)

R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)

R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)

R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)

R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)

R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-06-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-06-05] (Avira Operations GmbH & Co. KG)

R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)

U4 BthHFEnum; 

R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-08-03] (Emsisoft GmbH)

R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-08-03] (Emsisoft GmbH)

S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)

R4 sgfxk; C:\Windows\System32\drivers\sgfxk64.sys [157432 2013-03-18] (SMSC)

R0 sgfxl; C:\Windows\System32\drivers\sgfxl64.sys [18168 2013-03-18] (SMSC)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-24] (Synaptics Incorporated)

S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-06-28] ()

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-04 13:29 - 2013-08-04 13:29 - 00561889 _____ (Oleg N. Scherbakov) C:\Users\Shandy\Downloads\JRT.exe

2013-08-04 13:29 - 2013-08-04 13:29 - 00000000 ____D C:\Windows\ERUNT

2013-08-04 13:22 - 2013-08-04 13:22 - 00000957 _____ C:\AdwCleaner[S1].txt

2013-08-04 13:21 - 2013-08-04 13:21 - 00666633 _____ C:\Users\Shandy\Downloads\adwcleaner.exe

2013-08-03 17:46 - 2013-08-03 17:46 - 00028356 _____ C:\Users\Shandy\Downloads\Addition.txt

2013-08-03 17:45 - 2013-08-03 17:45 - 00000000 ____D C:\FRST

2013-08-03 17:44 - 2013-08-03 17:44 - 01781485 _____ (Farbar) C:\Users\Shandy\Downloads\FRST64.exe

2013-08-03 14:52 - 2013-08-03 15:46 - 798478207 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(2).flv

2013-08-03 14:42 - 2013-08-03 14:42 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Shandy\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-03 14:41 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-03 14:38 - 2013-08-04 13:28 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:38 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2013-08-03 14:38 - 2013-08-03 14:38 - 00000000 ____D C:\Users\Shandy\Documents\Anti-Malware

2013-08-03 14:36 - 2013-08-03 14:38 - 190490568 _____ (Emsisoft GmbH                                               ) C:\Users\Shandy\Downloads\EmsisoftAntiMalwareSetup_8.0.exe

2013-08-03 14:34 - 2013-08-03 14:34 - 00003444 _____ C:\Users\Shandy\Desktop\Ereignisse.txt

2013-08-03 14:30 - 2013-08-03 14:30 - 00020740 _____ C:\Users\Shandy\Downloads\BAR_SAN_2H_08022013.flv.html

2013-08-03 14:07 - 2013-08-03 14:25 - 269893632 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv.part

2013-08-03 14:07 - 2013-08-03 14:07 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv

2013-08-03 13:18 - 2013-08-03 13:56 - 562626560 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv.part

2013-08-03 13:18 - 2013-08-03 13:18 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv

2013-08-03 12:38 - 2013-08-03 13:01 - 00010565 _____ C:\Users\Shandy\Downloads\hijackthis.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000795 _____ C:\Windows\setupact.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000000 _____ C:\Windows\setuperr.log

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\GRETECH

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Program Files (x86)\GRETECH

2013-08-03 10:39 - 2013-08-03 11:25 - 865199442 _____ C:\Users\Shandy\Downloads\BAR SAN 1H 08022013.flv

2013-07-30 15:22 - 2013-07-30 15:22 - 00062388 _____ C:\Users\Shandy\Downloads\media(1).xav

2013-07-30 15:22 - 2013-07-30 15:22 - 00062379 _____ C:\Users\Shandy\Downloads\media(2).xav

2013-07-30 15:21 - 2013-07-30 15:21 - 00062387 _____ C:\Users\Shandy\Downloads\media.xav

2013-07-30 13:02 - 2013-07-30 13:02 - 00000307 _____ C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuletzt besucht.lnk

2013-07-27 13:34 - 2013-07-27 13:34 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-07-27 13:00 - 2013-08-01 13:16 - 00029516 _____ C:\Users\Shandy\Downloads\HA M13 endgültig - Kopie.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00089557 _____ C:\Users\Shandy\Downloads\HA M13 endgültig.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\OpenOffice

2013-07-25 17:44 - 2013-07-25 17:44 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk

2013-07-25 17:43 - 2013-07-25 17:43 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4

2013-07-25 17:30 - 2013-07-25 17:40 - 00000000 ____D C:\Users\Shandy\Downloads\fh

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Program Files\Unlocker

2013-07-25 15:11 - 2013-07-29 18:47 - 00000000 ____D C:\Users\Shandy\Desktop\Modul13

2013-07-24 13:35 - 2013-07-24 15:53 - 00000000 ____D C:\Users\Shandy\Documents\do

2013-07-23 21:34 - 2013-07-23 21:35 - 00000000 ____D C:\Windows\system32\MRT

2013-07-21 11:14 - 2013-08-04 13:25 - 00307760 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-18 16:59 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-18 16:58 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-18 16:58 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-18 16:58 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-18 16:58 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-18 16:57 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-18 16:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-18 16:57 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-18 16:56 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-18 16:56 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-17 09:18 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2013-07-17 09:18 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys

2013-07-17 09:18 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys

2013-07-17 09:18 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe

2013-07-17 09:18 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-07-17 09:18 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS

2013-07-17 09:18 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS

2013-07-17 09:18 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-07-17 09:18 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys

2013-07-17 09:18 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

2013-07-17 09:18 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll

2013-07-17 09:18 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll

2013-07-17 09:18 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2013-07-17 09:18 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe

2013-07-17 09:18 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe

2013-07-17 09:18 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll

2013-07-17 09:18 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll

2013-07-17 09:18 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2013-07-17 09:18 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll

2013-07-17 09:18 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys

2013-07-17 09:18 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2013-07-17 09:18 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2013-07-17 09:18 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2013-07-17 09:18 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2013-07-17 09:18 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml

2013-07-16 21:47 - 2013-08-04 13:24 - 00002382 _____ C:\Windows\PFRO.log

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Canneverbe Limited

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\ProgramData\Canneverbe Limited

2013-07-08 15:50 - 2013-07-08 15:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP

190
 

==================== One Month Modified Files and Folders =======
 

2013-08-04 13:36 - 2013-08-04 13:36 - 00000749 _____ C:\Users\Shandy\Desktop\JRT.txt

2013-08-04 13:32 - 2012-07-26 12:27 - 00754172 _____ C:\Windows\system32\perfh007.dat

2013-08-04 13:32 - 2012-07-26 12:27 - 00156362 _____ C:\Windows\system32\perfc007.dat

2013-08-04 13:32 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-04 13:29 - 2013-08-04 13:29 - 00561889 _____ (Oleg N. Scherbakov) C:\Users\Shandy\Downloads\JRT.exe

2013-08-04 13:29 - 2013-08-04 13:29 - 00000000 ____D C:\Windows\ERUNT

2013-08-04 13:28 - 2013-08-03 14:38 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2013-08-04 13:25 - 2013-07-21 11:14 - 00307760 _____ C:\Windows\system32\FNTCACHE.DAT

2013-08-04 13:25 - 2012-09-26 09:53 - 00000932 _____ C:\Windows\SysWOW64\bscs.ini

2013-08-04 13:25 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-04 13:24 - 2013-07-16 21:47 - 00002382 _____ C:\Windows\PFRO.log

2013-08-04 13:24 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI

2013-08-04 13:23 - 2013-07-01 02:52 - 01378569 _____ C:\Windows\WindowsUpdate.log

2013-08-04 13:22 - 2013-08-04 13:22 - 00000957 _____ C:\AdwCleaner[S1].txt

2013-08-04 13:21 - 2013-08-04 13:21 - 00666633 _____ C:\Users\Shandy\Downloads\adwcleaner.exe

2013-08-04 13:19 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru

2013-08-04 02:55 - 2013-06-05 20:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-03 17:46 - 2013-08-03 17:46 - 00028356 _____ C:\Users\Shandy\Downloads\Addition.txt

2013-08-03 17:45 - 2013-08-03 17:45 - 00000000 ____D C:\FRST

2013-08-03 17:44 - 2013-08-03 17:44 - 01781485 _____ (Farbar) C:\Users\Shandy\Downloads\FRST64.exe

2013-08-03 15:46 - 2013-08-03 14:52 - 798478207 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(2).flv

2013-08-03 14:42 - 2013-08-03 14:42 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Shandy\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:38 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2013-08-03 14:38 - 2013-08-03 14:38 - 00000000 ____D C:\Users\Shandy\Documents\Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:36 - 190490568 _____ (Emsisoft GmbH                                               ) C:\Users\Shandy\Downloads\EmsisoftAntiMalwareSetup_8.0.exe

2013-08-03 14:34 - 2013-08-03 14:34 - 00003444 _____ C:\Users\Shandy\Desktop\Ereignisse.txt

2013-08-03 14:30 - 2013-08-03 14:30 - 00020740 _____ C:\Users\Shandy\Downloads\BAR_SAN_2H_08022013.flv.html

2013-08-03 14:25 - 2013-08-03 14:07 - 269893632 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv.part

2013-08-03 14:07 - 2013-08-03 14:07 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv

2013-08-03 13:56 - 2013-08-03 13:18 - 562626560 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv.part

2013-08-03 13:18 - 2013-08-03 13:18 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv

2013-08-03 13:01 - 2013-08-03 12:38 - 00010565 _____ C:\Users\Shandy\Downloads\hijackthis.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000795 _____ C:\Windows\setupact.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000000 _____ C:\Windows\setuperr.log

2013-08-03 11:34 - 2013-06-15 21:29 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\vlc

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\GRETECH

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Program Files (x86)\GRETECH

2013-08-03 11:25 - 2013-08-03 10:39 - 865199442 _____ C:\Users\Shandy\Downloads\BAR SAN 1H 08022013.flv

2013-08-02 17:46 - 2013-06-05 23:20 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Spotify

2013-08-02 16:33 - 2013-06-08 19:55 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-08-02 16:33 - 2013-06-08 19:55 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-08-01 13:16 - 2013-07-27 13:00 - 00029516 _____ C:\Users\Shandy\Downloads\HA M13 endgültig - Kopie.odt

2013-07-30 22:17 - 2013-06-06 17:26 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\.ACEStream

2013-07-30 15:22 - 2013-07-30 15:22 - 00062388 _____ C:\Users\Shandy\Downloads\media(1).xav

2013-07-30 15:22 - 2013-07-30 15:22 - 00062379 _____ C:\Users\Shandy\Downloads\media(2).xav

2013-07-30 15:21 - 2013-07-30 15:21 - 00062387 _____ C:\Users\Shandy\Downloads\media.xav

2013-07-30 13:02 - 2013-07-30 13:02 - 00000307 _____ C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuletzt besucht.lnk

2013-07-29 18:47 - 2013-07-25 15:11 - 00000000 ____D C:\Users\Shandy\Desktop\Modul13

2013-07-27 16:24 - 2013-06-05 18:46 - 00000000 ____D C:\Users\Shandy

2013-07-27 13:37 - 2013-06-05 20:12 - 00000000 ____D C:\Users\Shandy\AppData\Local\Adobe

2013-07-27 13:34 - 2013-07-27 13:34 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-07-27 13:34 - 2013-06-05 23:37 - 00000000 ____D C:\ProgramData\Adobe

2013-07-27 10:35 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2013-07-26 13:33 - 2013-07-26 13:33 - 00089557 _____ C:\Users\Shandy\Downloads\HA M13 endgültig.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\OpenOffice

2013-07-26 12:57 - 2013-06-05 18:52 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2511654649-832228088-3128315156-1001

2013-07-25 17:44 - 2013-07-25 17:44 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk

2013-07-25 17:43 - 2013-07-25 17:43 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4

2013-07-25 17:40 - 2013-07-25 17:30 - 00000000 ____D C:\Users\Shandy\Downloads\fh

2013-07-25 17:38 - 2013-06-05 18:46 - 00000000 ____D C:\Users\Shandy\AppData\Local\Packages

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Program Files\Unlocker

2013-07-24 15:53 - 2013-07-24 13:35 - 00000000 ____D C:\Users\Shandy\Documents\do

2013-07-23 21:35 - 2013-07-23 21:34 - 00000000 ____D C:\Windows\system32\MRT

2013-07-19 00:09 - 2012-07-26 12:29 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-17 21:40 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe

2013-07-16 21:47 - 2013-06-05 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-16 21:46 - 2012-07-26 07:37 - 00000000 ____D C:\Windows\servicing

2013-07-11 16:23 - 2013-06-05 20:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-11 11:26 - 2013-06-30 16:18 - 00026967 _____ C:\Users\Shandy\Documents\modul18.odt

2013-07-09 17:26 - 2013-06-05 23:20 - 00000000 ____D C:\Users\Shandy\AppData\Local\Spotify

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Canneverbe Limited

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\ProgramData\Canneverbe Limited

2013-07-08 15:50 - 2013-07-08 15:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP

2013-07-06 14:45 - 2013-06-19 13:58 - 00000298 _____ C:\Users\Shandy\Documents\Neues Textdokument.txt
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-22 11:13
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Vielen Dank schon mal für die Mühe die du dir mit mir machst, ich weiß das wirklich zu schätzen !!!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=08a600798bcdff418e18626f15a13514
# engine=14656
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-05 10:53:12
# local_time=2013-08-05 12:53:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode=1799 16775165 100 96 3458 5245877 0 0
# compatibility_mode=5893 16776574 100 94 5184685 35206103 0 0
# scanned=157558
# found=0
# cleaned=0
# scan_time=3243

Results of screen317's Security Check version 0.99.71
x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Emsisoft Anti-Malware
Windows Defender
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Adobe Reader XI
Mozilla Firefox (22.0)
Mozilla Thunderbird (17.0.7)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Emsisoft Anti-Malware a2service.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013

Ran by Shandy (administrator) on 05-08-2013 12:57:26

Running from C:\Users\Shandy\Downloads

Windows 8 Pro (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe

(SMSC) C:\Program Files\SGFX\sgfxmgr.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

() C:\Program Files\SGFX\SgfxConfig.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Windows\system32\prevhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2013-04-24] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1664000 2000-01-01] (IDT, Inc.)

HKCU\...\Run: [Spotify] - C:\Users\Shandy\AppData\Roaming\Spotify\Spotify.exe [4640768 2013-07-09] (Spotify Ltd)

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Shandy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-09] (Spotify Ltd)

HKCU\...\Run: [DriverTurbo] - C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6775400 2012-05-15] ()

MountPoints2: {d11f80aa-cdfe-11e2-be66-806e6f6e6963} - "G:\LaunchU3.exe" -a

HKLM-x32\...\Run: [BtTray] - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [371976 2012-09-19] (IVT Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-21] (Intel Corporation)

HKLM-x32\...\Run: [SgfxConfig] - C:\Program Files\SGFX\sgfxconfig.exe [2233592 2013-03-18] ()

HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [2928040 2013-07-02] (Emsisoft GmbH)

Startup: C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/

SearchScopes: HKLM - DefaultScope value is missing.

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1261.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default

FF Homepage: www.google.de

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @acestream.net/acestreamplugin,version=2.0.13.1 - C:\Users\Shandy\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies)

FF Extension: HP Detect - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: No Name - C:\Users\Shandy\AppData\Roaming\Mozilla\Firefox\Profiles\se08g1e6.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKCU\...\Firefox\Extensions: [magicplayer@torrentstream.org] C:\Users\Shandy\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org

FF Extension: TS Magic Player - C:\Users\Shandy\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org
 

==================== Services (Whitelisted) =================
 

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2938408 2013-07-02] (Emsisoft GmbH)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)

R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1612552 2012-09-26] (IVT Corporation)

R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [146184 2012-09-19] (IVT Corporation)

S2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [38712 2013-01-10] (Hewlett-Packard)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)

R2 SGFXMgr; C:\Program Files\SGFX\sgfxmgr.exe [8481280 2013-03-15] (SMSC)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)

R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)

R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)

R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)

R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)

R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)

R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-06-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-06-05] (Avira Operations GmbH & Co. KG)

R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)

U4 BthHFEnum; 

R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-08-03] (Emsisoft GmbH)

R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-08-03] (Emsisoft GmbH)

S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-04] (Realtek Semiconductor Corp.)

R4 sgfxk; C:\Windows\System32\drivers\sgfxk64.sys [157432 2013-03-18] (SMSC)

R0 sgfxl; C:\Windows\System32\drivers\sgfxl64.sys [18168 2013-03-18] (SMSC)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-24] (Synaptics Incorporated)

S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-06-28] ()

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-05 11:56 - 2013-08-05 11:56 - 02347384 _____ (ESET) C:\Users\Shandy\Downloads\esetsmartinstaller_enu.exe

2013-08-05 11:56 - 2013-08-05 11:56 - 00000000 ____D C:\Program Files (x86)\ESET

2013-08-04 13:36 - 2013-08-04 13:36 - 00000749 _____ C:\Users\Shandy\Desktop\JRT.txt

2013-08-04 13:29 - 2013-08-04 13:29 - 00561889 _____ (Oleg N. Scherbakov) C:\Users\Shandy\Downloads\JRT.exe

2013-08-04 13:29 - 2013-08-04 13:29 - 00000000 ____D C:\Windows\ERUNT

2013-08-04 13:22 - 2013-08-04 13:22 - 00000957 _____ C:\AdwCleaner[S1].txt

2013-08-04 13:21 - 2013-08-04 13:21 - 00666633 _____ C:\Users\Shandy\Downloads\adwcleaner.exe

2013-08-03 17:46 - 2013-08-03 17:46 - 00028356 _____ C:\Users\Shandy\Downloads\Addition.txt

2013-08-03 17:45 - 2013-08-03 17:45 - 00000000 ____D C:\FRST

2013-08-03 17:44 - 2013-08-03 17:44 - 01781485 _____ (Farbar) C:\Users\Shandy\Downloads\FRST64.exe

2013-08-03 14:52 - 2013-08-03 15:46 - 798478207 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(2).flv

2013-08-03 14:42 - 2013-08-03 14:42 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Shandy\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-03 14:41 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-03 14:38 - 2013-08-05 12:49 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:38 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2013-08-03 14:38 - 2013-08-03 14:38 - 00000000 ____D C:\Users\Shandy\Documents\Anti-Malware

2013-08-03 14:36 - 2013-08-03 14:38 - 190490568 _____ (Emsisoft GmbH                                               ) C:\Users\Shandy\Downloads\EmsisoftAntiMalwareSetup_8.0.exe

2013-08-03 14:34 - 2013-08-03 14:34 - 00003444 _____ C:\Users\Shandy\Desktop\Ereignisse.txt

2013-08-03 14:30 - 2013-08-03 14:30 - 00020740 _____ C:\Users\Shandy\Downloads\BAR_SAN_2H_08022013.flv.html

2013-08-03 14:07 - 2013-08-03 14:25 - 269893632 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv.part

2013-08-03 14:07 - 2013-08-03 14:07 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv

2013-08-03 13:18 - 2013-08-03 13:56 - 562626560 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv.part

2013-08-03 13:18 - 2013-08-03 13:18 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv

2013-08-03 12:38 - 2013-08-03 13:01 - 00010565 _____ C:\Users\Shandy\Downloads\hijackthis.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000795 _____ C:\Windows\setupact.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000000 _____ C:\Windows\setuperr.log

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\GRETECH

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Program Files (x86)\GRETECH

2013-08-03 10:39 - 2013-08-03 11:25 - 865199442 _____ C:\Users\Shandy\Downloads\BAR SAN 1H 08022013.flv

2013-07-30 15:22 - 2013-07-30 15:22 - 00062388 _____ C:\Users\Shandy\Downloads\media(1).xav

2013-07-30 15:22 - 2013-07-30 15:22 - 00062379 _____ C:\Users\Shandy\Downloads\media(2).xav

2013-07-30 15:21 - 2013-07-30 15:21 - 00062387 _____ C:\Users\Shandy\Downloads\media.xav

2013-07-30 13:02 - 2013-07-30 13:02 - 00000307 _____ C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuletzt besucht.lnk

2013-07-27 13:34 - 2013-07-27 13:34 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-07-27 13:00 - 2013-08-01 13:16 - 00029516 _____ C:\Users\Shandy\Downloads\HA M13 endgültig - Kopie.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00089557 _____ C:\Users\Shandy\Downloads\HA M13 endgültig.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\OpenOffice

2013-07-25 17:44 - 2013-07-25 17:44 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk

2013-07-25 17:43 - 2013-07-25 17:43 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4

2013-07-25 17:30 - 2013-07-25 17:40 - 00000000 ____D C:\Users\Shandy\Downloads\fh

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Program Files\Unlocker

2013-07-25 15:11 - 2013-07-29 18:47 - 00000000 ____D C:\Users\Shandy\Desktop\Modul13

2013-07-24 13:35 - 2013-07-24 15:53 - 00000000 ____D C:\Users\Shandy\Documents\do

2013-07-23 21:34 - 2013-07-23 21:35 - 00000000 ____D C:\Windows\system32\MRT

2013-07-21 11:14 - 2013-08-04 13:25 - 00307760 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-18 16:59 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-18 16:58 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-18 16:58 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-18 16:58 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-18 16:58 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-18 16:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-18 16:57 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-18 16:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-18 16:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-18 16:57 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-18 16:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-18 16:56 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-18 16:56 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-17 09:18 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2013-07-17 09:18 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys

2013-07-17 09:18 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys

2013-07-17 09:18 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe

2013-07-17 09:18 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-07-17 09:18 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS

2013-07-17 09:18 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS

2013-07-17 09:18 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-07-17 09:18 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys

2013-07-17 09:18 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

2013-07-17 09:18 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll

2013-07-17 09:18 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll

2013-07-17 09:18 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll

2013-07-17 09:18 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2013-07-17 09:18 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe

2013-07-17 09:18 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll

2013-07-17 09:18 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe

2013-07-17 09:18 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll

2013-07-17 09:18 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll

2013-07-17 09:18 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll

2013-07-17 09:18 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2013-07-17 09:18 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll

2013-07-17 09:18 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys

2013-07-17 09:18 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2013-07-17 09:18 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2013-07-17 09:18 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2013-07-17 09:18 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2013-07-17 09:18 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml

2013-07-16 21:47 - 2013-08-04 13:24 - 00002382 _____ C:\Windows\PFRO.log

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Canneverbe Limited

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\ProgramData\Canneverbe Limited

2013-07-08 15:50 - 2013-07-08 15:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP

193
 

==================== One Month Modified Files and Folders =======
 

2013-08-05 12:55 - 2013-08-05 12:55 - 00891098 _____ C:\Users\Shandy\Downloads\SecurityCheck.exe

2013-08-05 12:55 - 2013-06-05 20:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-05 12:49 - 2013-08-03 14:38 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2013-08-05 12:25 - 2013-07-01 02:52 - 01402690 _____ C:\Windows\WindowsUpdate.log

2013-08-05 12:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru

2013-08-05 11:56 - 2013-08-05 11:56 - 02347384 _____ (ESET) C:\Users\Shandy\Downloads\esetsmartinstaller_enu.exe

2013-08-05 11:56 - 2013-08-05 11:56 - 00000000 ____D C:\Program Files (x86)\ESET

2013-08-04 20:27 - 2013-06-06 17:26 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\.ACEStream

2013-08-04 13:56 - 2012-07-26 12:27 - 00754172 _____ C:\Windows\system32\perfh007.dat

2013-08-04 13:56 - 2012-07-26 12:27 - 00156362 _____ C:\Windows\system32\perfc007.dat

2013-08-04 13:56 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-04 13:51 - 2012-09-26 09:53 - 00000932 _____ C:\Windows\SysWOW64\bscs.ini

2013-08-04 13:51 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-04 13:50 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI

2013-08-04 13:36 - 2013-08-04 13:36 - 00000749 _____ C:\Users\Shandy\Desktop\JRT.txt

2013-08-04 13:29 - 2013-08-04 13:29 - 00561889 _____ (Oleg N. Scherbakov) C:\Users\Shandy\Downloads\JRT.exe

2013-08-04 13:29 - 2013-08-04 13:29 - 00000000 ____D C:\Windows\ERUNT

2013-08-04 13:25 - 2013-07-21 11:14 - 00307760 _____ C:\Windows\system32\FNTCACHE.DAT

2013-08-04 13:24 - 2013-07-16 21:47 - 00002382 _____ C:\Windows\PFRO.log

2013-08-04 13:22 - 2013-08-04 13:22 - 00000957 _____ C:\AdwCleaner[S1].txt

2013-08-04 13:21 - 2013-08-04 13:21 - 00666633 _____ C:\Users\Shandy\Downloads\adwcleaner.exe

2013-08-03 17:46 - 2013-08-03 17:46 - 00028356 _____ C:\Users\Shandy\Downloads\Addition.txt

2013-08-03 17:45 - 2013-08-03 17:45 - 00000000 ____D C:\FRST

2013-08-03 17:44 - 2013-08-03 17:44 - 01781485 _____ (Farbar) C:\Users\Shandy\Downloads\FRST64.exe

2013-08-03 15:46 - 2013-08-03 14:52 - 798478207 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(2).flv

2013-08-03 14:42 - 2013-08-03 14:42 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Shandy\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-03 14:41 - 2013-08-03 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:38 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2013-08-03 14:38 - 2013-08-03 14:38 - 00000000 ____D C:\Users\Shandy\Documents\Anti-Malware

2013-08-03 14:38 - 2013-08-03 14:36 - 190490568 _____ (Emsisoft GmbH                                               ) C:\Users\Shandy\Downloads\EmsisoftAntiMalwareSetup_8.0.exe

2013-08-03 14:34 - 2013-08-03 14:34 - 00003444 _____ C:\Users\Shandy\Desktop\Ereignisse.txt

2013-08-03 14:30 - 2013-08-03 14:30 - 00020740 _____ C:\Users\Shandy\Downloads\BAR_SAN_2H_08022013.flv.html

2013-08-03 14:25 - 2013-08-03 14:07 - 269893632 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv.part

2013-08-03 14:07 - 2013-08-03 14:07 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013(1).flv

2013-08-03 13:56 - 2013-08-03 13:18 - 562626560 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv.part

2013-08-03 13:18 - 2013-08-03 13:18 - 00000000 _____ C:\Users\Shandy\Downloads\BAR SAN 2H 08022013.flv

2013-08-03 13:01 - 2013-08-03 12:38 - 00010565 _____ C:\Users\Shandy\Downloads\hijackthis.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000795 _____ C:\Windows\setupact.log

2013-08-03 12:21 - 2013-08-03 12:21 - 00000000 _____ C:\Windows\setuperr.log

2013-08-03 11:34 - 2013-06-15 21:29 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\vlc

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\GRETECH

2013-08-03 11:33 - 2013-08-03 11:33 - 00000000 ____D C:\Program Files (x86)\GRETECH

2013-08-03 11:25 - 2013-08-03 10:39 - 865199442 _____ C:\Users\Shandy\Downloads\BAR SAN 1H 08022013.flv

2013-08-02 17:46 - 2013-06-05 23:20 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Spotify

2013-08-02 16:33 - 2013-06-08 19:55 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-08-02 16:33 - 2013-06-08 19:55 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-08-01 13:16 - 2013-07-27 13:00 - 00029516 _____ C:\Users\Shandy\Downloads\HA M13 endgültig - Kopie.odt

2013-07-30 15:22 - 2013-07-30 15:22 - 00062388 _____ C:\Users\Shandy\Downloads\media(1).xav

2013-07-30 15:22 - 2013-07-30 15:22 - 00062379 _____ C:\Users\Shandy\Downloads\media(2).xav

2013-07-30 15:21 - 2013-07-30 15:21 - 00062387 _____ C:\Users\Shandy\Downloads\media.xav

2013-07-30 13:02 - 2013-07-30 13:02 - 00000307 _____ C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuletzt besucht.lnk

2013-07-29 18:47 - 2013-07-25 15:11 - 00000000 ____D C:\Users\Shandy\Desktop\Modul13

2013-07-27 16:24 - 2013-06-05 18:46 - 00000000 ____D C:\Users\Shandy

2013-07-27 13:37 - 2013-06-05 20:12 - 00000000 ____D C:\Users\Shandy\AppData\Local\Adobe

2013-07-27 13:34 - 2013-07-27 13:34 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-07-27 13:34 - 2013-06-05 23:37 - 00000000 ____D C:\ProgramData\Adobe

2013-07-27 10:35 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2013-07-26 13:33 - 2013-07-26 13:33 - 00089557 _____ C:\Users\Shandy\Downloads\HA M13 endgültig.odt

2013-07-26 13:33 - 2013-07-26 13:33 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\OpenOffice

2013-07-26 12:57 - 2013-06-05 18:52 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2511654649-832228088-3128315156-1001

2013-07-25 17:44 - 2013-07-25 17:44 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk

2013-07-25 17:43 - 2013-07-25 17:43 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4

2013-07-25 17:40 - 2013-07-25 17:30 - 00000000 ____D C:\Users\Shandy\Downloads\fh

2013-07-25 17:38 - 2013-06-05 18:46 - 00000000 ____D C:\Users\Shandy\AppData\Local\Packages

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2013-07-25 17:28 - 2013-07-25 17:28 - 00000000 ____D C:\Program Files\Unlocker

2013-07-24 15:53 - 2013-07-24 13:35 - 00000000 ____D C:\Users\Shandy\Documents\do

2013-07-23 21:35 - 2013-07-23 21:34 - 00000000 ____D C:\Windows\system32\MRT

2013-07-19 00:09 - 2012-07-26 12:29 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-17 21:40 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe

2013-07-16 21:47 - 2013-06-05 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-16 21:46 - 2012-07-26 07:37 - 00000000 ____D C:\Windows\servicing

2013-07-11 16:23 - 2013-06-05 20:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-07-11 11:26 - 2013-06-30 16:18 - 00026967 _____ C:\Users\Shandy\Documents\modul18.odt

2013-07-09 17:26 - 2013-06-05 23:20 - 00000000 ____D C:\Users\Shandy\AppData\Local\Spotify

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\Users\Shandy\AppData\Roaming\Canneverbe Limited

2013-07-08 15:51 - 2013-07-08 15:51 - 00000000 ____D C:\ProgramData\Canneverbe Limited

2013-07-08 15:50 - 2013-07-08 15:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP

2013-07-06 14:45 - 2013-06-19 13:58 - 00000298 _____ C:\Users\Shandy\Documents\Neues Textdokument.txt
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-22 11:13
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Hab nochma Antivir drüber laufen lassen, mit ziemlich hohen Suchlauf einstellungen.

'SPR/LockFolder.A' [riskware]. gefunden, ich nehme an das kommt von dem Programm FolderAccess

Genau.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Mir ist nicht ganz klar was das jetzt mit dem
Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
bedeuten soll, da ich keines der beiden Programme verwendet habe. Soll ich eines der Programme noch nachträglich anwenden ? Heute morgen war mein PC sehr langsam aber laut dem LOG müsste alles OK sein oder ?

Wenn wir die nit benutzt haben weglassen und gleich Delfix laufen lassen :)

Mach den Rest der Anleitung inklusive Abschnitt Performance.

Super vielen vielen Dank !!!! Hab noch eine abschließende Frage. Habe jetzt nachdem ich DelFix und Spyware Blaster installiert habe 2x eine Datei "Desktop.ini" auf dem Desktop sowie in meinem Download Ordner, kann ich die löschen ??

Ahso und kannst du mir ein Treiber-Update Programm empfehlen ? Habe jetzt Driver Turbo, aber dass kann ich net Deinstallieren :(

Versuch das Deinstallieren mal mit Revo.
Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller

Die Desktop Dateien sind da weil Du versteckte Dateien anzeigen lässt, ändere das dann verschwinden die. Nicht löschen.

Programme für Treiber würde ich nicht nutzen.