Trojaner-Board - AppHang bei Windows Explorer und Word, vermutlich nach Druckerinstallation

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - AppHang bei Windows Explorer und Word, vermutlich nach Druckerinstallation (https://www.trojaner-board.de/141043-apphang-windows-explorer-word-vermutlich-druckerinstallation.html)

AppHang bei Windows Explorer und Word, vermutlich nach Druckerinstallation

Liebe Helfer!
Ich (kein Computerspezialist, einfach nur Anwender) habe folgendes Problem: seit einiger Zeit stürzt der Laptop (ein Dell Inspiron N5050 mit Windows 7 Home Premium 64-bit) ab, wenn ich den Windows Explorer starte bzw. beim ersten Versuch, einen Ordner oder Datei anzuklicken.
Nicht immer, aber öfter passiert dasselbe, wenn ich aus einem Office-Programm drucken möchte. Vor einiger Zeit habe ich einen Drucker installiert, der an einem anderen PC in einem manchmal verwendeten Netzwerk hängt, ein Samsung CLX 330. Er hat nur einmal die Testseite korrekt ausgedruckt, dann konnte ich nicht mehr über diesen Drucker drucken, weil der Laptop abstürzt (dh Bildschirm wird milchig weiß, nichts geht mehr, „keine Rückmeldung“. Ich habe versucht, den Drucker zu deinstallieren, geht auch nicht, weil ich ihn nicht auswählen kann, ohne dass der Laptop hängt.
Im Ereignisprotokoll kommt folgende Meldung:
Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: c60
Startzeit: 01cea4c1957e8cc3
Endzeit: 47
Anwendungspfad: C:\windows\Explorer.EXE
Berichts-ID: 0faf7129-10b5-11e3-bb10-64273768c763

Fehlerbucket 1907878655, Typ 5
Ereignisname: AppHangB1
Antwort: Nicht verfügbar
CAB-Datei-ID: 0

Problemsignatur:
P1: explorer.exe
P2: 6.1.7601.17567
P3: 4d672ee4
P4: 7b03
P5: 0
P6:
P7:
P8:
P9:
P10:

Weitere Fehlermeldungen:

1) Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert.
2) Unerwarteter Fehler. Fehlercode: D@01010004
3) Dem Computer wurde (vom DHCP-Server) keine Adresse aus dem Netzwerk für die Netzwerkkarte mit der Netzwerkadresse 0x64273768C763 zugewiesen. Fehler: 0x79. Der Computer versucht, weiterhin selbständig eine Adresse vom Netzwerkadressserver (DHCP-Server) abzurufen.
4) Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: b10
Startzeit: 01cea62726114840
Endzeit: 16
Anwendungspfad: C:\windows\Explorer.EXE
Berichts-ID: b31dfd69-121a-11e3-a206-24b6fd1d0888

und:

Fehlerbucket , Typ 0
Ereignisname: AppHangXProcB1
Antwort: Nicht verfügbar
CAB-Datei-ID: 0

Problemsignatur:
P1: explorer.exe
P2: 6.1.7601.17567
P3: 4d672ee4
P4: 52e8
P5: 128
P6: spoolsv.exe:spoolss
P7: 0.0.0.0
P8:
P9:
P10:

Angefügte Dateien:
C:\Users\Petersplatz\AppData\Local\Temp\WERB827.tmp.appcompat.txt
C:\Users\Petersplatz\AppData\Local\Temp\WERB847.tmp.WERInternalMetadata.xml

Diese Dateien befinden sich möglicherweise hier:
C:\Users\Petersplatz\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_explorer.exe_93fea527d39ce95b1379d1d2137f9a0bae5d5c1_10cecca1

Analysesymbol:
Es wird erneut nach einer Lösung gesucht: 0
Berichts-ID: b31dfd69-121a-11e3-a206-24b6fd1d0888
Berichtstatus: 1

Einige Male ist auch Word auf dieselbe Art und Weise abgestürzt, dabei kam folgende Fehlermeldung:

Protokollname: Application
Quelle: Application Hang
Datum: 31.08.2013 18:57:21
Ereignis-ID: 1002
Aufgabenkategorie101)
Ebene: Fehler
Schlüsselwörter:Klassisch
Benutzer: Nicht zutreffend
Computer: PpLaptop
Beschreibung:
Programm WINWORD.EXE, Version 14.0.6129.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: a40
Startzeit: 01cea65400e93738
Endzeit: 47
Anwendungspfad: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Berichts-ID: 4d488123-125e-11e3-a206-24b6fd1d0888

Ereignis-XML:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Hang" />
<EventID Qualifiers="0">1002</EventID>
<Level>2</Level>
<Task>101</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-08-31T16:57:21.000000000Z" />
<EventRecordID>23388</EventRecordID>
<Channel>Application</Channel>
<Computer>PpLaptop</Computer>
<Security />
</System>
<EventData>
<Data>WINWORD.EXE</Data>
<Data>14.0.6129.5000</Data>
<Data>a40</Data>
<Data>01cea65400e93738</Data>
<Data>47</Data>
<Data>C:\Program Files\Microsoft Office\Office14\WINWORD.EXE</Data>
<Data>4d488123-125e-11e3-a206-24b6fd1d0888</Data>
<Binary>55006E006B006E006F0077006E0000000000</Binary>
</EventData>
</Event>

Ich habe die Scans lt. Anleitung gemacht und hänge die Dateien an.

Ich habe auch einen vollständigen Scan mit dem Antivirenprogramm (AVG 2013) gemacht, aber es gab keinerlei Bedrohungen ...

Vielen Dank für alle Hilfe!
Grüße, Biggy

hi,

Logs zur Not aufteilen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Sorry, hatte "anhängen" wörtlich genommen...

1)

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 12:41 on 05/09/2013 (Petersplatz)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

2)
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-09-2013

Ran by Petersplatz (administrator) on PPLAPTOP on 05-09-2013 12:45:01

Running from C:\Users\Petersplatz\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Microsoft Corporation) C:\windows\system32\WLANExt.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Dropbox, Inc.) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe

() C:\Program Files (x86)\AVG Secure Search\vprot.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Users\Petersplatz\Downloads\Defogger.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [608112 2011-03-29] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)

HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [3668336 2011-03-24] (Dell Inc.)

HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()

HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()

HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)

HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Launcher] - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [163040 2010-08-12] (Softthinks)

HKLM\...\Policies\Explorer: [NoActiveDesktop] 1

HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1

HKCU\...\Run: [GoogleChromeAutoLaunch_DC2C44A93382AC9B5634D9F68269EB5C] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [829392 2013-08-24] (Google Inc.)

HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)

HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()

HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()

HKLM-x32\...\Run: [AdobeCS4ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-14] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)

HKLM-x32\...\Run: [Adobe_ID0ENQBO] - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe [378224 2008-08-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2314416 2013-08-15] ()

HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

Startup: C:\Users\Petersplatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (Adobe Systems Incorporated.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (Adobe Systems Incorporated.)

Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll (AVG Secure Search)

Tcpip\Parameters: [DhcpNameServer] 192.168.10.1 217.15.0.1 217.15.0.2
 

FireFox:

========

FF ProfilePath: C:\Users\Petersplatz\AppData\Roaming\Mozilla\Firefox\Profiles\lv4h1kzg.default

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\\npsitesafety.dll (AVG Technologies)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK
 

Chrome: 

=======

CHR RestoreOnStartup: "hxxp://www.google.at/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 7.0.10.8) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U1) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Drive) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (AVG Secure Search) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.5.0.2_0

CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0

CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.172_0

CHR Extension: (Gmail) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\15.5.0.2\avg.crx

CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
 

==================== Services (Whitelisted) =================
 

S3 Adobe Version Cue CS4; C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [284016 2008-08-15] (Adobe Systems Incorporated)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)

S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2013-06-13] ()

R2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [1643184 2013-08-15] (AVG Secure Search)
 

==================== Drivers (Whitelisted) ====================
 

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\windows\system32\drivers\avgtpx64.sys [45856 2013-08-15] (AVG Technologies)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-05 12:43 - 2013-09-05 12:43 - 01947160 _____ (Farbar) C:\Users\Petersplatz\Desktop\FRST64.exe

2013-09-05 12:43 - 2013-09-05 12:43 - 00000765 _____ C:\Users\Petersplatz\Desktop\defogger_disable - Verknüpfung.lnk

2013-09-05 12:43 - 2013-09-05 12:43 - 00000725 _____ C:\Users\Petersplatz\Desktop\Defogger - Verknüpfung.lnk

2013-09-05 12:41 - 2013-09-05 12:41 - 00000484 _____ C:\Users\Petersplatz\Downloads\defogger_disable.log

2013-09-05 12:41 - 2013-09-05 12:41 - 00000000 _____ C:\Users\Petersplatz\defogger_reenable

2013-09-05 10:55 - 2013-09-05 10:55 - 00050477 _____ C:\Users\Petersplatz\Downloads\Defogger.exe

2013-09-01 10:24 - 2013-09-01 10:24 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309 (1).zip

2013-08-29 10:33 - 2013-08-29 10:33 - 00515927 _____ C:\Users\Petersplatz\Downloads\Messzettel1309.zip

2013-08-29 10:30 - 2013-08-29 10:31 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309.zip

2013-08-28 18:31 - 2013-08-28 18:31 - 01528184 _____ (Microsoft Corporation) C:\Users\Petersplatz\Downloads\GenuineCheck.exe

2013-08-28 18:12 - 2013-08-29 14:55 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Systweak

2013-08-28 18:12 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe

2013-08-28 18:11 - 2013-08-28 18:11 - 05541392 _____ (Systweak Inc                                                ) C:\Users\Petersplatz\Downloads\rcpsetup_2005_file.net_ab_DE-iCh.exe

2013-08-28 14:32 - 2013-09-01 10:25 - 01335639 _____ C:\Users\Petersplatz\Desktop\Messbuch 1309.epub

2013-08-15 03:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-08-15 03:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-08-15 03:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-08-15 03:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-08-15 03:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-08-15 03:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-08-15 03:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-08-15 03:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-08-15 03:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-08-15 03:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-08-15 03:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-08-15 03:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-14 18:29 - 2013-08-14 18:29 - 00010908 _____ C:\Users\Petersplatz\Downloads\Budget2014 (1).xlsx

2013-08-14 14:25 - 2013-08-14 14:25 - 00011988 _____ C:\Users\Petersplatz\Downloads\Plan der Woche.xlsx

2013-08-14 12:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll

2013-08-14 12:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll

2013-08-14 12:55 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL

2013-08-14 12:55 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL

2013-08-14 12:55 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2013-08-14 12:55 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

2013-08-14 12:55 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2013-08-14 12:55 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

2013-08-14 12:54 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2013-08-14 12:54 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2013-08-14 12:54 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2013-08-14 12:54 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2013-08-14 12:54 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2013-08-14 12:54 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2013-08-14 12:54 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2013-08-14 12:54 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2013-08-14 12:54 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2013-08-14 12:54 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2013-08-14 12:54 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2013-08-14 12:54 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2013-08-14 12:54 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys

2013-08-13 18:51 - 2013-08-13 18:51 - 00014753 _____ C:\Users\Petersplatz\Downloads\Aufgabenforum.xlsm

2013-08-13 18:50 - 2013-08-13 18:51 - 00023954 _____ C:\Users\Petersplatz\Downloads\Forum2013.xlsm

2013-08-12 14:22 - 2013-08-12 14:22 - 00001106 _____ C:\Users\Petersplatz\Downloads\url.htm

2013-08-12 12:11 - 2013-08-12 12:14 - 00011696 _____ C:\Users\Petersplatz\Downloads\Budget2014.xlsx

2013-08-10 10:31 - 2013-08-10 10:35 - 37455597 _____ (A.I.SOFT,INC.) C:\Users\Petersplatz\Downloads\HL-2130-inst-B1-useu (1).EXE

2013-08-08 19:02 - 2013-08-08 19:02 - 00003132 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Retry
 

==================== One Month Modified Files and Folders =======
 

2013-09-05 12:44 - 2013-09-05 12:44 - 00000000 ____D C:\FRST

2013-09-05 12:43 - 2013-09-05 12:43 - 01947160 _____ (Farbar) C:\Users\Petersplatz\Desktop\FRST64.exe

2013-09-05 12:43 - 2013-09-05 12:43 - 00000765 _____ C:\Users\Petersplatz\Desktop\defogger_disable - Verknüpfung.lnk

2013-09-05 12:43 - 2013-09-05 12:43 - 00000725 _____ C:\Users\Petersplatz\Desktop\Defogger - Verknüpfung.lnk

2013-09-05 12:41 - 2013-09-05 12:41 - 00000484 _____ C:\Users\Petersplatz\Downloads\defogger_disable.log

2013-09-05 12:41 - 2013-09-05 12:41 - 00000000 _____ C:\Users\Petersplatz\defogger_reenable

2013-09-05 12:41 - 2013-01-04 12:10 - 00000000 ____D C:\Users\Petersplatz

2013-09-05 12:22 - 2013-02-24 10:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-09-05 12:14 - 2012-01-27 14:39 - 00696870 _____ C:\windows\system32\perfh007.dat

2013-09-05 12:14 - 2012-01-27 14:39 - 00148134 _____ C:\windows\system32\perfc007.dat

2013-09-05 12:14 - 2009-07-14 07:13 - 01612484 _____ C:\windows\system32\PerfStringBackup.INI

2013-09-05 12:12 - 2012-01-27 12:47 - 01652702 _____ C:\windows\WindowsUpdate.log

2013-09-05 12:11 - 2013-01-04 12:43 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-09-05 10:55 - 2013-09-05 10:55 - 00050477 _____ C:\Users\Petersplatz\Downloads\Defogger.exe

2013-09-05 10:42 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-05 10:42 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-05 10:39 - 2013-02-08 16:09 - 00000000 ____D C:\ProgramData\MFAData

2013-09-05 10:36 - 2013-01-08 12:44 - 00000000 ___RD C:\Users\Petersplatz\Dropbox

2013-09-05 10:36 - 2013-01-08 12:38 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Dropbox

2013-09-05 10:34 - 2013-01-04 12:43 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-09-05 10:34 - 2013-01-04 12:10 - 00000000 ____D C:\Users\PETERS~1\AppData\Local\SoftThinks

2013-09-05 10:34 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-09-05 10:34 - 2009-07-14 06:51 - 00074784 _____ C:\windows\setupact.log

2013-09-03 18:06 - 2012-01-27 13:16 - 00000000 ____D C:\ProgramData\Sonic

2013-09-02 17:46 - 2013-03-22 20:43 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\vlc

2013-09-01 20:20 - 2013-01-04 20:47 - 00000000 ____D C:\Users\Petersplatz\Documents\Petersplatz Haus

2013-09-01 20:02 - 2012-01-27 13:31 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-09-01 10:25 - 2013-08-28 14:32 - 01335639 _____ C:\Users\Petersplatz\Desktop\Messbuch 1309.epub

2013-09-01 10:24 - 2013-09-01 10:24 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309 (1).zip

2013-08-31 10:44 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-08-31 10:37 - 2013-05-01 15:50 - 00000375 _____ C:\windows\system32\Drivers\etc\hosts.ics

2013-08-29 16:10 - 2010-11-21 05:47 - 00034714 _____ C:\windows\PFRO.log

2013-08-29 14:57 - 2012-01-27 13:21 - 00000000 ____D C:\ProgramData\WildTangent

2013-08-29 14:55 - 2013-08-28 18:12 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Systweak

2013-08-29 10:33 - 2013-08-29 10:33 - 00515927 _____ C:\Users\Petersplatz\Downloads\Messzettel1309.zip

2013-08-29 10:31 - 2013-08-29 10:30 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309.zip

2013-08-28 18:33 - 2013-06-07 20:25 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-28 18:31 - 2013-08-28 18:31 - 01528184 _____ (Microsoft Corporation) C:\Users\Petersplatz\Downloads\GenuineCheck.exe

2013-08-28 18:11 - 2013-08-28 18:11 - 05541392 _____ (Systweak Inc                                                ) C:\Users\Petersplatz\Downloads\rcpsetup_2005_file.net_ab_DE-iCh.exe

2013-08-28 15:44 - 2013-08-04 18:02 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\dvdcss

2013-08-28 14:44 - 2013-05-22 15:50 - 00003440 _____ C:\windows\System32\Tasks\PCDEventLauncherTask

2013-08-27 18:12 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF

2013-08-24 17:17 - 2012-01-27 13:17 - 00000000 ____D C:\ProgramData\Nero

2013-08-24 17:17 - 2012-01-27 13:17 - 00000000 ____D C:\Program Files (x86)\Nero

2013-08-23 16:07 - 2013-01-04 12:30 - 00000000 ____D C:\Users\PETERS~1\AppData\Local\Nero

2013-08-22 20:58 - 2013-02-24 10:38 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-08-22 20:58 - 2013-02-24 10:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-08-22 20:58 - 2012-01-27 12:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-22 18:36 - 2013-08-28 18:12 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe

2013-08-16 10:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache

2013-08-15 14:25 - 2013-02-08 16:14 - 00045856 _____ (AVG Technologies) C:\windows\system32\Drivers\avgtpx64.sys

2013-08-15 14:25 - 2013-02-08 16:14 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search

2013-08-15 03:05 - 2013-07-25 20:49 - 00000000 ____D C:\windows\system32\MRT

2013-08-15 03:02 - 2013-01-04 13:42 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-08-14 18:29 - 2013-08-14 18:29 - 00010908 _____ C:\Users\Petersplatz\Downloads\Budget2014 (1).xlsx

2013-08-14 14:25 - 2013-08-14 14:25 - 00011988 _____ C:\Users\Petersplatz\Downloads\Plan der Woche.xlsx

2013-08-13 18:51 - 2013-08-13 18:51 - 00014753 _____ C:\Users\Petersplatz\Downloads\Aufgabenforum.xlsm

2013-08-13 18:51 - 2013-08-13 18:50 - 00023954 _____ C:\Users\Petersplatz\Downloads\Forum2013.xlsm

2013-08-12 14:22 - 2013-08-12 14:22 - 00001106 _____ C:\Users\Petersplatz\Downloads\url.htm

2013-08-12 12:14 - 2013-08-12 12:11 - 00011696 _____ C:\Users\Petersplatz\Downloads\Budget2014.xlsx

2013-08-10 15:13 - 2013-05-11 16:14 - 03207168 _____ C:\Users\Petersplatz\Desktop\Aktuelle Filmliste.xls

2013-08-10 10:35 - 2013-08-10 10:31 - 37455597 _____ (A.I.SOFT,INC.) C:\Users\Petersplatz\Downloads\HL-2130-inst-B1-useu (1).EXE

2013-08-08 19:02 - 2013-08-08 19:02 - 00003132 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Retry
 

Files to move or delete:

====================

C:\Users\PETERS~1\AppData\Local\Temp\jna2282236172047180976.dll

C:\Users\PETERS~1\AppData\Local\Temp\{3D5AD9C7-EC19-4412-9C45-37F1F7B39E20}\{E2A97415-BD97-4867-B906-05E39E9EE51F}\difxapi.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_f6fa8d54-e0cd-4151-8ce0-3b81c4f3e653\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_f6fa8d54-e0cd-4151-8ce0-3b81c4f3e653\UpdatePrinterDriver.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_8c599cb5-0260-41a4-80c3-98962b18ee83\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_71813271-f82a-4be0-b379-d33d2fe3588d\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_65409e00-5a65-4f40-a4fa-640ebc468d46\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_65409e00-5a65-4f40-a4fa-640ebc468d46\UpdatePrinterDriver.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_55338015-dd51-4121-8ed5-4f9059b4f63f\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_419f4ee8-aa3e-4535-9f00-b8030fd1eac3\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\SDIAG_2ad0926b-1978-4933-a236-69abdc70aaac\DiagPackage.dll

C:\Users\PETERS~1\AppData\Local\Temp\nstD0D7.tmp\DropboxNSISTools.dll

C:\Users\PETERS~1\AppData\Local\Temp\nstD0D7.tmp\UAC.dll

C:\Users\PETERS~1\AppData\Local\Temp\776D.tmp\osppc.dll

C:\Users\PETERS~1\AppData\Local\Temp\776D.tmp\ospprearm.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 20:41
 

==================== End Of Log ============================

--- --- ---

3)

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-09-2013

Ran by Petersplatz at 2013-09-05 12:45:51

Running from C:\Users\Petersplatz\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

 2013 (Version: 2013.0.3392)

7-Zip 9.20 (x32)

Acrobat.com (x32 Version: 0.0.0)

Acrobat.com (x32 Version: 1.2.443)

Adobe Acrobat 9 Pro - English, Français, Deutsch (x32 Version: 9.5.5)

Adobe Acrobat 9.5.5 - CPSID_83708 (x32)

Adobe After Effects CS4 (x32 Version: 9)

Adobe After Effects CS4 Presets (x32 Version: 9)

Adobe After Effects CS4 Third Party Content (x32 Version: 9)

Adobe AIR (x32 Version: 2.6.0.19120)

Adobe Anchor Service CS4 (x32 Version: 2.0)

Adobe Anchor Service x64 CS4 (Version: 2.0)

Adobe Asset Services CS4 (x32 Version: 4)

Adobe Bridge CS4 (x32 Version: 3)

Adobe CMaps CS4 (x32 Version: 2.0)

Adobe CMaps x64 CS4 (Version: 2.0)

Adobe Color - Photoshop Specific CS4 (x32 Version: 2.0)

Adobe Color EU Recommended Settings CS4 (x32 Version: 2.0)

Adobe Color JA Extra Settings CS4 (x32 Version: 2.0)

Adobe Color NA Extra Settings CS4 (x32 Version: 2.0)

Adobe Color Video Profiles AE CS4 (x32 Version: 2.0)

Adobe Color Video Profiles CS CS4 (x32 Version: 2.0)

Adobe Contribute CS4 (x32 Version: 5.0)

Adobe Creative Suite 4 Master Collection (x32 Version: 4.0)

Adobe CS4 American English Speech Analysis Models (x32 Version: 1)

Adobe CSI CS4 (x32 Version: 1)

Adobe CSI CS4 x64 (Version: 1)

Adobe Default Language CS4 (x32 Version: 2.0)

Adobe Device Central CS4 (x32 Version: 2)

Adobe Dreamweaver CS4 (x32 Version: 10.0)

Adobe Drive CS4 (x32 Version: 1)

Adobe Drive CS4 x64 (Version: 1)

Adobe Dynamiclink Support (x32 Version: 1)

Adobe Encore CS4 (x32 Version: 4)

Adobe Encore CS4 Codecs (x32 Version: 4)

Adobe ExtendScript Toolkit CS4 (x32 Version: 3.0.0)

Adobe Extension Manager CS4 (x32 Version: 2.0)

Adobe Fireworks CS4 (x32 Version: 10.0)

Adobe Flash CS4 (x32 Version: 10.0)

Adobe Flash CS4 Extension - Flash Lite STI others (x32 Version: 3.0)

Adobe Flash CS4 STI-other (x32 Version: 10.0)

Adobe Flash Player 10 Plugin (x32 Version: 10.0.2.54)

Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)

Adobe Fonts All (x32 Version: 2.0)

Adobe Fonts All x64 (Version: 2.0)

Adobe Illustrator CS4 (x32 Version: 14.0)

Adobe InDesign CS4 (x32 Version: 6.0)

Adobe InDesign CS4 Application Feature Set Files (Roman) (x32 Version: 6.0)

Adobe InDesign CS4 Common Base Files (x32 Version: 6.0)

Adobe InDesign CS4 Icon Handler (x32 Version: 6.0)

Adobe InDesign CS4 Icon Handler x64 (Version: 6.0)

Adobe Linguistics CS4 (x32 Version: 4.0.0)

Adobe Linguistics CS4 x64 (Version: 4.0.0)

Adobe Media Encoder CS4 (x32 Version: 1.0)

Adobe Media Encoder CS4 Additional Exporter (x32 Version: 1.0)

Adobe Media Encoder CS4 Dolby (x32 Version: 1.0)

Adobe Media Encoder CS4 Exporter (x32 Version: 1.0)

Adobe Media Encoder CS4 Importer (x32 Version: 1.0)

Adobe Media Player (x32 Version: 0.0.0)

Adobe Media Player (x32 Version: 1.1)

Adobe MotionPicture Color Files CS4 (x32 Version: 2.0)

Adobe OnLocation CS4 (x32 Version: 4)

Adobe Output Module (x32 Version: 2.0)

Adobe PDF Library Files CS4 (x32 Version: 9.0)

Adobe PDF Library Files x64 CS4 (Version: 9.0)

Adobe Photoshop CS4 (64 Bit) (Version: 11.0)

Adobe Photoshop CS4 (x32 Version: 11.0)

Adobe Photoshop CS4 Support (x32 Version: 11.0)

Adobe Premiere Pro CS4 (x32 Version: 4)

Adobe Premiere Pro CS4 Functional Content (x32 Version: 4)

Adobe Premiere Pro CS4 Third Party Content (x32 Version: 4)

Adobe Reader X (10.1.6) MUI (x32 Version: 10.1.6)

Adobe Search for Help (x32 Version: 1.0)

Adobe Service Manager Extension (x32 Version: 1.0)

Adobe Setup (x32 Version: 2.0)

Adobe SGM CS4 (x32 Version: 3.0)

Adobe SING CS4 (x32 Version: 2.0)

Adobe Soundbooth CS4 (x32 Version: 2)

Adobe Soundbooth CS4 Codecs (x32 Version: 2)

Adobe Type Support CS4 (x32 Version: 9.0)

Adobe Type Support x64 CS4 (Version: 9.0)

Adobe Update Manager CS4 (x32 Version: 6.0.0)

Adobe Version Cue CS4 Server (x32 Version: 4.0)

Adobe WinSoft Linguistics Plugin (x32 Version: 1.1)

Adobe WinSoft Linguistics Plugin x64 (Version: 1.1)

Adobe XMP Panels CS4 (x32 Version: 2.0)

AdobeColorCommonSetCMYK (x32 Version: 2.0)

AdobeColorCommonSetRGB (x32 Version: 2.0)

Advanced Audio FX Engine (x32 Version: 1.12.05)

AVG 2013 (Version: 13.0.3222)

AVG 2013 (Version: 13.0.3392)

AVG Security Toolbar (x32 Version: 15.5.0.2)

Connect (x32 Version: 1.0.0.1)

D3DX10 (x32 Version: 15.4.2368.0902)

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

Dell DataSafe Local Backup - Support Software (x32)

Dell DataSafe Local Backup (x32 Version: 9.4.47)

Dell Edoc Viewer (Version: 1.0.0)

Dell Getting Started Guide (x32 Version: 1.00.0000)

Dell MusicStage (x32 Version: 1.5.201.0)

Dell PhotoStage (x32 Version: 1.5.0.65)

Dell Stage (x32 Version: 1.7.209.0)

Dell Stage Remote (x32 Version: 2.0.0.43)

Dell Touchpad (Version: 7.1207.101.225)

Dell VideoStage  (x32 Version: 1.2.0.1712)

Dell Webcam Central (x32 Version: 2.00.44)

DirectX 9 Runtime (x32 Version: 1.00.0000)

DivX-Setup (x32 Version: 2.6.1.24)

Dropbox (HKCU Version: 2.0.22)

DW WLAN Card (Version: 5.100.82.88)

eBay (x32 Version: 1.4.0)

ELBA5 (C:\Program Files (x86)\ELBA5) (x32 Version: 5.4.1.0)

Free Video Converter V 3.1 (x32 Version: 3.1.0.0)

Free YouTube Download version 3.2.0.128 (x32 Version: 3.2.0.128)

Google Apps Migration For Microsoft Outlook® 2.3.12.34 (x32 Version: 2.3.12.34)

Google Apps Sync™ for Microsoft Outlook® 3.2.353.947 (x32 Version: 3.2.353.947)

Google Chrome (x32 Version: 29.0.1547.66)

Google Update Helper (x32 Version: 1.3.21.153)

HL-2130 (x32 Version: 1.0.7.0)

IDT Audio (x32 Version: 1.0.6341.0)

Intel(R) Control Center (x32 Version: 1.2.1.1007)

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2342)

Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)

iSilo (x32 Version: 5.10.21)

Java 7 Update 21 (x32 Version: 7.0.210)

Java Auto Updater (x32 Version: 2.1.9.5)

Java(TM) 7 Update 1 (64-bit) (Version: 7.0.10)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

kuler (x32 Version: 2.0)

Mesh Runtime (x32 Version: 15.4.5722.2)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)

Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)

Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000)

Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox 19.0.2 (x86 de) (x32 Version: 19.0.2)

Mozilla Maintenance Service (x32 Version: 19.0.2)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

My Dell (Version: 3.3.6280.92)

PDF Settings CS4 (x32 Version: 9.0)

Photoshop Camera Raw (x32 Version: 5.0)

Photoshop Camera Raw_x64 (Version: 5.0)

PhotoShowExpress (x32 Version: 2.0.063)

Pixel Bender Toolkit (x32 Version: 1.0)

Quickset64 (Version: 10.09.25)

RBVirtualFolder64Inst (Version: 1.00.0000)

Realtek Ethernet Controller Driver (x32 Version: 7.45.516.2011)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30126)

Roxio Activation Module (x32 Version: 1.0)

Roxio BackOnTrack (x32 Version: 1.3.3)

Roxio Burn (x32 Version: 1.8)

Roxio Creator Starter (x32 Version: 1.0.439)

Roxio Creator Starter (x32 Version: 12.1.77.0)

Roxio Creator Starter (x32 Version: 5.0.0)

Roxio Express Labeler 3 (x32 Version: 3.2.2)

Roxio File Backup (Version: 1.3.2)

Shared C Run-time for x64 (Version: 10.0.0)

Skype™ 5.10 (x32 Version: 5.10.116)

Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)

Suite Shared Configuration CS4 (x32 Version: 1.0)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553378) 64-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition

Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition

Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition

Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2597090) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2598240) 64-Bit Edition

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)

Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)

VLC media player 2.0.5 (x32 Version: 2.0.5)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3508.1109)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3508.1109)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Mesh (x32 Version: 15.4.3502.0922)

Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)

Windows Live Messenger (x32 Version: 15.4.3502.0922)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

Windows Mobile-Gerätecenter (Version: 6.1.6965.0)

Zinio Reader 4 (x32 Version: 4.2.4164)
 

==================== Restore Points  =========================
 

02-08-2013 17:50:39 Geplanter Prüfpunkt

10-08-2013 12:54:25 Geplanter Prüfpunkt

15-08-2013 01:01:03 Windows Update

24-08-2013 15:15:22 Removed SyncUP.

28-08-2013 16:15:59 RegClean Pro Mi, Aug 28, 13  18:15

28-08-2013 16:32:28 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started

Task: {45BD0002-38EE-4897-A458-2580AC2670AE} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)

Task: {485BC70C-A13D-40F6-970C-3F9EED5653F8} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe

Task: {550CE1BD-08AA-42E0-B52A-644224FE98B6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-04] (Google Inc.)

Task: {57A4601C-616A-4D76-930C-3AF2F85776CE} - System32\Tasks\PCDoctorBackgroundMonitorTask-Retry => C:\Program Files\My Dell\uaclauncher.exe [2013-05-07] (PC-Doctor, Inc.)

Task: {6244938C-397A-40BB-B7BF-CF3B54A960A8} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-21] (Microsoft Corporation)

Task: {7C0F1747-4BC1-4F64-89C2-05F7E7BE3BB8} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {8F50FB0F-5C4C-4E5C-A68F-720EAF36DE01} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-07-18] (PC-Doctor, Inc.)

Task: {A04700EB-16FE-424B-916A-E2B2B5E8065D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-04] (Google Inc.)

Task: {A5BC6CD7-CE17-4115-81B1-1CFCCF5C8EA7} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {AB4167B8-284D-4C23-A5BB-D176837E02EF} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-22] (Adobe Systems Incorporated)

Task: {B0B68EDB-8281-4EC0-B7BE-E58498B74E6C} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)

Task: {B381A536-8355-4402-B4F0-3BAF438D9080} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)

Task: {DE7FFB44-D3EB-47EA-9324-CC85A52702C6} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-05-07] (PC-Doctor, Inc.)

Task: {F7F08BB2-6CFB-4474-B7D8-D5EF2E22AB65} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2013-02-13] ()

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2013-06-27 01:54 - 2013-06-27 01:54 - 01018416 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgsysa.dll

2010-11-11 06:54 - 2010-11-11 06:54 - 00177136 _____ (TODO: <Company name>) c:\Program Files\Roxio\Roxio Burn\RB_ContextMenu64.dll

2013-03-28 02:48 - 2013-03-28 02:48 - 00266288 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgsea.dll

2012-01-27 14:10 - 2011-03-26 03:40 - 00286720 _____ (Intel Corporation) C:\windows\system32\igfxrDEU.lrc

2012-01-27 14:10 - 2011-03-26 03:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-01-27 14:13 - 2011-03-02 20:30 - 01711472 _____ (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.dll

2012-01-27 14:13 - 2011-01-19 07:36 - 00110448 _____ (Alps Electric Co., Ltd.) C:\windows\system32\Vxdif.dll

2012-01-27 14:13 - 2010-06-01 07:23 - 00039792 _____ (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\EzAuto.dll

2012-01-27 13:02 - 2011-05-27 21:06 - 04780032 _____ (IDT, Inc.) C:\Program Files\IDT\WDM\STLang64.dll

2012-01-27 13:02 - 2011-05-27 21:06 - 00654336 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll

2012-01-27 14:13 - 2011-01-19 07:36 - 00110448 _____ (Alps Electric Co., Ltd.) C:\windows\system32\VXDIF.DLL

2012-01-27 14:13 - 2011-03-02 20:30 - 01711472 _____ (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.DLL

2012-01-27 13:31 - 2010-08-12 02:19 - 00126176 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll

2012-01-27 13:31 - 2010-08-12 02:19 - 01121504 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll

2012-01-27 13:31 - 2010-08-12 02:19 - 00077024 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll

2012-01-27 13:31 - 2010-08-12 02:19 - 00232672 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll

2012-01-27 13:31 - 2010-08-12 02:19 - 00072928 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll

2012-01-27 13:31 - 2010-08-12 02:19 - 00109792 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll

2012-01-27 13:31 - 2010-08-12 02:19 - 00119008 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll

2013-01-04 13:06 - 2012-10-16 09:39 - 00561664 _____ (Microsoft Corporation) C:\windows\AppPatch\AcLayers.DLL

2010-03-17 04:28 - 2010-03-17 04:28 - 01926144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtCore4.dll

2010-03-22 23:52 - 2010-03-22 23:52 - 06776832 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtGui4.dll

2010-03-17 04:28 - 2010-03-17 04:28 - 00635904 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtNetwork4.dll

2010-03-17 04:28 - 2010-03-17 04:28 - 00326144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtXml4.dll

2011-06-29 16:52 - 2011-06-29 16:52 - 00077376 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\DMSAdapter.dll

2011-06-28 03:25 - 2011-06-28 03:25 - 00491968 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\DHServerAgent.dll

2011-06-28 03:26 - 2011-06-28 03:26 - 00715400 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\UMediaManager.dll

2011-06-25 07:19 - 2011-06-25 07:19 - 00043584 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\ASDBTool.dll

2011-06-25 07:20 - 2011-06-25 07:20 - 00565968 _____ () C:\Program Files (x86)\Dell\Stage Remote\sqlite3.dll

2011-06-28 03:25 - 2011-06-28 03:25 - 00051264 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\ASTransMgr.dll

2011-06-25 07:19 - 2011-06-25 07:19 - 00043584 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\ASXmlTool.dll

2011-06-28 03:25 - 2011-06-28 03:25 - 00058944 _____ () C:\Program Files (x86)\Dell\Stage Remote\DataService.dll

2011-06-25 07:32 - 2011-06-25 07:32 - 00323136 _____ () C:\Program Files (x86)\Dell\Stage Remote\de-DE\UI\ManagerUI.dll

2010-03-12 03:52 - 2010-03-12 03:52 - 00028160 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qgif4.dll

2010-03-05 23:07 - 2010-03-05 23:07 - 00031744 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qico4.dll

2010-03-05 23:07 - 2010-03-05 23:07 - 00125952 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qjpeg4.dll

2010-03-12 03:52 - 2010-03-12 03:52 - 00225280 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qmng4.dll

2010-01-07 04:43 - 2010-01-07 04:43 - 00017408 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\EndPointCtrl.dll

2013-08-15 14:25 - 2013-08-15 14:25 - 01110704 _____ (AVG Technologies) C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\npsitesafety.dll

2013-09-03 18:53 - 2013-08-24 19:48 - 09962960 _____ (The ICU Project) C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\icudt.dll

2013-05-25 02:36 - 2013-05-25 02:36 - 00130736 _____ (Dropbox, Inc.) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2013-05-15 08:00 - 2013-04-13 06:45 - 00474624 _____ (Microsoft Corporation) C:\windows\AppPatch\AcSpecfc.DLL

2012-11-14 01:32 - 2012-11-14 01:32 - 03558400 _____ (wxWidgets development team) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\libcef.dll

2013-03-13 22:48 - 2013-03-13 22:48 - 09956864 _____ (The ICU Project) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\icudt.dll

2012-01-27 12:53 - 2009-09-08 18:01 - 00237056 ____N (Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\CTLoadRs.dll

2012-01-27 12:53 - 2010-07-22 21:01 - 00065536 ____N (Creative Technology Ltd.) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\CtPinMgr.dll

2013-08-15 04:30 - 2013-08-15 04:30 - 00475648 _____ (Intel Corporation) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\6c1d55eed243331c944206f8608fb850\IAStorUtil.ni.dll

2013-07-12 11:42 - 2013-07-12 11:42 - 00014336 _____ (Intel Corp.) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\571f0babf15ab38dc80829622caa99d3\IAStorCommon.ni.dll

2010-11-09 19:59 - 2010-11-09 19:59 - 04479472 _____ (Sonic Solutions) C:\Program Files (x86)\Roxio\OEM\Roxio Burn\AS_Storage_w32.dll

2010-11-25 06:34 - 2010-11-25 06:34 - 00632304 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\homepermitsconfig13.dll

2010-11-22 21:27 - 2010-11-22 21:27 - 00190960 _____ (Roxio, Inc.) c:\program files (x86)\common files\roxio shared\dllshared\rsl.dll

2010-11-25 06:44 - 2010-11-25 06:44 - 00375280 _____ () c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll

2010-11-22 21:27 - 2010-11-22 21:27 - 00186864 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\rcsl.dll

2010-11-25 06:35 - 2010-11-25 06:35 - 00961008 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\SonicHTTPClient13.dll

2010-11-25 06:35 - 2010-11-25 06:35 - 00712688 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\SonicLicenseManager13.dll

2012-02-01 12:44 - 2012-02-01 12:44 - 18858496 _____ (Unlimited Realities) C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\libumajin.dll

2012-02-01 12:44 - 2012-02-01 12:44 - 08151040 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll

2012-02-01 12:44 - 2012-02-01 12:44 - 02278400 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll

2013-07-27 11:57 - 2009-02-27 17:39 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.deu

2013-01-09 21:03 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

2013-01-09 21:03 - 2010-02-17 11:50 - 00626688 ____R (Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonWRes.dll

2009-07-14 02:29 - 2009-07-14 03:38 - 00701952 _____ (Microsoft Corporation) C:\windows\system32\hhctrl.ocx

2013-01-09 21:03 - 2009-12-25 16:08 - 00208896 ____R (Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrFirmUpdateCheck.dll

2013-02-19 05:01 - 2013-02-19 05:01 - 00890928 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgntopensslx.dll

2013-06-27 01:54 - 2013-06-27 01:54 - 00848432 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgsysx.dll

2013-02-19 05:01 - 2013-02-19 05:01 - 00309808 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avglogx.dll

2013-07-23 01:31 - 2013-07-23 01:31 - 02853936 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgkrnlapix.dll

2013-03-21 03:09 - 2013-03-21 03:09 - 01028144 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcfgx.dll

2013-07-26 01:33 - 2013-07-26 01:33 - 00455216 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcommx.dll

2013-02-19 05:01 - 2013-02-19 05:01 - 00273968 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidpmx.dll

2013-02-19 05:01 - 2013-02-19 05:01 - 00174640 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avglngx.dll

2013-03-29 02:54 - 2013-03-29 02:54 - 01799216 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avguires.dll

2013-02-19 05:00 - 2013-02-19 05:00 - 00279088 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgclitx.dll

2013-02-19 05:01 - 2013-02-19 05:01 - 00025648 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgapps.dll

2013-03-14 03:16 - 2013-03-14 03:16 - 00409648 _____ (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgdecider.dll

2009-07-14 02:18 - 2009-07-14 03:38 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\imaadp32.acm

2009-07-14 02:18 - 2009-07-14 03:38 - 00014848 _____ (Microsoft Corporation) C:\windows\system32\msg711.acm

2009-07-14 02:18 - 2009-07-14 03:38 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\msgsm32.acm

2009-07-14 02:18 - 2009-07-14 03:38 - 00024064 _____ (Microsoft Corporation) C:\windows\system32\msadp32.acm

2009-07-14 02:07 - 2009-07-14 03:14 - 00064000 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\SysWOW64\l3codeca.acm

2009-07-14 02:23 - 2009-07-14 03:38 - 00182272 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\windows\system32\l3codecp.acm

2013-08-15 14:25 - 2013-08-15 14:25 - 00521904 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\log4cplusU.dll

2013-08-15 14:25 - 2013-08-15 14:25 - 00144560 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\SiteSafety.dll

2013-09-03 18:53 - 2013-08-24 19:49 - 00709584 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\libglesv2.dll

2013-09-03 18:53 - 2013-08-24 19:49 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\libegl.dll

2013-09-03 18:53 - 2013-08-24 19:49 - 04053456 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll

2013-09-03 18:53 - 2013-08-24 19:49 - 00410576 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll

2013-09-03 18:53 - 2013-08-24 19:48 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ffmpegsumo.dll
 

==================== Alternate Data Streams (whitelisted) ==========
 
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (09/02/2013 05:22:46 PM) (Source: Application Hang) (User: )

Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: a7c
 

Startzeit: 01cea7eba1a4c188
 

Endzeit: 31
 

Anwendungspfad: C:\windows\Explorer.EXE
 

Berichts-ID: 80d8675c-13e3-11e3-ae87-64273768c763
 

Error: (09/01/2013 08:11:38 PM) (Source: Application Hang) (User: )

Description: Programm WINWORD.EXE, Version 14.0.6129.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 84c
 

Startzeit: 01cea73d4cbd621d
 

Endzeit: 15
 

Anwendungspfad: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
 

Berichts-ID: e88f5a00-1331-11e3-baae-24b6fd1d0888
 

Error: (08/31/2013 06:57:31 PM) (Source: Application Hang) (User: )

Description: Programm WINWORD.EXE, Version 14.0.6129.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: fd0
 

Startzeit: 01cea627e2e40d2a
 

Endzeit: 110
 

Anwendungspfad: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
 

Berichts-ID: 6863bc6a-125e-11e3-a206-24b6fd1d0888
 

Error: (08/31/2013 06:57:21 PM) (Source: Application Hang) (User: )

Description: Programm WINWORD.EXE, Version 14.0.6129.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: a40
 

Startzeit: 01cea65400e93738
 

Endzeit: 47
 

Anwendungspfad: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
 

Berichts-ID: 4d488123-125e-11e3-a206-24b6fd1d0888
 

Error: (08/31/2013 10:52:53 AM) (Source: Application Hang) (User: )

Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: b10
 

Startzeit: 01cea62726114840
 

Endzeit: 16
 

Anwendungspfad: C:\windows\Explorer.EXE
 

Berichts-ID: b31dfd69-121a-11e3-a206-24b6fd1d0888
 

Error: (08/31/2013 10:22:11 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/30/2013 08:01:23 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/30/2013 10:25:08 AM) (Source: Application Hang) (User: )

Description: Programm WINWORD.EXE, Version 14.0.6129.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 139c
 

Startzeit: 01cea557ffb569a1
 

Endzeit: 0
 

Anwendungspfad: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
 

Berichts-ID: a999c8a3-114d-11e3-8aec-24b6fd1d0888
 

Error: (08/30/2013 10:07:31 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/29/2013 04:12:42 PM) (Source: Application Hang) (User: )

Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: c60
 

Startzeit: 01cea4c1957e8cc3
 

Endzeit: 47
 

Anwendungspfad: C:\windows\Explorer.EXE
 

Berichts-ID: 0faf7129-10b5-11e3-bb10-64273768c763
 
 

System errors:

=============

Error: (09/03/2013 08:46:21 PM) (Source: Service Control Manager) (User: )

Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 

%%5
 

Error: (09/03/2013 06:05:47 PM) (Source: Service Control Manager) (User: )

Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 

%%5
 

Error: (09/02/2013 06:13:33 PM) (Source: Service Control Manager) (User: )

Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 

%%5
 

Error: (09/02/2013 06:13:33 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
 

Error: (09/02/2013 06:08:18 PM) (Source: DCOM) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (09/02/2013 06:07:11 PM) (Source: DCOM) (User: )

Description: {06622D85-6856-4460-8DE1-A81921B41C4B}
 

Error: (09/02/2013 04:49:31 PM) (Source: Service Control Manager) (User: )

Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 

%%5
 

Error: (09/01/2013 08:59:32 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst BrYNSvc erreicht.
 

Error: (09/01/2013 08:59:01 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst BrYNSvc erreicht.
 

Error: (09/01/2013 08:58:56 PM) (Source: Service Control Manager) (User: )

Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 

%%5
 
 

Microsoft Office Sessions:

=========================

Error: (09/02/2013 05:22:46 PM) (Source: Application Hang)(User: )

Description: Explorer.EXE6.1.7601.17567a7c01cea7eba1a4c18831C:\windows\Explorer.EXE80d8675c-13e3-11e3-ae87-64273768c763
 

Error: (09/01/2013 08:11:38 PM) (Source: Application Hang)(User: )

Description: WINWORD.EXE14.0.6129.500084c01cea73d4cbd621d15C:\Program Files\Microsoft Office\Office14\WINWORD.EXEe88f5a00-1331-11e3-baae-24b6fd1d0888
 

Error: (08/31/2013 06:57:31 PM) (Source: Application Hang)(User: )

Description: WINWORD.EXE14.0.6129.5000fd001cea627e2e40d2a110C:\Program Files\Microsoft Office\Office14\WINWORD.EXE6863bc6a-125e-11e3-a206-24b6fd1d0888
 

Error: (08/31/2013 06:57:21 PM) (Source: Application Hang)(User: )

Description: WINWORD.EXE14.0.6129.5000a4001cea65400e9373847C:\Program Files\Microsoft Office\Office14\WINWORD.EXE4d488123-125e-11e3-a206-24b6fd1d0888
 

Error: (08/31/2013 10:52:53 AM) (Source: Application Hang)(User: )

Description: Explorer.EXE6.1.7601.17567b1001cea6272611484016C:\windows\Explorer.EXEb31dfd69-121a-11e3-a206-24b6fd1d0888
 

Error: (08/31/2013 10:22:11 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/30/2013 08:01:23 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/30/2013 10:25:08 AM) (Source: Application Hang)(User: )

Description: WINWORD.EXE14.0.6129.5000139c01cea557ffb569a10C:\Program Files\Microsoft Office\Office14\WINWORD.EXEa999c8a3-114d-11e3-8aec-24b6fd1d0888
 

Error: (08/30/2013 10:07:31 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/29/2013 04:12:42 PM) (Source: Application Hang)(User: )

Description: Explorer.EXE6.1.7601.17567c6001cea4c1957e8cc347C:\windows\Explorer.EXE0faf7129-10b5-11e3-bb10-64273768c763
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 65%

Total physical RAM: 4004.27 MB

Available physical RAM: 1368.97 MB

Total Pagefile: 8006.73 MB

Available Pagefile: 5650.04 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:374.84 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: B3B3C776)

Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)

Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-09-05 16:18:37

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500LM0 rev.2AR1 465,76GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\PETERS~1\AppData\Local\Temp\pgtiapow.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544                                                                                              fffff800035a6000 45 bytes [00, 00, 10, 02, 4E, 74, 66, ...]

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591                                                                                              fffff800035a602f 18 bytes [00, 01, 00, 06, 00, 00, 00, ...]
 

---- User code sections - GMER 2.1 ----
 

.text     C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe[1848] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                   0000000077491465 2 bytes [49, 77]

.text     C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe[1848] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                  00000000774914bb 2 bytes [49, 77]

.text     ...                                                                                                                                                             * 2

.text     C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE[2016] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000077491465 2 bytes [49, 77]

.text     C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE[2016] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 00000000774914bb 2 bytes [49, 77]

.text     ...                                                                                                                                                             * 2

.text     C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000077491465 2 bytes [49, 77]

.text     C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000774914bb 2 bytes [49, 77]

.text     ...                                                                                                                                                             * 2

.text     C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe[4260] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69                                      0000000077491465 2 bytes [49, 77]

.text     C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe[4260] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155                                     00000000774914bb 2 bytes [49, 77]

.text     ...                                                                                                                                                             * 2

.text     C:\Program Files (x86)\AVG Secure Search\vprot.exe[4628] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000077491465 2 bytes [49, 77]

.text     C:\Program Files (x86)\AVG Secure Search\vprot.exe[4628] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000774914bb 2 bytes [49, 77]

.text     ...                                                                                                                                                             * 2
 

---- Registry - GMER 2.1 ----
 

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{5B729DE4-EBFF-4188-8F2C-EFFA1B710AB2}\Connection@Name                     isatap.{335E881E-9033-47B8-B300-CF5EBBD7D085}

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind                        \Device\{8A23D3E6-01B2-422C-B8AE-2AD9144852F6}?\Device\{A8805CE8-CD4E-44C7-B29D-51F8B4E4E12B}?\Device\{5B729DE4-EBFF-4188-8F2C-EFFA1B710AB2}?\Device\{6DBA3FC3-B04D-4131-A77D-3B88E07B85DA}?

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route                       "{8A23D3E6-01B2-422C-B8AE-2AD9144852F6}"?"{A8805CE8-CD4E-44C7-B29D-51F8B4E4E12B}"?"{5B729DE4-EBFF-4188-8F2C-EFFA1B710AB2}"?"{6DBA3FC3-B04D-4131-A77D-3B88E07B85DA}"?

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export                      \Device\TCPIP6TUNNEL_{8A23D3E6-01B2-422C-B8AE-2AD9144852F6}?\Device\TCPIP6TUNNEL_{A8805CE8-CD4E-44C7-B29D-51F8B4E4E12B}?\Device\TCPIP6TUNNEL_{5B729DE4-EBFF-4188-8F2C-EFFA1B710AB2}?\Device\TCPIP6TUNNEL_{6DBA3FC3-B04D-4131-A77D-3B88E07B85DA}?

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015007f6c3b                                                                                     

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38d054a8                                                                                     

Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{5B729DE4-EBFF-4188-8F2C-EFFA1B710AB2}@InterfaceName                                          isatap.{335E881E-9033-47B8-B300-CF5EBBD7D085}

Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{5B729DE4-EBFF-4188-8F2C-EFFA1B710AB2}@ReusableType                                           0

Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015007f6c3b (not active ControlSet)                                                                 

Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38d054a8 (not active ControlSet)                                                                 
 

---- EOF - GMER 2.1 ----

Ich hoffe, jetzt ist´s OK...
Vielen Dank!

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Code:

ComboFix 13-09-06.01 - Petersplatz 06.09.2013  10:00:55.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.4004.2371 [GMT 2:00]

ausgeführt von:: c:\users\Petersplatz\Desktop\ComboFix.exe

AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\PCDr\6280\AddOnDownloaded\31d5a116-b563-4195-8dbd-1798d14bfacd.dll

c:\programdata\PCDr\6280\AddOnDownloaded\3265cc37-1ae8-4a1d-b93a-d8a0d09ba823.dll

c:\programdata\PCDr\6280\AddOnDownloaded\357a8a4f-74a2-42f1-aed0-bea5984fd709.dll

c:\programdata\PCDr\6280\AddOnDownloaded\393c4795-5a95-448d-89c3-2d1321ae7575.dll

c:\programdata\PCDr\6280\AddOnDownloaded\5737a9df-39af-4df3-b97d-07f556d679c5.dll

c:\programdata\PCDr\6280\AddOnDownloaded\8aa95cb2-816d-4a9a-a370-962b815a3013.dll

c:\programdata\PCDr\6280\AddOnDownloaded\97b26c73-ba78-4c33-81e8-2f3210990c0e.dll

c:\programdata\PCDr\6280\AddOnDownloaded\9a29e1fb-664e-4651-a32c-e1ab34198ded.dll

c:\programdata\PCDr\6280\AddOnDownloaded\ad3867bf-de78-4ebd-93f2-0811b275b627.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-08-06 bis 2013-09-06  ))))))))))))))))))))))))))))))

.

.

2013-09-06 08:08 . 2013-09-06 08:08        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-09-06 08:08 . 2013-09-06 08:08        --------        d-----w-        c:\users\Gast\AppData\Local\temp

2013-09-05 10:44 . 2013-09-05 10:44        --------        d-----w-        C:\FRST

2013-08-28 16:12 . 2013-08-29 12:55        --------        d-----w-        c:\users\Petersplatz\AppData\Roaming\Systweak

2013-08-28 16:12 . 2013-08-22 16:36        20312        ----a-w-        c:\windows\system32\roboot64.exe

2013-08-28 16:12 . 2013-08-28 16:12        --------        d-----w-        c:\users\Petersplatz\AppData\Local\Programs

2013-08-14 10:57 . 2013-07-09 05:52        224256        ----a-w-        c:\windows\system32\wintrust.dll

2013-08-14 10:57 . 2013-07-09 05:46        184320        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-08-14 10:57 . 2013-07-09 05:46        1472512        ----a-w-        c:\windows\system32\crypt32.dll

2013-08-14 10:57 . 2013-07-09 05:46        139776        ----a-w-        c:\windows\system32\cryptnet.dll

2013-08-14 10:57 . 2013-07-09 04:52        175104        ----a-w-        c:\windows\SysWow64\wintrust.dll

2013-08-14 10:57 . 2013-07-09 04:46        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2013-08-14 10:57 . 2013-07-09 04:46        1166848        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-08-14 10:57 . 2013-07-09 04:46        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

2013-08-14 10:55 . 2013-07-19 01:58        2048        ----a-w-        c:\windows\system32\tzres.dll

2013-08-14 10:55 . 2013-07-19 01:41        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2013-08-14 10:55 . 2013-07-25 09:25        1888768        ----a-w-        c:\windows\system32\WMVDECOD.DLL

2013-08-14 10:55 . 2013-07-25 08:57        1620992        ----a-w-        c:\windows\SysWow64\WMVDECOD.DLL

2013-08-14 10:55 . 2013-06-15 04:32        39936        ----a-w-        c:\windows\system32\drivers\tssecsrv.sys

2013-08-14 10:55 . 2013-07-09 05:03        3913664        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-22 18:58 . 2013-02-24 08:38        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-08-22 18:58 . 2012-01-27 10:59        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-08-15 12:25 . 2013-02-08 14:14        45856        ----a-w-        c:\windows\system32\drivers\avgtpx64.sys

2013-08-15 01:02 . 2013-01-04 11:42        78161360        ----a-w-        c:\windows\system32\MRT.exe

2013-07-19 23:51 . 2013-07-19 23:51        311608        ----a-w-        c:\windows\system32\drivers\avgloga.sys

2013-07-19 23:50 . 2013-07-19 23:50        71480        ----a-w-        c:\windows\system32\drivers\avgidsha.sys

2013-07-19 23:50 . 2013-07-19 23:50        246072        ----a-w-        c:\windows\system32\drivers\avgidsdrivera.sys

2013-07-19 23:50 . 2013-07-19 23:50        206648        ----a-w-        c:\windows\system32\drivers\avgldx64.sys

2013-07-09 23:32 . 2013-07-09 23:32        45880        ----a-w-        c:\windows\system32\drivers\avgrkx64.sys

2013-07-09 04:45 . 2013-08-14 10:54        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2013-06-30 23:45 . 2013-06-30 23:45        116536        ----a-w-        c:\windows\system32\drivers\avgmfx64.sys

2013-06-21 11:52 . 2013-06-21 13:52        89600        ----a-w-        c:\windows\system32\sst7cci.dll

2013-06-21 11:52 . 2013-06-21 13:52        34304        ----a-w-        c:\windows\system32\sst7clm.dll

2013-06-21 11:52 . 2013-06-21 13:52        226424        ----a-w-        c:\windows\system32\SBuySupplies.exe

2013-06-21 11:52 . 2013-06-21 13:52        151552        ----a-w-        c:\windows\system32\sst7cci.exe

2013-06-13 08:19 . 2013-06-13 08:19        8192        ----a-w-        c:\windows\SysWow64\srvany.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-01-28 14:48        281760        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GoogleChromeAutoLaunch_DC2C44A93382AC9B5634D9F68269EB5C"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2013-09-02 829392]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]

"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]

"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]

"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2013-05-08 642664]

"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]

"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-06-30 4411440]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2013-08-15 2314416]

"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-01-30 450560]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-08-12 163040]

.

c:\users\Petersplatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 KMService;KMService;c:\windows\system32\srvany.exe;c:\windows\SYSNATIVE\srvany.exe [x]

R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [x]

R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]

R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 vToolbarUpdater15.5.0;vToolbarUpdater15.5.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [x]

S3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]

S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-09-05 08:51        1177552        ----a-w-        c:\program files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-24 18:58]

.

2013-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-04 10:43]

.

2013-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-04 10:43]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-01-28 14:48        342176        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Petersplatz\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-03-29 608112]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-27 1128448]

"Stage Remote"="c:\program files (x86)\Dell\Stage Remote\StageRemote.exe" [2011-06-28 2022976]

"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.at/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105

IE: An vorhandenes PDF anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000

IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

Trusted Zone: kastner.at\www

TCP: DhcpNameServer = 192.168.10.1 217.15.0.1 217.15.0.2

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll

FF - ProfilePath - c:\users\Petersplatz\AppData\Roaming\Mozilla\Firefox\Profiles\lv4h1kzg.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)

Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

AddRemove-7-Zip - c:\neuer ordner\7-Zip\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-09-06  10:11:45

ComboFix-quarantined-files.txt  2013-09-06 08:11

.

Vor Suchlauf: 10 Verzeichnis(se), 403.589.169.152 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 403.481.563.136 Bytes frei

.

- - End Of File - - 8F25A7141A78EEF2CC8C6F155DFD8C30

Vielen Dank und Gruß
Biggy

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-09-2013

Ran by Petersplatz (administrator) on PPLAPTOP on 06-09-2013 15:50:35

Running from C:\Users\Petersplatz\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Microsoft Corporation) C:\windows\system32\WLANExt.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe

(Dropbox, Inc.) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

() C:\Users\Petersplatz\Desktop\adwcleaner.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe

(Microsoft Corporation) C:\windows\SysWOW64\NOTEPAD.EXE

(Microsoft Corporation) C:\windows\SysWOW64\notepad.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [608112 2011-03-29] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)

HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()

HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()

HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)

HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Launcher] - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [163040 2010-08-12] (Softthinks)

HKLM\...\Policies\Explorer: [NoDrives] 0

HKCU\...\Run: [GoogleChromeAutoLaunch_DC2C44A93382AC9B5634D9F68269EB5C] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [829392 2013-09-02] (Google Inc.)

HKCU\...\Policies\Explorer: [NoDrives] 0

HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)

HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()

HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()

HKLM-x32\...\Run: [AdobeCS4ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-14] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)

HKLM-x32\...\Run: [Adobe_ID0ENQBO] - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe [378224 2008-08-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2314416 2013-08-15] ()

HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

Startup: C:\Users\Petersplatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (Adobe Systems Incorporated.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (Adobe Systems Incorporated.)

Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.10.1 217.15.0.1 217.15.0.2
 

FireFox:

========

FF ProfilePath: C:\Users\Petersplatz\AppData\Roaming\Mozilla\Firefox\Profiles\lv4h1kzg.default

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\\npsitesafety.dll (AVG Technologies)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK
 

Chrome: 

=======

CHR RestoreOnStartup: "hxxp://www.google.at/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 7.0.10.8) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U1) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Drive) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (AVG Secure Search) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.5.0.2_0

CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0

CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.172_0

CHR Extension: (Gmail) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\15.5.0.2\avg.crx

CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
 

==================== Services (Whitelisted) =================
 

S3 Adobe Version Cue CS4; C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [284016 2008-08-15] (Adobe Systems Incorporated)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)

S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2013-06-13] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [1643184 2013-08-15] (AVG Secure Search)
 

==================== Drivers (Whitelisted) ====================
 

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\windows\system32\drivers\avgtpx64.sys [45856 2013-08-15] (AVG Technologies)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-06 15:48 - 2013-09-06 15:48 - 00004509 _____ C:\Users\Petersplatz\Desktop\JRT.txt

2013-09-06 15:41 - 2013-09-06 15:41 - 00000000 ____D C:\windows\ERUNT

2013-09-06 15:40 - 2013-09-06 15:40 - 01028823 _____ (Thisisu) C:\Users\Petersplatz\Desktop\JRT.exe

2013-09-06 15:35 - 2013-09-06 15:35 - 00000000 ____D C:\AdwCleaner

2013-09-06 15:30 - 2013-09-06 15:30 - 01037222 _____ C:\Users\Petersplatz\Desktop\adwcleaner.exe

2013-09-06 15:19 - 2013-09-06 15:19 - 00001107 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-06 15:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-09-06 15:17 - 2013-09-06 15:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Petersplatz\Desktop\mbam-setup-1.75.0.1300.exe

2013-09-06 10:11 - 2013-09-06 10:11 - 00025269 _____ C:\ComboFix.txt

2013-09-06 09:59 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe

2013-09-06 09:59 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe

2013-09-06 09:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe

2013-09-06 09:58 - 2013-09-06 10:11 - 00000000 ____D C:\Qoobox

2013-09-06 09:58 - 2013-09-06 10:10 - 00000000 ____D C:\windows\erdnt

2013-09-06 09:52 - 2013-09-06 09:52 - 05120615 ____R (Swearware) C:\Users\Petersplatz\Desktop\ComboFix.exe

2013-09-05 16:18 - 2013-09-05 16:18 - 00006227 _____ C:\Users\Petersplatz\Desktop\Scan_20130905.log

2013-09-05 15:40 - 2013-09-05 15:40 - 00377856 _____ C:\Users\Petersplatz\Desktop\gmer_2.1.19163.exe

2013-09-05 12:58 - 2013-09-05 12:58 - 00000486 _____ C:\Users\Petersplatz\Desktop\defogger_disable.log

2013-09-05 12:45 - 2013-09-05 12:46 - 00037921 _____ C:\Users\Petersplatz\Desktop\Addition.txt

2013-09-05 12:44 - 2013-09-05 12:44 - 00000000 ____D C:\FRST

2013-09-05 12:43 - 2013-09-05 12:43 - 00000725 _____ C:\Users\Petersplatz\Desktop\Defogger - Verknüpfung.lnk

2013-09-05 12:41 - 2013-09-05 12:41 - 00000484 _____ C:\Users\Petersplatz\Downloads\defogger_disable.log

2013-09-05 12:41 - 2013-09-05 12:41 - 00000000 _____ C:\Users\Petersplatz\defogger_reenable

2013-09-05 10:55 - 2013-09-05 10:55 - 00050477 _____ C:\Users\Petersplatz\Downloads\Defogger.exe

2013-09-01 10:24 - 2013-09-01 10:24 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309 (1).zip

2013-08-29 10:33 - 2013-08-29 10:33 - 00515927 _____ C:\Users\Petersplatz\Downloads\Messzettel1309.zip

2013-08-29 10:30 - 2013-08-29 10:31 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309.zip

2013-08-28 18:31 - 2013-08-28 18:31 - 01528184 _____ (Microsoft Corporation) C:\Users\Petersplatz\Downloads\GenuineCheck.exe

2013-08-28 18:12 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe

2013-08-28 14:32 - 2013-09-01 10:25 - 01335639 _____ C:\Users\Petersplatz\Desktop\Messbuch 1309.epub

2013-08-15 03:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-08-15 03:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-08-15 03:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-08-15 03:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-08-15 03:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-08-15 03:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-08-15 03:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-08-15 03:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-08-15 03:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-08-15 03:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-08-15 03:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-08-15 03:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-14 18:29 - 2013-08-14 18:29 - 00010908 _____ C:\Users\Petersplatz\Downloads\Budget2014 (1).xlsx

2013-08-14 14:25 - 2013-08-14 14:25 - 00011988 _____ C:\Users\Petersplatz\Downloads\Plan der Woche.xlsx

2013-08-14 12:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll

2013-08-14 12:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll

2013-08-14 12:55 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL

2013-08-14 12:55 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL

2013-08-14 12:55 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2013-08-14 12:55 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

2013-08-14 12:55 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2013-08-14 12:55 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

2013-08-14 12:54 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2013-08-14 12:54 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2013-08-14 12:54 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2013-08-14 12:54 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2013-08-14 12:54 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2013-08-14 12:54 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2013-08-14 12:54 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2013-08-14 12:54 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2013-08-14 12:54 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2013-08-14 12:54 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2013-08-14 12:54 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2013-08-14 12:54 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2013-08-14 12:54 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys

2013-08-13 18:51 - 2013-08-13 18:51 - 00014753 _____ C:\Users\Petersplatz\Downloads\Aufgabenforum.xlsm

2013-08-13 18:50 - 2013-08-13 18:51 - 00023954 _____ C:\Users\Petersplatz\Downloads\Forum2013.xlsm

2013-08-12 14:22 - 2013-08-12 14:22 - 00001106 _____ C:\Users\Petersplatz\Downloads\url.htm

2013-08-12 12:11 - 2013-08-12 12:14 - 00011696 _____ C:\Users\Petersplatz\Downloads\Budget2014.xlsx

2013-08-10 10:31 - 2013-08-10 10:35 - 37455597 _____ (A.I.SOFT,INC.) C:\Users\Petersplatz\Downloads\HL-2130-inst-B1-useu (1).EXE

2013-08-08 19:02 - 2013-08-08 19:02 - 00003132 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Retry
 

==================== One Month Modified Files and Folders =======
 

2013-09-06 15:50 - 2013-09-06 15:50 - 01948360 _____ (Farbar) C:\Users\Petersplatz\Desktop\FRST64.exe

2013-09-06 15:50 - 2013-01-04 12:43 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-09-06 15:50 - 2013-01-04 12:43 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-09-06 15:48 - 2013-09-06 15:48 - 00004509 _____ C:\Users\Petersplatz\Desktop\JRT.txt

2013-09-06 15:41 - 2013-09-06 15:41 - 00000000 ____D C:\windows\ERUNT

2013-09-06 15:40 - 2013-09-06 15:40 - 01028823 _____ (Thisisu) C:\Users\Petersplatz\Desktop\JRT.exe

2013-09-06 15:40 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-06 15:40 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-06 15:37 - 2012-01-27 14:39 - 00700418 _____ C:\windows\system32\perfh007.dat

2013-09-06 15:37 - 2012-01-27 14:39 - 00149182 _____ C:\windows\system32\perfc007.dat

2013-09-06 15:37 - 2009-07-14 07:13 - 01621244 _____ C:\windows\system32\PerfStringBackup.INI

2013-09-06 15:35 - 2013-09-06 15:35 - 00000000 ____D C:\AdwCleaner

2013-09-06 15:34 - 2013-01-08 12:44 - 00000000 ___RD C:\Users\Petersplatz\Dropbox

2013-09-06 15:34 - 2013-01-08 12:38 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Dropbox

2013-09-06 15:33 - 2013-01-04 12:10 - 00000000 ____D C:\Users\PETERS~1\AppData\Local\SoftThinks

2013-09-06 15:32 - 2012-01-27 12:47 - 01739281 _____ C:\windows\WindowsUpdate.log

2013-09-06 15:32 - 2010-11-21 05:47 - 00035534 _____ C:\windows\PFRO.log

2013-09-06 15:32 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-09-06 15:32 - 2009-07-14 06:51 - 00074896 _____ C:\windows\setupact.log

2013-09-06 15:30 - 2013-09-06 15:30 - 01037222 _____ C:\Users\Petersplatz\Desktop\adwcleaner.exe

2013-09-06 15:22 - 2013-02-24 10:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-09-06 15:19 - 2013-09-06 15:19 - 00001107 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-06 15:17 - 2013-09-06 15:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Petersplatz\Desktop\mbam-setup-1.75.0.1300.exe

2013-09-06 10:11 - 2013-09-06 10:11 - 00025269 _____ C:\ComboFix.txt

2013-09-06 10:11 - 2013-09-06 09:58 - 00000000 ____D C:\Qoobox

2013-09-06 10:11 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default

2013-09-06 10:10 - 2013-09-06 09:58 - 00000000 ____D C:\windows\erdnt

2013-09-06 10:09 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini

2013-09-06 09:52 - 2013-09-06 09:52 - 05120615 ____R (Swearware) C:\Users\Petersplatz\Desktop\ComboFix.exe

2013-09-06 09:51 - 2013-02-08 16:09 - 00000000 ____D C:\ProgramData\MFAData

2013-09-05 16:18 - 2013-09-05 16:18 - 00006227 _____ C:\Users\Petersplatz\Desktop\Scan_20130905.log

2013-09-05 15:40 - 2013-09-05 15:40 - 00377856 _____ C:\Users\Petersplatz\Desktop\gmer_2.1.19163.exe

2013-09-05 12:58 - 2013-09-05 12:58 - 00000486 _____ C:\Users\Petersplatz\Desktop\defogger_disable.log

2013-09-05 12:46 - 2013-09-05 12:45 - 00037921 _____ C:\Users\Petersplatz\Desktop\Addition.txt

2013-09-05 12:44 - 2013-09-05 12:44 - 00000000 ____D C:\FRST

2013-09-05 12:43 - 2013-09-05 12:43 - 00000725 _____ C:\Users\Petersplatz\Desktop\Defogger - Verknüpfung.lnk

2013-09-05 12:41 - 2013-09-05 12:41 - 00000484 _____ C:\Users\Petersplatz\Downloads\defogger_disable.log

2013-09-05 12:41 - 2013-09-05 12:41 - 00000000 _____ C:\Users\Petersplatz\defogger_reenable

2013-09-05 12:41 - 2013-01-04 12:10 - 00000000 ____D C:\Users\Petersplatz

2013-09-05 10:55 - 2013-09-05 10:55 - 00050477 _____ C:\Users\Petersplatz\Downloads\Defogger.exe

2013-09-03 18:06 - 2012-01-27 13:16 - 00000000 ____D C:\ProgramData\Sonic

2013-09-02 17:46 - 2013-03-22 20:43 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\vlc

2013-09-01 20:20 - 2013-01-04 20:47 - 00000000 ____D C:\Users\Petersplatz\Documents\Petersplatz Haus

2013-09-01 20:02 - 2012-01-27 13:31 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-09-01 10:25 - 2013-08-28 14:32 - 01335639 _____ C:\Users\Petersplatz\Desktop\Messbuch 1309.epub

2013-09-01 10:24 - 2013-09-01 10:24 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309 (1).zip

2013-08-31 10:44 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-08-31 10:37 - 2013-05-01 15:50 - 00000375 _____ C:\windows\system32\Drivers\etc\hosts.ics

2013-08-29 14:57 - 2012-01-27 13:21 - 00000000 ____D C:\ProgramData\WildTangent

2013-08-29 10:33 - 2013-08-29 10:33 - 00515927 _____ C:\Users\Petersplatz\Downloads\Messzettel1309.zip

2013-08-29 10:31 - 2013-08-29 10:30 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309.zip

2013-08-28 18:33 - 2013-06-07 20:25 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-28 18:31 - 2013-08-28 18:31 - 01528184 _____ (Microsoft Corporation) C:\Users\Petersplatz\Downloads\GenuineCheck.exe

2013-08-28 15:44 - 2013-08-04 18:02 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\dvdcss

2013-08-28 14:44 - 2013-05-22 15:50 - 00003440 _____ C:\windows\System32\Tasks\PCDEventLauncherTask

2013-08-27 18:12 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF

2013-08-24 17:17 - 2012-01-27 13:17 - 00000000 ____D C:\ProgramData\Nero

2013-08-24 17:17 - 2012-01-27 13:17 - 00000000 ____D C:\Program Files (x86)\Nero

2013-08-23 16:07 - 2013-01-04 12:30 - 00000000 ____D C:\Users\PETERS~1\AppData\Local\Nero

2013-08-22 20:58 - 2013-02-24 10:38 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-08-22 20:58 - 2013-02-24 10:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-08-22 20:58 - 2012-01-27 12:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-22 18:36 - 2013-08-28 18:12 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe

2013-08-16 10:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache

2013-08-15 14:25 - 2013-02-08 16:14 - 00045856 _____ (AVG Technologies) C:\windows\system32\Drivers\avgtpx64.sys

2013-08-15 14:25 - 2013-02-08 16:14 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search

2013-08-15 03:05 - 2013-07-25 20:49 - 00000000 ____D C:\windows\system32\MRT

2013-08-15 03:02 - 2013-01-04 13:42 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-08-14 18:29 - 2013-08-14 18:29 - 00010908 _____ C:\Users\Petersplatz\Downloads\Budget2014 (1).xlsx

2013-08-14 14:25 - 2013-08-14 14:25 - 00011988 _____ C:\Users\Petersplatz\Downloads\Plan der Woche.xlsx

2013-08-13 18:51 - 2013-08-13 18:51 - 00014753 _____ C:\Users\Petersplatz\Downloads\Aufgabenforum.xlsm

2013-08-13 18:51 - 2013-08-13 18:50 - 00023954 _____ C:\Users\Petersplatz\Downloads\Forum2013.xlsm

2013-08-12 14:22 - 2013-08-12 14:22 - 00001106 _____ C:\Users\Petersplatz\Downloads\url.htm

2013-08-12 12:14 - 2013-08-12 12:11 - 00011696 _____ C:\Users\Petersplatz\Downloads\Budget2014.xlsx

2013-08-10 15:13 - 2013-05-11 16:14 - 03207168 _____ C:\Users\Petersplatz\Desktop\Aktuelle Filmliste.xls

2013-08-10 10:35 - 2013-08-10 10:31 - 37455597 _____ (A.I.SOFT,INC.) C:\Users\Petersplatz\Downloads\HL-2130-inst-B1-useu (1).EXE

2013-08-08 19:02 - 2013-08-08 19:02 - 00003132 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Retry
 

Files to move or delete:

====================

C:\Users\PETERS~1\AppData\Local\Temp\Quarantine.exe

C:\Users\PETERS~1\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 20:41
 

==================== End Of Log ============================

--- --- ---

Code:

# AdwCleaner v3.002 - Bericht erstellt am 06/09/2013 um 15:35:25

# Updated 01/09/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Petersplatz - PPLAPTOP

# Gestartet von : C:\Users\Petersplatz\Desktop\adwcleaner.exe

# Option : Suchen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Datei Gefunden : C:\windows\System32\roboot64.exe

Ordner Gefunden : C:\Users\Petersplatz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Ordner Gefunden C:\Program Files (x86)\AVG Secure Search

Ordner Gefunden C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gefunden C:\ProgramData\AVG Secure Search

Ordner Gefunden C:\ProgramData\Uniblue\DriverScanner

Ordner Gefunden C:\Users\Gast\AppData\Local\AVG Secure Search

Ordner Gefunden C:\Users\Petersplatz\AppData\Local\AVG Secure Search

Ordner Gefunden C:\Users\Petersplatz\AppData\LocalLow\AVG Secure Search

Ordner Gefunden C:\Users\Petersplatz\AppData\LocalLow\boost_interprocess

Ordner Gefunden C:\Users\Petersplatz\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gefunden C:\Users\Petersplatz\AppData\Roaming\Systweak
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gefunden : HKCU\Software\AVG Secure Search

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : [x64] HKCU\Software\AVG Secure Search

Schlüssel Gefunden : HKLM\Software\AVG Secure Search

Schlüssel Gefunden : HKLM\Software\AVG Security Toolbar

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\driverscanner

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gefunden : HKLM\Software\systweak

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16660
 
 

-\\ Mozilla Firefox v19.0.2 (de)
 

[ Datei : C:\Users\Petersplatz\AppData\Roaming\Mozilla\Firefox\Profiles\lv4h1kzg.default\prefs.js ]
 
 

-\\ Google Chrome v29.0.1547.66
 

[ Datei : C:\Users\Petersplatz\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [5927 octets] - [06/09/2013 15:35:25]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5987 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.5.8 (09.05.2013:1)

OS: Windows 7 Home Premium x64

Ran by Petersplatz on 06.09.2013 at 15:41:19,88

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthelper.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\viprotocol.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\driverscanner

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\windows\syswow64\sho1B98.tmp
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Users\Petersplatz\AppData\Roaming\dvdvideosoftiehelpers"

Successfully deleted: [Folder] "C:\Users\Petersplatz\AppData\Roaming\systweak"

Successfully deleted: [Folder] "C:\Users\Petersplatz\appdata\locallow\boost_interprocess"

Successfully deleted: [Folder] "C:\Program Files (x86)\free video converter"

Successfully deleted: [Empty Folder] C:\Users\Petersplatz\appdata\local\{544BDE06-9AAB-4FAA-AE5B-C83F7035CD19}

Successfully deleted: [Empty Folder] C:\Users\Petersplatz\appdata\local\{66B6C61F-7940-4D6A-81DD-6ADF298A5784}

Successfully deleted: [Empty Folder] C:\Users\Petersplatz\appdata\local\{7A1FE3CB-ED79-4CD7-95BD-6147233F5D09}

Successfully deleted: [Empty Folder] C:\Users\Petersplatz\appdata\local\{7DC60B0A-8F43-4F3A-99AC-4340D4E50F87}

Successfully deleted: [Empty Folder] C:\Users\Petersplatz\appdata\local\{9E10920A-549E-4EBD-8408-68FF719FDD76}
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 06.09.2013 at 15:48:02,22

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.09.06.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16660

Petersplatz :: PPLAPTOP [Administrator]
 

Schutz: Aktiviert
 

06.09.2013 15:22:11

mbam-log-2013-09-06 (15-22-11).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 249161

Laufzeit: 4 Minute(n), 50 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Petersplatz\Downloads\rcpsetup_2005_file.net_ab_DE-iCh.exe (PUP.Optional.RegCleanerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Vielen Dank!
Biggy

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hi,
ich habe derzeit nur eine kurze Zwischenfrage: habe gestern ESET installiert und den Scan begonnen. Wollte nur vorsichtshalber fragen, ob es normal ist, dass nach 2 1/2 Stunden erst 31% des PC (+ eine externe Festplatte) gescannt sind? Bin heute früh vom Urlaub zurückgekommen und musste deswegen gestern Abend den Scan unterbrechen...

Bis jetzt hat sich übrigens leider nichts verändert am Absturzverhalten von WExplorer und Word...
Danke vielmals für alle Unterstützung!
Grüsse Biggy

Der Scan dauert schon mehrere Stunden :)

So, jetzt hab ich den Scan nochmal gemacht - er hat jetzt 1,5 Stunden gedauert... aber vielleicht hab ich auch wieder etwas gemurkst... nur: die gute Nachricht - warum auch immer, es funktioniert wieder alles!!!! Ich konnte den Drucker löschen, und weder der Explorer noch Word ist mir seither abgestürzt!!:crazy:
Ich poste aber trotzdem nochmal die Ergebnisse, der Vollständigkeit halber!

Code:

 Results of screen317's Security Check version 0.99.72  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

AVG AntiVirus Free Edition 2013   

 Antivirus out of date!  
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java 7 Update 21  

 Java version out of Date! 

 Adobe Flash Player 10 Flash Player out of Date! 

 Adobe Reader 10.1.6 Adobe Reader out of Date!  

 Mozilla Firefox 19.0.2 Firefox out of Date!  

 Google Chrome 29.0.1547.62  

 Google Chrome 29.0.1547.66  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 AVG avgwdsvc.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2013 01

Ran by Petersplatz (administrator) on PPLAPTOP on 07-09-2013 16:01:00

Running from C:\Users\Petersplatz\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Microsoft Corporation) C:\windows\system32\WLANExt.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Dropbox, Inc.) C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe

() C:\Program Files (x86)\AVG Secure Search\vprot.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe

(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [608112 2011-03-29] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)

HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()

HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()

HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)

HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\RunOnce: [Launcher] - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [163040 2010-08-12] (Softthinks)

HKCU\...\Run: [GoogleChromeAutoLaunch_DC2C44A93382AC9B5634D9F68269EB5C] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [829392 2013-09-02] (Google Inc.)

HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)

HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()

HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()

HKLM-x32\...\Run: [AdobeCS4ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-14] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)

HKLM-x32\...\Run: [Adobe_ID0ENQBO] - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe [378224 2008-08-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2314416 2013-08-15] ()

HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

Startup: C:\Users\Petersplatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Petersplatz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (Adobe Systems Incorporated.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (Adobe Systems Incorporated.)

Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
 

FireFox:

========

FF ProfilePath: C:\Users\Petersplatz\AppData\Roaming\Mozilla\Firefox\Profiles\lv4h1kzg.default

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\\npsitesafety.dll (AVG Technologies)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK
 

Chrome: 

=======

CHR RestoreOnStartup: "hxxp://www.google.at/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 7.0.10.8) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U1) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Drive) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (AVG Secure Search) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.5.0.2_0

CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0

CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.172_0

CHR Extension: (Gmail) - C:\Users\PETERS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\15.5.0.2\avg.crx

CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
 

==================== Services (Whitelisted) =================
 

S3 Adobe Version Cue CS4; C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [284016 2008-08-15] (Adobe Systems Incorporated)

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)

S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2013-06-13] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [1643184 2013-08-15] (AVG Secure Search)
 

==================== Drivers (Whitelisted) ====================
 

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\windows\system32\drivers\avgtpx64.sys [45856 2013-08-15] (AVG Technologies)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-07 15:58 - 2013-09-07 15:58 - 00001181 _____ C:\Users\Petersplatz\Desktop\checkup.txt

2013-09-07 15:55 - 2013-09-07 15:55 - 00891115 _____ C:\Users\Petersplatz\Desktop\SecurityCheck.exe

2013-09-06 18:56 - 2013-09-06 18:56 - 02347384 _____ (ESET) C:\Users\Petersplatz\Desktop\esetsmartinstaller_enu.exe

2013-09-06 15:48 - 2013-09-06 15:48 - 00004509 _____ C:\Users\Petersplatz\Desktop\JRT.txt

2013-09-06 15:41 - 2013-09-06 15:41 - 00000000 ____D C:\windows\ERUNT

2013-09-06 15:40 - 2013-09-06 15:40 - 01028823 _____ (Thisisu) C:\Users\Petersplatz\Desktop\JRT.exe

2013-09-06 15:35 - 2013-09-06 15:35 - 00000000 ____D C:\AdwCleaner

2013-09-06 15:30 - 2013-09-06 15:30 - 01037222 _____ C:\Users\Petersplatz\Desktop\adwcleaner.exe

2013-09-06 15:19 - 2013-09-06 15:19 - 00001107 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-06 15:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-09-06 15:17 - 2013-09-06 15:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Petersplatz\Desktop\mbam-setup-1.75.0.1300.exe

2013-09-06 10:11 - 2013-09-06 10:11 - 00025269 _____ C:\ComboFix.txt

2013-09-06 09:59 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe

2013-09-06 09:59 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe

2013-09-06 09:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe

2013-09-06 09:59 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe

2013-09-06 09:58 - 2013-09-06 10:11 - 00000000 ____D C:\Qoobox

2013-09-06 09:58 - 2013-09-06 10:10 - 00000000 ____D C:\windows\erdnt

2013-09-06 09:52 - 2013-09-06 09:52 - 05120615 ____R (Swearware) C:\Users\Petersplatz\Desktop\ComboFix.exe

2013-09-05 16:18 - 2013-09-05 16:18 - 00006227 _____ C:\Users\Petersplatz\Desktop\Scan_20130905.log

2013-09-05 15:40 - 2013-09-05 15:40 - 00377856 _____ C:\Users\Petersplatz\Desktop\gmer_2.1.19163.exe

2013-09-05 12:58 - 2013-09-05 12:58 - 00000486 _____ C:\Users\Petersplatz\Desktop\defogger_disable.log

2013-09-05 12:45 - 2013-09-05 12:46 - 00037921 _____ C:\Users\Petersplatz\Desktop\Addition.txt

2013-09-05 12:44 - 2013-09-05 12:44 - 00000000 ____D C:\FRST

2013-09-05 12:43 - 2013-09-05 12:43 - 00000725 _____ C:\Users\Petersplatz\Desktop\Defogger - Verknüpfung.lnk

2013-09-05 12:41 - 2013-09-05 12:41 - 00000484 _____ C:\Users\Petersplatz\Downloads\defogger_disable.log

2013-09-05 12:41 - 2013-09-05 12:41 - 00000000 _____ C:\Users\Petersplatz\defogger_reenable

2013-09-05 10:55 - 2013-09-05 10:55 - 00050477 _____ C:\Users\Petersplatz\Downloads\Defogger.exe

2013-09-01 10:24 - 2013-09-01 10:24 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309 (1).zip

2013-08-29 10:33 - 2013-08-29 10:33 - 00515927 _____ C:\Users\Petersplatz\Downloads\Messzettel1309.zip

2013-08-29 10:30 - 2013-08-29 10:31 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309.zip

2013-08-28 18:31 - 2013-08-28 18:31 - 01528184 _____ (Microsoft Corporation) C:\Users\Petersplatz\Downloads\GenuineCheck.exe

2013-08-28 18:12 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe

2013-08-28 14:32 - 2013-09-01 10:25 - 01335639 _____ C:\Users\Petersplatz\Desktop\Messbuch 1309.epub

2013-08-15 03:10 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-08-15 03:10 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-08-15 03:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-08-15 03:10 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-08-15 03:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-08-15 03:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-08-15 03:10 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-08-15 03:10 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-08-15 03:10 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-08-15 03:10 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-08-15 03:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-08-15 03:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-08-15 03:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-08-15 03:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-14 18:29 - 2013-08-14 18:29 - 00010908 _____ C:\Users\Petersplatz\Downloads\Budget2014 (1).xlsx

2013-08-14 14:25 - 2013-08-14 14:25 - 00011988 _____ C:\Users\Petersplatz\Downloads\Plan der Woche.xlsx

2013-08-14 12:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll

2013-08-14 12:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll

2013-08-14 12:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll

2013-08-14 12:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll

2013-08-14 12:55 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL

2013-08-14 12:55 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL

2013-08-14 12:55 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2013-08-14 12:55 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

2013-08-14 12:55 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2013-08-14 12:55 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

2013-08-14 12:54 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2013-08-14 12:54 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2013-08-14 12:54 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2013-08-14 12:54 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2013-08-14 12:54 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2013-08-14 12:54 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2013-08-14 12:54 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2013-08-14 12:54 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2013-08-14 12:54 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2013-08-14 12:54 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2013-08-14 12:54 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2013-08-14 12:54 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2013-08-14 12:54 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys

2013-08-13 18:51 - 2013-08-13 18:51 - 00014753 _____ C:\Users\Petersplatz\Downloads\Aufgabenforum.xlsm

2013-08-13 18:50 - 2013-08-13 18:51 - 00023954 _____ C:\Users\Petersplatz\Downloads\Forum2013.xlsm

2013-08-12 14:22 - 2013-08-12 14:22 - 00001106 _____ C:\Users\Petersplatz\Downloads\url.htm

2013-08-12 12:11 - 2013-08-12 12:14 - 00011696 _____ C:\Users\Petersplatz\Downloads\Budget2014.xlsx

2013-08-10 10:31 - 2013-08-10 10:35 - 37455597 _____ (A.I.SOFT,INC.) C:\Users\Petersplatz\Downloads\HL-2130-inst-B1-useu (1).EXE

2013-08-08 19:02 - 2013-08-08 19:02 - 00003132 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Retry
 

==================== One Month Modified Files and Folders =======
 

2013-09-07 16:00 - 2013-09-07 15:59 - 01948682 _____ (Farbar) C:\Users\Petersplatz\Desktop\FRST64.exe

2013-09-07 15:58 - 2013-09-07 15:58 - 00001181 _____ C:\Users\Petersplatz\Desktop\checkup.txt

2013-09-07 15:55 - 2013-09-07 15:55 - 00891115 _____ C:\Users\Petersplatz\Desktop\SecurityCheck.exe

2013-09-07 15:50 - 2013-01-04 12:43 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-09-07 15:50 - 2013-01-04 12:43 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-09-07 15:22 - 2013-02-24 10:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-09-07 15:10 - 2012-01-27 14:39 - 00700418 _____ C:\windows\system32\perfh007.dat

2013-09-07 15:10 - 2012-01-27 14:39 - 00149182 _____ C:\windows\system32\perfc007.dat

2013-09-07 15:10 - 2009-07-14 07:13 - 01621244 _____ C:\windows\system32\PerfStringBackup.INI

2013-09-07 15:08 - 2012-01-27 12:47 - 01829755 _____ C:\windows\WindowsUpdate.log

2013-09-07 14:13 - 2012-01-27 13:31 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-09-07 11:42 - 2013-05-22 15:50 - 00003440 _____ C:\windows\System32\Tasks\PCDEventLauncherTask

2013-09-07 11:36 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-07 11:36 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-07 11:33 - 2013-02-08 16:09 - 00000000 ____D C:\ProgramData\MFAData

2013-09-07 11:30 - 2013-01-08 12:44 - 00000000 ___RD C:\Users\Petersplatz\Dropbox

2013-09-07 11:30 - 2013-01-08 12:38 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Dropbox

2013-09-07 11:29 - 2013-01-04 12:10 - 00000000 ____D C:\Users\PETERS~1\AppData\Local\SoftThinks

2013-09-07 11:28 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-09-07 11:28 - 2009-07-14 06:51 - 00074952 _____ C:\windows\setupact.log

2013-09-06 18:56 - 2013-09-06 18:56 - 02347384 _____ (ESET) C:\Users\Petersplatz\Desktop\esetsmartinstaller_enu.exe

2013-09-06 17:28 - 2013-01-04 20:47 - 00000000 ____D C:\Users\Petersplatz\Documents\Petersplatz Haus

2013-09-06 15:48 - 2013-09-06 15:48 - 00004509 _____ C:\Users\Petersplatz\Desktop\JRT.txt

2013-09-06 15:41 - 2013-09-06 15:41 - 00000000 ____D C:\windows\ERUNT

2013-09-06 15:40 - 2013-09-06 15:40 - 01028823 _____ (Thisisu) C:\Users\Petersplatz\Desktop\JRT.exe

2013-09-06 15:35 - 2013-09-06 15:35 - 00000000 ____D C:\AdwCleaner

2013-09-06 15:32 - 2010-11-21 05:47 - 00035534 _____ C:\windows\PFRO.log

2013-09-06 15:30 - 2013-09-06 15:30 - 01037222 _____ C:\Users\Petersplatz\Desktop\adwcleaner.exe

2013-09-06 15:19 - 2013-09-06 15:19 - 00001107 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-06 15:19 - 2013-09-06 15:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-06 15:17 - 2013-09-06 15:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Petersplatz\Desktop\mbam-setup-1.75.0.1300.exe

2013-09-06 10:11 - 2013-09-06 10:11 - 00025269 _____ C:\ComboFix.txt

2013-09-06 10:11 - 2013-09-06 09:58 - 00000000 ____D C:\Qoobox

2013-09-06 10:11 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default

2013-09-06 10:10 - 2013-09-06 09:58 - 00000000 ____D C:\windows\erdnt

2013-09-06 10:09 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini

2013-09-06 09:52 - 2013-09-06 09:52 - 05120615 ____R (Swearware) C:\Users\Petersplatz\Desktop\ComboFix.exe

2013-09-05 16:18 - 2013-09-05 16:18 - 00006227 _____ C:\Users\Petersplatz\Desktop\Scan_20130905.log

2013-09-05 15:40 - 2013-09-05 15:40 - 00377856 _____ C:\Users\Petersplatz\Desktop\gmer_2.1.19163.exe

2013-09-05 12:58 - 2013-09-05 12:58 - 00000486 _____ C:\Users\Petersplatz\Desktop\defogger_disable.log

2013-09-05 12:46 - 2013-09-05 12:45 - 00037921 _____ C:\Users\Petersplatz\Desktop\Addition.txt

2013-09-05 12:44 - 2013-09-05 12:44 - 00000000 ____D C:\FRST

2013-09-05 12:43 - 2013-09-05 12:43 - 00000725 _____ C:\Users\Petersplatz\Desktop\Defogger - Verknüpfung.lnk

2013-09-05 12:41 - 2013-09-05 12:41 - 00000484 _____ C:\Users\Petersplatz\Downloads\defogger_disable.log

2013-09-05 12:41 - 2013-09-05 12:41 - 00000000 _____ C:\Users\Petersplatz\defogger_reenable

2013-09-05 12:41 - 2013-01-04 12:10 - 00000000 ____D C:\Users\Petersplatz

2013-09-05 10:55 - 2013-09-05 10:55 - 00050477 _____ C:\Users\Petersplatz\Downloads\Defogger.exe

2013-09-03 18:06 - 2012-01-27 13:16 - 00000000 ____D C:\ProgramData\Sonic

2013-09-02 17:46 - 2013-03-22 20:43 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\vlc

2013-09-01 10:25 - 2013-08-28 14:32 - 01335639 _____ C:\Users\Petersplatz\Desktop\Messbuch 1309.epub

2013-09-01 10:24 - 2013-09-01 10:24 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309 (1).zip

2013-08-31 10:44 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-08-31 10:37 - 2013-05-01 15:50 - 00000375 _____ C:\windows\system32\Drivers\etc\hosts.ics

2013-08-29 14:57 - 2012-01-27 13:21 - 00000000 ____D C:\ProgramData\WildTangent

2013-08-29 10:33 - 2013-08-29 10:33 - 00515927 _____ C:\Users\Petersplatz\Downloads\Messzettel1309.zip

2013-08-29 10:31 - 2013-08-29 10:30 - 05294724 _____ C:\Users\Petersplatz\Downloads\Messbuch1309.zip

2013-08-28 18:33 - 2013-06-07 20:25 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-28 18:31 - 2013-08-28 18:31 - 01528184 _____ (Microsoft Corporation) C:\Users\Petersplatz\Downloads\GenuineCheck.exe

2013-08-28 15:44 - 2013-08-04 18:02 - 00000000 ____D C:\Users\Petersplatz\AppData\Roaming\dvdcss

2013-08-27 18:12 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF

2013-08-24 17:17 - 2012-01-27 13:17 - 00000000 ____D C:\ProgramData\Nero

2013-08-24 17:17 - 2012-01-27 13:17 - 00000000 ____D C:\Program Files (x86)\Nero

2013-08-23 16:07 - 2013-01-04 12:30 - 00000000 ____D C:\Users\PETERS~1\AppData\Local\Nero

2013-08-22 20:58 - 2013-02-24 10:38 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-08-22 20:58 - 2013-02-24 10:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-08-22 20:58 - 2012-01-27 12:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-22 18:36 - 2013-08-28 18:12 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe

2013-08-16 10:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache

2013-08-15 14:25 - 2013-02-08 16:14 - 00045856 _____ (AVG Technologies) C:\windows\system32\Drivers\avgtpx64.sys

2013-08-15 14:25 - 2013-02-08 16:14 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search

2013-08-15 03:05 - 2013-07-25 20:49 - 00000000 ____D C:\windows\system32\MRT

2013-08-15 03:02 - 2013-01-04 13:42 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-08-14 18:29 - 2013-08-14 18:29 - 00010908 _____ C:\Users\Petersplatz\Downloads\Budget2014 (1).xlsx

2013-08-14 14:25 - 2013-08-14 14:25 - 00011988 _____ C:\Users\Petersplatz\Downloads\Plan der Woche.xlsx

2013-08-13 18:51 - 2013-08-13 18:51 - 00014753 _____ C:\Users\Petersplatz\Downloads\Aufgabenforum.xlsm

2013-08-13 18:51 - 2013-08-13 18:50 - 00023954 _____ C:\Users\Petersplatz\Downloads\Forum2013.xlsm

2013-08-12 14:22 - 2013-08-12 14:22 - 00001106 _____ C:\Users\Petersplatz\Downloads\url.htm

2013-08-12 12:14 - 2013-08-12 12:11 - 00011696 _____ C:\Users\Petersplatz\Downloads\Budget2014.xlsx

2013-08-10 15:13 - 2013-05-11 16:14 - 03207168 _____ C:\Users\Petersplatz\Desktop\Aktuelle Filmliste.xls

2013-08-10 10:35 - 2013-08-10 10:31 - 37455597 _____ (A.I.SOFT,INC.) C:\Users\Petersplatz\Downloads\HL-2130-inst-B1-useu (1).EXE

2013-08-08 19:02 - 2013-08-08 19:02 - 00003132 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Retry
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 20:41
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=926daeee5571b641b671a4f0d8b2d56d

# engine=15034

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-09-06 08:10:58

# local_time=2013-09-06 10:10:58 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1043 16777213 100 87 44373 65632242 0 0

# compatibility_mode=5893 16776574 100 94 4930507 130128108 0 0

# scanned=146041

# found=0

# cleaned=0

# scan_time=8488

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=926daeee5571b641b671a4f0d8b2d56d

# engine=15043

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-09-07 01:26:42

# local_time=2013-09-07 03:26:42 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1043 16777213 100 87 14049 65694386 0 0

# compatibility_mode=5893 16776574 100 94 4992651 130190252 0 0

# scanned=137080

# found=0

# cleaned=0

# scan_time=4384

Also, momentan einfach nur vielen Dank für die Hilfe!!! :dankeschoen:
------------------------------------------------------------------------------------------------------------------------------------
Oh je, zu früh gefreut!!!! Seit dem letzten Neustart funktionieren mehrere Dinge nicht mehr...

Code:

Fehlerbucket 3779131704, Typ 1

Ereignisname: APPCRASH

Antwort: Nicht verfügbar

CAB-Datei-ID: 0
 

Problemsignatur:

P1: ELBA5.exe

P2: 11.0.0.0

P3: 4b73e4e3

P4: ntdll.dll

P5: 6.1.7601.18205

P6: 51db9710

P7: c0000005

P8: 000222d2

P9: 

P10:

Code:

Name der fehlerhaften Anwendung: ELBA5.exe, Version: 11.0.0.0, Zeitstempel: 0x4b73e4e3

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000222d2

ID des fehlerhaften Prozesses: 0xcc4

Startzeit der fehlerhaften Anwendung: 0x01ceabd879dfe483

Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\ELBA5\ELBA5.exe

Pfad des fehlerhaften Moduls: C:\windows\SysWOW64\ntdll.dll

Berichtskennung: b89246c1-17cb-11e3-99af-24b6fd1d0888

Code:

Fehlerbucket , Typ 0

Ereignisname: CLR20r3

Antwort: Nicht verfügbar

CAB-Datei-ID: 0
 

Problemsignatur:

P1: iastoricon.exe

P2: 10.1.2.1004

P3: 4d2e5bcf

P4: System.Xml

P5: 2.0.0.0

P6: 51e9fc46

P7: 212e

P8: 274

P9: System.UnauthorizedAccess

P10: 
 

Angefügte Dateien:
 

Diese Dateien befinden sich möglicherweise hier:

C:\Users\Petersplatz\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_iastoricon.exe_ac217241a4f8509fc63a4c5c557ac853777860bd_cab_12b1907b
 

Analysesymbol: 

Es wird erneut nach einer Lösung gesucht: 0

Berichts-ID: a4a5dab0-17cb-11e3-99af-24b6fd1d0888

Berichtstatus: 36

Code:

Dem Computer wurde (vom DHCP-Server) keine Adresse aus dem Netzwerk für die Netzwerkkarte mit der Netzwerkadresse 0x64273768C763 zugewiesen. Fehler: 0x79. Der Computer versucht, weiterhin selbständig eine Adresse vom Netzwerkadressserver (DHCP-Server) abzurufen.

Code:

Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 

Zugriff verweigert

Außerdem konnte Dropbox nicht gestartet werden (Pop-up-Meldung)

???? Vielen Dank....!!
Grüße Biggy
Grüße Biggy

Es gehen immer weniger Dinge... ich kann keine Word- und keine Excel-Dateien mehr öffnen (Dateien, die auf dem PC gespeichert sind)

Fehlermeldungen:

Code:

Protokollname: OAlerts

Quelle:        Microsoft Office 14 Alerts

Datum:         07.09.2013 18:58:48

Ereignis-ID:   300

Aufgabenkategorie:Keine

Ebene:         Informationen

Schlüsselwörter:Klassisch

Benutzer:      Nicht zutreffend

Computer:      PpLaptop

Beschreibung:

Microsoft Excel

Auf '04 April 2013.xls' konnte nicht zugegriffen werden. Unter Umständen ist die Datei beschädigt, befindet sich auf einem Server, der nicht mehr reagiert, oder die Datei ist schreibgeschützt.

P1: 100101

P2: 14.0.6029.1000

P3: 50tm

P4: 0x80030005
 

Ereignis-XML:

<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft Office 14 Alerts" />

    <EventID Qualifiers="0">300</EventID>

    <Level>4</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2013-09-07T16:58:48.000000000Z" />

    <EventRecordID>185</EventRecordID>

    <Channel>OAlerts</Channel>

    <Computer>PpLaptop</Computer>

    <Security />

  </System>

  <EventData>

    <Data>Microsoft Excel

</Data>

    <Data>Auf '04 April 2013.xls' konnte nicht zugegriffen werden. Unter Umständen ist die Datei beschädigt, befindet sich auf einem Server, der nicht mehr reagiert, oder die Datei ist schreibgeschützt.

</Data>

    <Data>100101

</Data>

    <Data>14.0.6029.1000

</Data>

    <Data>50tm

</Data>

    <Data>0x80030005

</Data>

  </EventData>

</Event>

Code:

Protokollname: OAlerts

Quelle:        Microsoft Office 14 Alerts

Datum:         07.09.2013 18:58:45

Ereignis-ID:   300

Aufgabenkategorie:Keine

Ebene:         Informationen

Schlüsselwörter:Klassisch

Benutzer:      Nicht zutreffend

Computer:      PpLaptop

Beschreibung:

Microsoft Excel

Excel kann auf die Daten in '04 April 2013.xls' nicht zugreifen. Die Datei ist unter Umständen schreibgeschützt oder verschlüsselt.

P1: 101070

P2: 14.0.6029.1000

P3: 

P4: 
 

Ereignis-XML:

<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft Office 14 Alerts" />

    <EventID Qualifiers="0">300</EventID>

    <Level>4</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2013-09-07T16:58:45.000000000Z" />

    <EventRecordID>184</EventRecordID>

    <Channel>OAlerts</Channel>

    <Computer>PpLaptop</Computer>

    <Security />

  </System>

  <EventData>

    <Data>Microsoft Excel

</Data>

    <Data>Excel kann auf die Daten in '04 April 2013.xls' nicht zugreifen. Die Datei ist unter Umständen schreibgeschützt oder verschlüsselt.

</Data>

    <Data>101070

</Data>

    <Data>14.0.6029.1000

</Data>

    <Data>

    </Data>

    <Data>

    </Data>

  </EventData>

</Event>

Code:

Protokollname: OAlerts

Quelle:        Microsoft Office 14 Alerts

Datum:         07.09.2013 19:19:11

Ereignis-ID:   300

Aufgabenkategorie:Keine

Ebene:         Informationen

Schlüsselwörter:Klassisch

Benutzer:      Nicht zutreffend

Computer:      PpLaptop

Beschreibung:

Microsoft Word

Fehler beim Öffnen der Datei in Word.

Versuchen Sie Folgendes:

* Überprüfen Sie die Dateiberechtigungen für das Dokument oder Laufwerk.

* Stellen Sie sicher, dass genügend Arbeitsspeicher oder Speicherplatz vorhanden ist.

* Öffnen Sie die Datei mit dem Wiederherstellen-Textkonverter.

 (C:\Users\...\Deckblatt Handbuch.doc)

P1: 200494

P2: 14.0.6029.1000

P3: 3w3z

P4: 
 

Ereignis-XML:

<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft Office 14 Alerts" />

    <EventID Qualifiers="0">300</EventID>

    <Level>4</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2013-09-07T17:19:11.000000000Z" />

    <EventRecordID>189</EventRecordID>

    <Channel>OAlerts</Channel>

    <Computer>PpLaptop</Computer>

    <Security />

  </System>

  <EventData>

    <Data>Microsoft Word

</Data>

    <Data>Fehler beim Öffnen der Datei in Word.

Versuchen Sie Folgendes:

* Überprüfen Sie die Dateiberechtigungen für das Dokument oder Laufwerk.

* Stellen Sie sicher, dass genügend Arbeitsspeicher oder Speicherplatz vorhanden ist.

* Öffnen Sie die Datei mit dem Wiederherstellen-Textkonverter.

 (C:\Users\...\Deckblatt Handbuch.doc)

</Data>

    <Data>200494

</Data>

    <Data>14.0.6029.1000

</Data>

    <Data>3w3z

</Data>

    <Data>

    </Data>

  </EventData>

</Event>

Die Dateien sind weder schreibgeschützt noch verschlüsselt. Heute vormittag konnte ich sie auch noch öffnen...

Soll ich vielleicht noch einmal den ESET-Scan vollständig machen?

Danke und sorry für die vielen Postings, aber es passieren ständig neue Dinge....
Biggy

Java, Flash , Adobe und Firefox updaten.

Downloade dir bitte Windows Repair (All In One) von hier.

Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
Klicke auf Step 2 und drücke unter Check Disk auf Do It.

http://i1224.photobucket.com/albums/...3/Capture3.gif
Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.

http://i1224.photobucket.com/albums/...y3/Capture.gif
Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.

http://i1224.photobucket.com/albums/...3/Capture1.gif
Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
Hake Restart System when Finished an.
Drücke Start.

http://i1238.photobucket.com/albums/...eakingtool.jpg

Lieber Schrauber!
Jetzt hab ich nach dem Windows-Repair ein bisschen gewartet mit der Antwort, um nicht wieder eine voreilige "Geschafft"-Meldung zu schicken... aber es sieht so aus, als ob wirklich alles wieder funktionieren würde!!! ich habe gestern den ganzen Tag und heute bis jetzt am Laptop gearbeitet, praktisch alle Programme verwendet und es geht!!
Also, jetzt hoffentlich endgültig VIELEN DANK FÜR DIE HILFE!
(Kann man sagen, was eigentlich das Problem war?)
Viele Grüße
Biggy

Durch die Malware verbogene Dienste :)

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Also, ich hab alle Schritte gemacht, alles ist gelöscht, und die von dir geratenen Programme sind installiert! Und es läuft immer noch alles...!:lach:

(Im Nachhinein fällt mir auf, dass tatsächlich seit einiger Zeit beim Runterfahren keine Updates mehr gemacht wurden... werde in Zukunft besser aufpassen auf solche Dinge...!)

Vielen Dank nochmals für die Hilfe, werde Euch sicher weiterempfehlen!!

Viele Grüße
Biggy