Trojaner-Board - Trojaner amxreadd.exe Bundespolizei

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Trojaner amxreadd.exe Bundespolizei (https://www.trojaner-board.de/148877-trojaner-amxreadd-exe-bundespolizei.html)

Trojaner amxreadd.exe Bundespolizei

Hallo zusammen,

erst mal bin ich froh, dass ich auf diese Forum gestoßen, ich hoffe Ihr könnt mir helfen:

Mein Pc: Acer/Windows 7 - Baujahr 2009

Ich habe vor ca. 30 Tagen die bekannte Bundespolizei Nachricht auf dem PC erhalten. Das System war danach festgefrohren. Ich habe den PC neu gestartet. Es hat nichts gebracht. Anschließend über den Task Manager das Programm beendet und dachte okay das wars. Als mein Pc dann immer wieder unerwartet abstürzte und ein blauer Bildschirm auftauchte, der mich warnte, dass das System runtergefahren wird um weiteren Schaden zu vermeiden, musste ich etwas unternehmen. Ein zweites mal hatte ich einen frostzustand wo man nichts mehr auf dem Bilschirm erkennen konnte, ausser bunten Farben im Frostzustand.
Aktuell kommen diese Symtome täglich vor.

Ich habe anschließend avast free antivirus aufgespielt. Parallel habe ich seit 10 Jahre Avira freeAntivirus laufen. Die Avast Quarantäne habe ich hier im Anhang als Screenshot gepostet.

Avast teilt jetzt folgende Viren/Bedrohungen mit:
1. amxreadd.exe
2. 3.exe
3. DlProtectSvc.exe - HIer ist mir das Symbol aufgefallen, dass plötzlich unten rechts in der Symbolleiste als Weltkugel auftauchte.
4. main.class - Java

Parallel dazu habe ich auch AdwCleaner durchlaufen lassen - Hierzu habe ich 2 Screenshots gepostet.

Da ich die letzten 10 Jahre immer zufrieden war mit Avira freeantivirus hat es mich jetzt letztendlich doch erwischt und wie es aussieht muss ich mir eine andere Lösung einfallen lassen.

Ich hoffe man kann mir helfen - Da ich schon Tage damit verbracht habe dem ganzen Spuk ein Ende zu bereiten. Ich hätte die Bedrohungen in der Quarantäne auch einfach löschen können, nur bin ich mir nicht sicher, ob ich damit meinen Rechner schädige, bzw. alles komplett lahm lege, da hier ja auch Dateien aus dem System32 Ordner befallen sind.

Ich würde mich sehr freuen wenn mir jemand helfen kann bevor mein Pc in die Brüche geht und alle Daten verloren gehen :dummguck:
Ps: Wie sieht es mit diesen Appdriver/Reparaturdatenträger und Recovery CD's von Windows 7 - Lässt sich damit auch etwas reparieren oder zeigt mir die DVD an was repariert oder ersetzt werden müsste?

Ich habe hierzu auch einen chip Bericht gefunden: Mit dem Kaspersky WindowsUnlocker den Bundespolizei Trojaner entfernen. Bin mir aber nicht sicher ob das mein Problem löst?

Vielen Vielen Dank!
Benny23

Anhang 64252

Anhang 64254

Anhang 64255

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hallo, vielen Dank erst mal das ging ja flott :)

Hier die Daten:
FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01

Ran by Halbig (administrator) on BENJI on 29-01-2014 15:14:40

Running from C:\Users\Halbig\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Wireless) C:\Program Files (x86)\TP-LINK\QSS\jswpbapi.exe

() C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

() C:\OEM\USBDECTION\USBS3S4Detection.exe

() C:\Program Files (x86)\TP-LINK\QSS\jswtrayutil.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Seiko Epson Corporation) E:\InstallNavi.exe

(SEIKO EPSON CORPORATION) E:\Network\EpsonNetSetup\ENEasyApp.exe

(SEIKO EPSON CORPORATION) E:\Network\EpsonNetSetup\x64\EpDevMgr.exe

(Wireless) C:\Program Files (x86)\TP-LINK\QSS\jswpsapi.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9955872 2010-01-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [609312 2010-05-06] ()

HKLM-x32\...\Run: [MDS_Menu] - C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [jswtrayutil] - C:\Program Files (x86)\TP-LINK\QSS\jswtrayutil.exe [32871 2010-04-21] ()

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2014-01-13] (AVAST Software)

HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)

MountPoints2: {f4cb7b30-99b1-11e0-b2ec-806e6f6e6963} - E:\InstallNavi.exe

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173606112207pe478v195w4761v047

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKCU - {205937E1-F9F7-45F9-8FCC-BC6D132ABC14} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3317892&CUI=UN36093365951008931&UM=2&SSPV=S41BIE

SearchScopes: HKCU - {38DD9B2C-D2EF-4626-96F0-D356DA985CEC} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=937811&p={searchTerms}

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU - No Name - {CB789373-04D5-4EF4-9C16-871463FD0830} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\searchplugins\google-default.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: DownloadHelper - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-13]

FF Extension: Hide My Ass Proxy Extension - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\extension@hidemyass.com.xpi [2014-01-13]

FF Extension: ebayitemdescriptionsaveenlargedp - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{ba2430e0-5b72-4cac-bc9e-7d1aaca75d3d}.xpi [2014-01-13]

FF Extension: Adblock Plus - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-13]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-13]
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-01-13] (AVAST Software)

R2 jswpbapi; C:\Program Files (x86)\TP-LINK\QSS\jswpbapi.exe [265216 2010-04-20] (Wireless)

R3 jswpsapi; C:\Program Files (x86)\TP-LINK\QSS\jswpsapi.exe [954368 2010-04-20] (Wireless)

R2 MagicTuneEngine; C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] ()

R2 RichVideo; C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904 2010-02-03] ()

R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
 

==================== Drivers (Whitelisted) ====================
 

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.)

R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-13] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-13] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-13] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-13] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-13] (AVAST Software)

R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-13] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-29 15:14 - 2014-01-29 15:15 - 00014053 _____ C:\Users\Halbig\Downloads\FRST.txt

2014-01-29 15:14 - 2014-01-29 15:14 - 02079744 _____ (Farbar) C:\Users\Halbig\Downloads\FRST64.exe

2014-01-29 15:14 - 2014-01-29 15:14 - 00000000 ____D C:\FRST

2014-01-29 14:37 - 2014-01-29 14:37 - 00002171 _____ C:\Users\Public\Desktop\Epson Easy Photo Print.lnk

2014-01-29 14:36 - 2014-01-29 14:36 - 00000000 ____D C:\Program Files\Epson Software

2014-01-29 14:35 - 2014-01-29 14:35 - 00002390 _____ C:\Users\Public\Desktop\Netzwerkhandbuch EPSON SX235 Series.lnk

2014-01-29 14:35 - 2014-01-29 14:35 - 00002390 _____ C:\Users\Public\Desktop\Benutzerhandbuch EPSON SX235 Series.lnk

2014-01-29 14:34 - 2014-01-29 14:34 - 00000934 _____ C:\Users\Public\Desktop\EPSON Scan.lnk

2014-01-29 14:34 - 2014-01-29 14:34 - 00000000 ____D C:\Program Files\EpsonNet

2014-01-29 14:34 - 2011-08-30 13:40 - 00535040 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\ensppui.dll

2014-01-29 14:34 - 2011-08-30 13:40 - 00535040 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enppui.dll

2014-01-29 14:34 - 2011-08-30 13:38 - 00558080 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\ensppmon.dll

2014-01-29 14:34 - 2011-08-30 13:38 - 00558080 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enppmon.dll

2014-01-29 14:34 - 2011-08-10 00:00 - 00464384 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll

2014-01-29 14:34 - 2011-08-01 18:24 - 00250880 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enspres.dll

2014-01-29 14:34 - 2011-08-01 18:24 - 00250880 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enpres.dll

2014-01-29 14:34 - 2009-10-16 00:00 - 00132560 _____ (Seiko Epson Corporation) C:\Windows\system32\esdevapp.exe

2014-01-29 14:34 - 2009-10-16 00:00 - 00013824 _____ (Seiko Epson Corporation) C:\Windows\system32\esxcdev.dll

2014-01-29 13:20 - 2014-01-29 14:35 - 00000000 ____D C:\Users\Halbig\Desktop\Pc Problem

2014-01-29 12:47 - 2014-01-29 12:47 - 01166132 _____ C:\Users\Halbig\Downloads\adwcleaner.exe

2014-01-29 00:59 - 2014-01-29 00:59 - 00275304 _____ C:\Windows\Minidump\012914-40638-01.dmp

2014-01-26 18:53 - 2014-01-26 18:53 - 00279432 _____ C:\Windows\Minidump\012614-46597-01.dmp

2014-01-25 11:32 - 2014-01-25 11:32 - 00001299 _____ C:\Users\Halbig\Desktop\Unbenannt - Verknüpfung.lnk

2014-01-23 20:50 - 2014-01-23 21:15 - 00000000 ____D C:\Users\Halbig\.gimp-2.8

2014-01-23 20:50 - 2014-01-23 20:50 - 00000000 ____D C:\Users\Halbig\AppData\Local\gegl-0.2

2014-01-23 20:35 - 2014-01-23 20:35 - 00000000 ____D C:\Program Files\GIMP 2

2014-01-23 20:31 - 2014-01-23 20:32 - 00000000 ____D C:\Program Files (x86)\GIMP 2

2014-01-23 01:47 - 2014-01-23 01:48 - 00000000 ____D C:\Users\Halbig\Desktop\Phantom der Oper

2014-01-21 14:21 - 2014-01-23 01:48 - 00000000 ____D C:\Users\Halbig\Desktop\Bewerbungen 2014

2014-01-16 14:07 - 2014-01-16 14:07 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-16 14:07 - 2014-01-16 14:07 - 00000000 ____D C:\Program Files\Java

2014-01-15 23:34 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 23:34 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 23:34 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-13 17:40 - 2014-01-13 17:40 - 00125440 _____ C:\Windows\system32\DlProtectSvc.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00118784 _____ C:\Windows\system32\amxreadd.exe

2014-01-13 14:21 - 2014-01-29 12:47 - 00000000 ____D C:\AdwCleaner

2014-01-13 09:43 - 2014-01-13 09:43 - 00002746 _____ C:\Users\Halbig\Desktop\Rkill.txt

2014-01-13 02:52 - 2014-01-13 02:52 - 00000000 ____D C:\ProgramData\Oracle

2014-01-13 02:40 - 2014-01-13 02:40 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView

2014-01-13 02:39 - 2014-01-13 02:39 - 00003138 _____ C:\Windows\System32\Tasks\{C5C75039-A08B-4E61-8475-E111EEA94580}

2014-01-13 02:22 - 2014-01-13 02:22 - 00001970 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-13 02:22 - 2014-01-13 02:22 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\AVAST Software

2014-01-13 02:21 - 2014-01-26 22:01 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-13 02:20 - 2014-01-29 10:46 - 00000000 ____D C:\Program Files (x86)\Google

2014-01-13 02:20 - 2014-01-13 02:21 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-13 02:20 - 2014-01-13 02:20 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D C:\ProgramData\AVAST Software

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D C:\Program Files\AVAST Software

2014-01-13 01:57 - 2014-01-13 01:57 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Mozilla

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-07 11:18 - 2014-01-29 12:18 - 00013682 _____ C:\Windows\PFRO.log

2014-01-07 10:44 - 2014-01-07 10:44 - 00001268 _____ C:\Users\Halbig\Desktop\Revo Uninstaller.lnk

2014-01-06 01:12 - 2014-01-23 01:50 - 00000000 ____D C:\Users\Halbig\Desktop\Verschiedenes

2014-01-05 20:43 - 2014-01-29 02:00 - 00014336 _____ C:\Users\Halbig\Desktop\Arbeitszeiten.xls

2014-01-05 17:17 - 2014-01-05 17:17 - 00007605 _____ C:\Users\Halbig\AppData\Local\Resmon.ResmonCfg

2014-01-02 00:48 - 2014-01-02 00:48 - 00000000 ____D C:\Users\Halbig\Documents\Steuersparer

2014-01-01 23:45 - 2014-01-01 23:45 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Buhl Data Service

2014-01-01 23:44 - 2014-01-07 10:57 - 00000650 _____ C:\Windows\wiso.ini

2014-01-01 23:44 - 2014-01-01 23:44 - 00000000 ____D C:\Users\Halbig\AppData\Local\Buhl Data Service

2014-01-01 23:44 - 2014-01-01 23:44 - 00000000 ____D C:\Users\Halbig\AppData\Local\Buhl

2014-01-01 23:39 - 2014-01-01 23:51 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

2013-12-30 13:44 - 2014-01-29 12:18 - 00004536 _____ C:\Windows\setupact.log

2013-12-30 13:44 - 2013-12-30 13:44 - 00000000 _____ C:\Windows\setuperr.log
 

==================== One Month Modified Files and Folders =======
 

2014-01-29 15:15 - 2014-01-29 15:14 - 00014053 _____ C:\Users\Halbig\Downloads\FRST.txt

2014-01-29 15:14 - 2014-01-29 15:14 - 02079744 _____ (Farbar) C:\Users\Halbig\Downloads\FRST64.exe

2014-01-29 15:14 - 2014-01-29 15:14 - 00000000 ____D C:\FRST

2014-01-29 15:09 - 2013-12-29 14:59 - 00822754 _____ C:\Windows\WindowsUpdate.log

2014-01-29 15:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF

2014-01-29 14:56 - 2013-06-27 19:40 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-29 14:38 - 2013-01-31 20:59 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint

2014-01-29 14:37 - 2014-01-29 14:37 - 00002171 _____ C:\Users\Public\Desktop\Epson Easy Photo Print.lnk

2014-01-29 14:37 - 2012-04-18 17:18 - 00000000 ____D C:\ProgramData\UDL

2014-01-29 14:36 - 2014-01-29 14:36 - 00000000 ____D C:\Program Files\Epson Software

2014-01-29 14:36 - 2012-04-18 17:17 - 00000306 _____ C:\Windows\setup.iss

2014-01-29 14:36 - 2012-04-18 17:16 - 00000000 ____D C:\Program Files (x86)\Epson Software

2014-01-29 14:36 - 2010-05-10 12:55 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2014-01-29 14:35 - 2014-01-29 14:35 - 00002390 _____ C:\Users\Public\Desktop\Netzwerkhandbuch EPSON SX235 Series.lnk

2014-01-29 14:35 - 2014-01-29 14:35 - 00002390 _____ C:\Users\Public\Desktop\Benutzerhandbuch EPSON SX235 Series.lnk

2014-01-29 14:35 - 2014-01-29 13:20 - 00000000 ____D C:\Users\Halbig\Desktop\Pc Problem

2014-01-29 14:35 - 2012-04-18 17:14 - 00000000 ____D C:\Program Files (x86)\epson

2014-01-29 14:34 - 2014-01-29 14:34 - 00000934 _____ C:\Users\Public\Desktop\EPSON Scan.lnk

2014-01-29 14:34 - 2014-01-29 14:34 - 00000000 ____D C:\Program Files\EpsonNet

2014-01-29 14:19 - 2013-04-28 00:20 - 00060416 _____ C:\Users\Halbig\Desktop\Amazon Verkauf.xls

2014-01-29 12:47 - 2014-01-29 12:47 - 01166132 _____ C:\Users\Halbig\Downloads\adwcleaner.exe

2014-01-29 12:47 - 2014-01-13 14:21 - 00000000 ____D C:\AdwCleaner

2014-01-29 12:26 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-01-29 12:26 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-01-29 12:18 - 2014-01-07 11:18 - 00013682 _____ C:\Windows\PFRO.log

2014-01-29 12:18 - 2013-12-30 13:44 - 00004536 _____ C:\Windows\setupact.log

2014-01-29 12:18 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-29 11:50 - 2013-04-11 22:20 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\vlc

2014-01-29 10:46 - 2014-01-13 02:20 - 00000000 ____D C:\Program Files (x86)\Google

2014-01-29 10:46 - 2011-06-20 13:42 - 00000000 ____D C:\Users\Halbig\AppData\Local\Google

2014-01-29 02:03 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp

2014-01-29 02:00 - 2014-01-05 20:43 - 00014336 _____ C:\Users\Halbig\Desktop\Arbeitszeiten.xls

2014-01-29 00:59 - 2014-01-29 00:59 - 00275304 _____ C:\Windows\Minidump\012914-40638-01.dmp

2014-01-29 00:59 - 2011-08-14 21:21 - 00000000 ____D C:\Windows\Minidump

2014-01-28 14:33 - 2011-06-29 03:13 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\dvdcss

2014-01-27 13:58 - 2013-07-09 22:04 - 00000000 ____D C:\Users\Halbig\Desktop\Bewerbung 08.07.13

2014-01-27 09:22 - 2013-09-29 19:38 - 00000000 ____D C:\Users\Halbig\Desktop\Auto Unfall

2014-01-26 22:01 - 2014-01-13 02:21 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-26 18:53 - 2014-01-26 18:53 - 00279432 _____ C:\Windows\Minidump\012614-46597-01.dmp

2014-01-25 11:32 - 2014-01-25 11:32 - 00001299 _____ C:\Users\Halbig\Desktop\Unbenannt - Verknüpfung.lnk

2014-01-24 23:36 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2014-01-23 21:15 - 2014-01-23 20:50 - 00000000 ____D C:\Users\Halbig\.gimp-2.8

2014-01-23 20:50 - 2014-01-23 20:50 - 00000000 ____D C:\Users\Halbig\AppData\Local\gegl-0.2

2014-01-23 20:50 - 2011-06-18 15:09 - 00000000 ____D C:\Users\Halbig

2014-01-23 20:48 - 2013-01-28 21:54 - 00000000 ____D C:\Users\Halbig\Desktop\Aktuelles

2014-01-23 20:35 - 2014-01-23 20:35 - 00000000 ____D C:\Program Files\GIMP 2

2014-01-23 20:32 - 2014-01-23 20:31 - 00000000 ____D C:\Program Files (x86)\GIMP 2

2014-01-23 01:50 - 2014-01-06 01:12 - 00000000 ____D C:\Users\Halbig\Desktop\Verschiedenes

2014-01-23 01:48 - 2014-01-23 01:47 - 00000000 ____D C:\Users\Halbig\Desktop\Phantom der Oper

2014-01-23 01:48 - 2014-01-21 14:21 - 00000000 ____D C:\Users\Halbig\Desktop\Bewerbungen 2014

2014-01-22 13:22 - 2011-06-22 20:02 - 00000000 ____D C:\Users\Halbig\dwhelper

2014-01-19 10:17 - 2013-09-15 02:46 - 00000000 ____D C:\Users\Halbig\Desktop\Wohnungen

2014-01-16 14:34 - 2010-05-10 13:19 - 00000000 ____D C:\Program Files (x86)\Adobe

2014-01-16 14:13 - 2011-06-21 17:12 - 00000000 ____D C:\Users\Halbig\AppData\Local\Adobe

2014-01-16 14:08 - 2013-06-27 19:40 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-01-16 14:08 - 2012-07-13 13:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-01-16 14:08 - 2011-10-14 03:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-16 14:07 - 2014-01-16 14:07 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-16 14:07 - 2014-01-16 14:07 - 00000000 ____D C:\Program Files\Java

2014-01-16 01:36 - 2011-06-19 00:26 - 00709900 _____ C:\Windows\system32\perfh007.dat

2014-01-16 01:36 - 2011-06-19 00:26 - 00154336 _____ C:\Windows\system32\perfc007.dat

2014-01-16 01:36 - 2009-07-14 06:13 - 01649492 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-16 01:28 - 2009-07-14 05:45 - 00286776 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-15 23:39 - 2013-07-12 18:18 - 00000000 ____D C:\Windows\system32\MRT

2014-01-15 23:35 - 2011-10-13 17:02 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00125440 _____ C:\Windows\system32\DlProtectSvc.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00118784 _____ C:\Windows\system32\amxreadd.exe

2014-01-13 09:43 - 2014-01-13 09:43 - 00002746 _____ C:\Users\Halbig\Desktop\Rkill.txt

2014-01-13 03:26 - 2011-06-22 19:52 - 00000000 ____D C:\Program Files\WinRAR

2014-01-13 02:56 - 2012-07-29 23:52 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2014-01-13 02:52 - 2014-01-13 02:52 - 00000000 ____D C:\ProgramData\Oracle

2014-01-13 02:40 - 2014-01-13 02:40 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView

2014-01-13 02:39 - 2014-01-13 02:39 - 00003138 _____ C:\Windows\System32\Tasks\{C5C75039-A08B-4E61-8475-E111EEA94580}

2014-01-13 02:36 - 2011-06-20 13:43 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Adobe

2014-01-13 02:22 - 2014-01-13 02:22 - 00001970 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-13 02:22 - 2014-01-13 02:22 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\AVAST Software

2014-01-13 02:21 - 2014-01-13 02:20 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-13 02:20 - 2014-01-13 02:20 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D C:\ProgramData\AVAST Software

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D C:\Program Files\AVAST Software

2014-01-13 01:57 - 2014-01-13 01:57 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Mozilla

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-11 13:01 - 2013-07-19 08:07 - 00031744 ___SH C:\Users\Halbig\Downloads\Thumbs.db

2014-01-07 10:57 - 2014-01-01 23:44 - 00000650 _____ C:\Windows\wiso.ini

2014-01-07 10:44 - 2014-01-07 10:44 - 00001268 _____ C:\Users\Halbig\Desktop\Revo Uninstaller.lnk

2014-01-07 10:44 - 2011-10-06 00:19 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2014-01-06 01:26 - 2013-11-01 18:09 - 00000000 ____D C:\Users\Halbig\Desktop\Ebay neu

2014-01-05 18:09 - 2011-07-02 17:15 - 00031744 _____ C:\Users\Halbig\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-01-05 17:17 - 2014-01-05 17:17 - 00007605 _____ C:\Users\Halbig\AppData\Local\Resmon.ResmonCfg

2014-01-02 00:48 - 2014-01-02 00:48 - 00000000 ____D C:\Users\Halbig\Documents\Steuersparer

2014-01-01 23:51 - 2014-01-01 23:39 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

2014-01-01 23:45 - 2014-01-01 23:45 - 00000000 ____D C:\Users\Halbig\AppData\Roaming\Buhl Data Service

2014-01-01 23:44 - 2014-01-01 23:44 - 00000000 ____D C:\Users\Halbig\AppData\Local\Buhl Data Service

2014-01-01 23:44 - 2014-01-01 23:44 - 00000000 ____D C:\Users\Halbig\AppData\Local\Buhl

2013-12-31 00:17 - 2012-05-28 14:13 - 00000000 ____D C:\Users\Halbig\Desktop\Christin

2013-12-30 13:44 - 2013-12-30 13:44 - 00000000 _____ C:\Windows\setuperr.log
 

Files to move or delete:

====================

C:\ProgramData\dlprotect.exe
 
 

Some content of TEMP:

====================

C:\Users\Halbig\AppData\Local\Temp\avgnt.exe

C:\Users\Halbig\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-19 10:15
 

==================== End Of Log ============================

--- --- ---

--- --- ---

UND ADDITIONAL:FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01

Ran by Halbig at 2014-01-29 15:15:41

Running from C:\Users\Halbig\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)

ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)

ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden

Acer Arcade Deluxe (x32 Version: 4.1.7405 - CyberLink Corp.)

Acer Arcade Deluxe (x32 Version: 4.1.7405 - CyberLink Corp.) Hidden

Acer Arcade Movie (x32 Version: 9.0.6205 - CyberLink Corp.) Hidden

Acer eRecovery Management (x32 Version: 4.05.3007 - Acer Incorporated)

Acer GameZone Console (x32 Version: 6.1.0.2 - Oberon Media, Inc.)

Acer Registration (x32 Version: 1.02.3006 - Acer Incorporated)

Acer ScreenSaver (x32 Version: 1.1.0318.2010 - Acer Incorporated)

Acer Updater (x32 Version: 1.02.3001 - Acer Incorporated)

Acrobat.com (x32 Version: 1.6.65 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden

AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden

AnyDVD (x32 Version: 7.0.8.0 - SlySoft)

ATI AVIVO64 Codecs (Version: 10.12.0.00225 - ATI Technologies Inc.) Hidden

avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Benutzerhandbuch EPSON SX235 Series (x32 Version:  - )

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2010.0225.1742.31671 - ATI Technologies, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000 - Microsoft Corporation)

Disc2Phone (x32 Version: 1.4.0.112 - Sony Media Software)

Druckerdeinstallation für EPSON SX235 Series (Version:  - SEIKO EPSON Corporation)

Epson Easy Photo Print 2 (x32 Version: 2.2.4.0 - SEIKO EPSON CORPORATION)

Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION)

Epson Event Manager (x32 Version: 2.50.0000 - SEIKO EPSON CORPORATION)

EPSON Scan (x32 Version:  - Seiko Epson Corporation)

EpsonNet Print (x32 Version: 2.5.00 - SEIKO EPSON CORPORATION)

eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.)

eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden

GIMP 2.8.10 (Version: 2.8.10 - The GIMP Team)

Haali Media Splitter (x32 Version:  - )

Hotkey Utility (x32 Version: 2.05.3005 - Acer Incorporated)

Identity Card (x32 Version: 1.00.3003 - Acer Incorporated)

ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden

IrfanView (remove only) (x32 Version: 4.37 - Irfan Skiljan)

Java 7 Update 51 (64-bit) (Version: 7.0.510 - Oracle)

Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

MagicTune Premium (x32 Version: 1.0 Beta - Samsung Electronics Co. Ltd.)

MediaShow Espresso (x32 Version: 5.5.1403_23691 - CyberLink Corp.) Hidden

Microsoft .NET Framework 1.1 (x32 Version:  - )

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden

Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)

MultiScreen (x32 Version: 1.00.0000 - Samsung Electronics Ltd.)

Nero 9 Essentials (x32 Version:  - Nero AG)

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero DiscSpeed (x32 Version: 5.4.13.100 - Nero AG) Hidden

Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden

Nero DriveSpeed (x32 Version: 4.4.12.100 - Nero AG) Hidden

Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden

Nero Express Help (x32 Version: 9.6.2.101 - Nero AG) Hidden

Nero InfoTool (x32 Version: 6.4.12.100 - Nero AG) Hidden

Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden

Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.37.100 - Nero AG) Hidden

Nero StartSmart Help (x32 Version: 9.4.27.100 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.16.0.100 - Nero AG) Hidden

NeroExpress (x32 Version: 9.4.33.100 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Netzwerkhandbuch EPSON SX235 Series (x32 Version:  - )

PDFCreator (x32 Version: 1.2.1 - Frank Heindörfer, Philip Chinery)

QSS-Installationsprogramm (x32 Version: 7.0 - TP-LINK)

Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.17.304.2010 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6024 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (x32 Version: 1.95 - VS Revo Group)

Samsung_MonSetup (x32 Version: 1.00.0000 - Samsung)

TP-LINK-Clientinstallationsprogramm (x32 Version: 7.0 - TP-LINK)

VLC media player 2.0.8 (Version: 2.0.8 - VideoLAN)

Welcome Center (x32 Version: 1.00.3013 - Acer Incorporated)

Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5 - Microsoft Corporation)

Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden

Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden

Windows Live Essentials (x32 Version: 14.0.8089.0726 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden

Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden

Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden

Windows Live Sync (x32 Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden

Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation)

Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)

WinRAR 5.01 (64-bit) (Version: 5.01.0 - win.rar GmbH)
 

==================== Restore Points  =========================
 

29-01-2014 10:41:57 Revo Uninstaller's restore point - EpsonNet Print

29-01-2014 10:45:12 Revo Uninstaller's restore point - Epson Event Manager

29-01-2014 10:45:23 Removed Epson Event Manager

29-01-2014 10:46:19 Revo Uninstaller's restore point - Netzwerkhandbuch EPSON SX235 Series

29-01-2014 10:48:28 Revo Uninstaller's restore point - Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)

29-01-2014 10:50:31 Entfernt Easy Photo Print Plug-in for PMB(Picture Motion Browseröô

29-01-2014 11:05:47 Revo Uninstaller's restore point - µTorrent

29-01-2014 11:14:35 Revo Uninstaller's restore point - JDownloader 0.9

29-01-2014 13:34:42 Installed Epson Event Manager

29-01-2014 13:36:25 Installiert Easy Photo Print Plug-in for PMB(Picture Motion BrowÏùq
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {1482345A-59A5-4BAF-BC99-374EC4A50334} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-16] (Adobe Systems Incorporated)

Task: {34086C54-6D32-4997-AA46-FBF502D8810A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-01-13] (AVAST Software)

Task: {4AB861A5-04EE-4EB2-B676-344B73FCA6CB} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Task: {F243E336-E9C0-4132-95BF-41A4388029FC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2014-01-29 00:43 - 2014-01-28 17:44 - 02166272 _____ () C:\Program Files\AVAST Software\Avast\defs\14012801\algo.dll

2013-05-12 18:17 - 2013-05-12 16:52 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2011-06-22 16:28 - 2010-01-08 14:11 - 00077824 _____ () C:\Program Files (x86)\MagicTune Premium\MagicTuneCore.dll

2011-06-22 16:28 - 2010-01-07 23:25 - 00045056 _____ () C:\Program Files (x86)\MagicTune Premium\VESADll.dll

2011-06-22 16:28 - 2010-01-07 23:25 - 00045056 _____ () C:\Program Files (x86)\MagicTune Premium\IPROFILE.dll

2011-06-22 16:28 - 2010-01-07 23:25 - 00040960 _____ () C:\Program Files (x86)\MagicTune Premium\DPROFILE.dll

2011-06-22 16:28 - 2010-01-07 23:25 - 00040960 _____ () C:\Program Files (x86)\MagicTune Premium\EPROFILE.dll

2011-06-22 16:28 - 2010-01-07 23:25 - 00040960 _____ () C:\Program Files (x86)\MagicTune Premium\DEVICEINTERFACE.dll

2010-05-06 03:24 - 2010-05-06 03:24 - 00151584 _____ () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll

2014-01-13 02:20 - 2014-01-13 02:20 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-01-13 01:57 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/29/2014 02:36:15 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SETUP.EXE_InstallShield, Version: 16.0.0.400, Zeitstempel: 0x4ab84bb7

Name des fehlerhaften Moduls: ISSetup.dll, Version: 16.0.0.400, Zeitstempel: 0x4ab84b70

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000a7a6f

ID des fehlerhaften Prozesses: 0x988

Startzeit der fehlerhaften Anwendung: 0xSETUP.EXE_InstallShield0

Pfad der fehlerhaften Anwendung: SETUP.EXE_InstallShield1

Pfad des fehlerhaften Moduls: SETUP.EXE_InstallShield2

Berichtskennung: SETUP.EXE_InstallShield3
 

Error: (01/29/2014 11:47:06 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: DUser.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bdf26

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000003a87

ID des fehlerhaften Prozesses: 0x1150

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (01/28/2014 00:08:26 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/24/2014 02:03:11 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/23/2014 10:03:31 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/22/2014 00:26:22 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/20/2014 09:48:36 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/19/2014 11:04:00 AM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/17/2014 05:24:19 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (01/16/2014 06:01:06 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 
 

System errors:

=============

Error: (01/29/2014 03:09:08 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 02:41:11 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 00:18:36 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 10:52:39 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 09:48:12 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 09:48:11 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎29.‎01.‎2014 um 09:38:30 unerwartet heruntergefahren.
 

Error: (01/29/2014 09:27:31 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 00:59:30 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
 

Modulpfad: C:\Windows\system32\athExt.dll

Fehlercode: 126
 

Error: (01/29/2014 00:59:28 AM) (Source: BugCheck) (User: )

Description: 0x0000003b (0x00000000c0000005, 0xfffff800033c4a0e, 0xfffff88007624b80, 0x0000000000000000)C:\Windows\MEMORY.DMP012914-40638-01
 

Error: (01/29/2014 00:59:01 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎29.‎01.‎2014 um 00:51:45 unerwartet heruntergefahren.
 
 

Microsoft Office Sessions:

=========================

Error: (01/29/2014 02:36:15 PM) (Source: Application Error)(User: )

Description: SETUP.EXE_InstallShield16.0.0.4004ab84bb7ISSetup.dll16.0.0.4004ab84b70c0000005000a7a6f98801cf1cf70ca513ebC:\Users\Halbig\AppData\Local\Temp\{7E25E516-EC43-43B0-B6F8-B2B53077FBE9}\SETUP.EXEC:\Users\Halbig\AppData\Local\Temp\{7E25E516-EC43-43B0-B6F8-B2B53077FBE9}\ISSetup.dll53018b4b-88ea-11e3-9557-90fba6e4aa22
 

Error: (01/29/2014 11:47:06 AM) (Source: Application Error)(User: )

Description: explorer.exe6.1.7601.175674d672ee4DUser.dll6.1.7600.163854a5bdf26c00000050000000000003a87115001cf1cdf482be830C:\Windows\explorer.exeC:\Windows\system32\DUser.dllb1baf73c-88d2-11e3-ae12-90fba6e4aa22
 

Error: (01/28/2014 00:08:26 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/24/2014 02:03:11 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/23/2014 10:03:31 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/22/2014 00:26:22 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/20/2014 09:48:36 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/19/2014 11:04:00 AM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/17/2014 05:24:19 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (01/16/2014 06:01:06 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 50%

Total physical RAM: 4023.11 MB

Available physical RAM: 1984.19 MB

Total Pagefile: 8044.4 MB

Available Pagefile: 5565.31 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Acer) (Fixed) (Total:458.87 GB) (Free:11.61 GB) NTFS

Drive d: (Data) (Fixed) (Total:458.87 GB) (Free:4.29 GB) NTFS

Drive e: (EPSON) (CDROM) (Total:0.31 GB) (Free:0 GB) CDFS

Drive g: (Elements) (Fixed) (Total:2794.52 GB) (Free:0.62 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 77223650)

Partition 1: (Not Active) - (Size=14 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=459 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=459 GB) - (Type=07 NTFS)

Attempted reading MBR returned 0 bytes.

 Could not read MBR for disk 1.
 

==================== End Of Log ============================

--- --- ---

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

So nachdem ich endlich wieder fit bin :confused: hier die gewünschten Scans:

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.04.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Halbig :: BENJI [Administrator]

Schutz: Aktiviert

05.02.2014 01:00:48
mbam-log-2014-02-05 (01-00-48).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|H:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 696643
Laufzeit: 3 Stunde(n), 19 Minute(n), 9 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\AdwCleaner\Quarantine\C\Users\Halbig\AppData\Local\DownloadGuide\Offers\mconduitinstaller.exe.vir (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Halbig\Systemsteuerung\Link\Unterverzeichnis\Aufgaben\Programme\speedupmypc.exe (PUP.Optional.SpeedUpMyPC) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
AdwCleaner Logfile:

Code:

# AdwCleaner v3.018 - Bericht erstellt am 05/02/2014 um 10:05:23

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Halbig - BENJI

# Gestartet von : C:\Users\Halbig\Downloads\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16428
 
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [5230 octets] - [28/01/2014 02:14:21]

AdwCleaner[R1].txt - [920 octets] - [29/01/2014 12:47:33]

AdwCleaner[R2].txt - [979 octets] - [05/02/2014 10:02:49]

AdwCleaner[S0].txt - [5084 octets] - [28/01/2014 02:34:42]

AdwCleaner[S1].txt - [901 octets] - [05/02/2014 10:05:23]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [960 octets] ##########

--- --- ---

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Halbig on 05.02.2014 at 10:13:11,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{205937E1-F9F7-45F9-8FCC-BC6D132ABC14}

~~~ Files

~~~ Folders

~~~ FireFox

Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\Halbig\AppData\Roaming\mozilla\firefox\profiles\5jr09hrn.default\minidumps [23 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.02.2014 at 10:18:26,91
End of JRT log

Und zum Schluss ein frisches FRST:
FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014

Ran by Halbig (administrator) on BENJI on 05-02-2014 10:22:09

Running from C:\Users\Halbig\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHLE.EXE

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Wireless) C:\Program Files (x86)\TP-LINK\QSS\jswpbapi.exe

() C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

() C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

() C:\OEM\USBDECTION\USBS3S4Detection.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

() C:\Program Files (x86)\TP-LINK\QSS\jswtrayutil.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9955872 2010-01-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [609312 2010-05-06] ()

HKLM-x32\...\Run: [MDS_Menu] - C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [jswtrayutil] - C:\Program Files (x86)\TP-LINK\QSS\jswtrayutil.exe [32871 2010-04-21] ()

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2014-01-13] (AVAST Software)

HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-774404752-444102748-1486131240-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-774404752-444102748-1486131240-1000\...\MountPoints2: {f4cb7b30-99b1-11e0-b2ec-806e6f6e6963} - E:\InstallNavi.exe
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x3950&r=173606112207pe478v195w4761v047

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - {38DD9B2C-D2EF-4626-96F0-D356DA985CEC} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=937811&p={searchTerms}

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU - No Name - {CB789373-04D5-4EF4-9C16-871463FD0830} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\searchplugins\google-default.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: DownloadHelper - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-13]

FF Extension: Hide My Ass Proxy Extension - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\extension@hidemyass.com.xpi [2014-01-13]

FF Extension: ebayitemdescriptionsaveenlargedp - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{ba2430e0-5b72-4cac-bc9e-7d1aaca75d3d}.xpi [2014-01-13]

FF Extension: Adblock Plus - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-13]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-13]
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-01-13] (AVAST Software)

R2 jswpbapi; C:\Program Files (x86)\TP-LINK\QSS\jswpbapi.exe [265216 2010-04-20] (Wireless)

S3 jswpsapi; C:\Program Files (x86)\TP-LINK\QSS\jswpsapi.exe [954368 2010-04-20] (Wireless)

R2 MagicTuneEngine; C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 RichVideo; C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904 2010-02-03] ()

R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
 

==================== Drivers (Whitelisted) ====================
 

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.)

R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-13] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-13] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-13] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-13] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-13] (AVAST Software)

S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-13] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-05 10:22 - 2014-02-05 10:22 - 00000000 ____D () C:\Users\Halbig\Downloads\FRST-OlderVersion

2014-02-05 10:18 - 2014-02-05 10:18 - 00000947 _____ () C:\Users\Halbig\Desktop\JRT.txt

2014-02-05 10:13 - 2014-02-05 10:13 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 10:10 - 2014-02-05 10:10 - 01037530 _____ (Thisisu) C:\Users\Halbig\Downloads\JRT.exe

2014-02-05 09:13 - 2014-02-05 09:13 - 00000000 _____ () C:\Users\Halbig\Downloads\barfu1ck_cony_clay.part3.rar

2014-02-05 00:57 - 2014-02-05 00:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-05 00:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-02-05 00:15 - 2014-02-05 00:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Halbig\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-30 14:08 - 2014-02-05 09:43 - 91521024 _____ () C:\Users\Halbig\Downloads\barfu1ck_cony_clay.part3.rar.part

2014-01-29 16:27 - 2014-01-29 22:02 - 00000000 ____D () C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint

2014-01-29 16:26 - 2014-01-29 16:26 - 00002171 _____ () C:\Users\Public\Desktop\Epson Easy Photo Print.lnk

2014-01-29 16:25 - 2014-01-29 16:25 - 00000000 ____D () C:\Program Files\Epson Software

2014-01-29 16:23 - 2014-01-29 21:59 - 00000934 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk

2014-01-29 16:23 - 2014-01-29 16:23 - 00000000 ____D () C:\Program Files\EpsonNet

2014-01-29 16:23 - 2011-08-30 13:40 - 00535040 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\ensppui.dll

2014-01-29 16:23 - 2011-08-30 13:40 - 00535040 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enppui.dll

2014-01-29 16:23 - 2011-08-30 13:38 - 00558080 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\ensppmon.dll

2014-01-29 16:23 - 2011-08-30 13:38 - 00558080 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enppmon.dll

2014-01-29 16:23 - 2011-08-10 00:00 - 00464384 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll

2014-01-29 16:23 - 2011-08-01 18:24 - 00250880 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enspres.dll

2014-01-29 16:23 - 2011-08-01 18:24 - 00250880 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enpres.dll

2014-01-29 16:23 - 2009-10-16 00:00 - 00132560 _____ (Seiko Epson Corporation) C:\Windows\system32\esdevapp.exe

2014-01-29 16:23 - 2009-10-16 00:00 - 00013824 _____ (Seiko Epson Corporation) C:\Windows\system32\esxcdev.dll

2014-01-29 15:15 - 2014-01-29 15:16 - 00030322 ____H () C:\Users\Halbig\Downloads\Addition.txt

2014-01-29 15:14 - 2014-02-05 10:22 - 02080256 _____ (Farbar) C:\Users\Halbig\Downloads\FRST64.exe

2014-01-29 15:14 - 2014-02-05 10:22 - 00014105 _____ () C:\Users\Halbig\Downloads\FRST.txt

2014-01-29 15:14 - 2014-02-05 10:22 - 00000000 ____D () C:\FRST

2014-01-29 13:20 - 2014-01-29 14:35 - 00000000 ____D () C:\Users\Halbig\Desktop\Pc Problem

2014-01-29 12:47 - 2014-01-29 12:47 - 01166132 ____H () C:\Users\Halbig\Downloads\adwcleaner.exe

2014-01-29 00:59 - 2014-01-29 00:59 - 00275304 _____ () C:\Windows\Minidump\012914-40638-01.dmp

2014-01-26 18:53 - 2014-01-26 18:53 - 00279432 _____ () C:\Windows\Minidump\012614-46597-01.dmp

2014-01-25 11:32 - 2014-01-25 11:32 - 00001299 _____ () C:\Users\Halbig\Desktop\Unbenannt - Verknüpfung.lnk

2014-01-23 20:50 - 2014-01-23 21:15 - 00000000 ____D () C:\Users\Halbig\.gimp-2.8

2014-01-23 20:50 - 2014-01-23 20:50 - 00000000 ____D () C:\Users\Halbig\AppData\Local\gegl-0.2

2014-01-23 20:35 - 2014-01-23 20:35 - 00000000 ____D () C:\Program Files\GIMP 2

2014-01-23 20:31 - 2014-01-23 20:32 - 00000000 ____D () C:\Program Files (x86)\GIMP 2

2014-01-23 01:47 - 2014-01-23 01:48 - 00000000 ____D () C:\Users\Halbig\Desktop\Phantom der Oper

2014-01-21 14:21 - 2014-01-23 01:48 - 00000000 ____D () C:\Users\Halbig\Desktop\Bewerbungen 2014

2014-01-16 14:07 - 2014-01-16 14:07 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-16 14:07 - 2014-01-16 14:07 - 00000000 ____D () C:\Program Files\Java

2014-01-15 23:34 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 23:34 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 23:34 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-13 17:40 - 2014-01-13 17:40 - 00125440 _____ () C:\Windows\system32\DlProtectSvc.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00118784 _____ () C:\Windows\system32\amxreadd.exe

2014-01-13 14:21 - 2014-02-05 10:05 - 00000000 ____D () C:\AdwCleaner

2014-01-13 09:43 - 2014-01-13 09:43 - 00002746 _____ () C:\Users\Halbig\Desktop\Rkill.txt

2014-01-13 02:52 - 2014-01-13 02:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-13 02:40 - 2014-01-13 02:40 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView

2014-01-13 02:39 - 2014-01-13 02:39 - 00003138 _____ () C:\Windows\System32\Tasks\{C5C75039-A08B-4E61-8475-E111EEA94580}

2014-01-13 02:22 - 2014-01-13 02:22 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-13 02:22 - 2014-01-13 02:22 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\AVAST Software

2014-01-13 02:21 - 2014-01-26 22:01 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-13 02:20 - 2014-01-29 10:46 - 00000000 ____D () C:\Program Files (x86)\Google

2014-01-13 02:20 - 2014-01-13 02:21 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-13 02:20 - 2014-01-13 02:20 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\Program Files\AVAST Software

2014-01-13 01:57 - 2014-01-13 01:57 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Mozilla

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-01-07 11:18 - 2014-02-05 09:44 - 00021932 _____ () C:\Windows\PFRO.log

2014-01-07 10:44 - 2014-01-07 10:44 - 00001268 _____ () C:\Users\Halbig\Desktop\Revo Uninstaller.lnk

2014-01-06 01:12 - 2014-01-23 01:50 - 00000000 ____D () C:\Users\Halbig\Desktop\Verschiedenes
 

==================== One Month Modified Files and Folders =======
 

2014-02-05 10:22 - 2014-02-05 10:22 - 00000000 ____D () C:\Users\Halbig\Downloads\FRST-OlderVersion

2014-02-05 10:22 - 2014-01-29 15:14 - 02080256 _____ (Farbar) C:\Users\Halbig\Downloads\FRST64.exe

2014-02-05 10:22 - 2014-01-29 15:14 - 00014105 _____ () C:\Users\Halbig\Downloads\FRST.txt

2014-02-05 10:22 - 2014-01-29 15:14 - 00000000 ____D () C:\FRST

2014-02-05 10:18 - 2014-02-05 10:18 - 00000947 _____ () C:\Users\Halbig\Desktop\JRT.txt

2014-02-05 10:15 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-05 10:15 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-05 10:13 - 2014-02-05 10:13 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 10:10 - 2014-02-05 10:10 - 01037530 _____ (Thisisu) C:\Users\Halbig\Downloads\JRT.exe

2014-02-05 10:06 - 2013-12-30 13:44 - 00005208 _____ () C:\Windows\setupact.log

2014-02-05 10:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-05 10:05 - 2014-01-13 14:21 - 00000000 ____D () C:\AdwCleaner

2014-02-05 10:05 - 2013-12-29 14:59 - 00927967 _____ () C:\Windows\WindowsUpdate.log

2014-02-05 10:01 - 2013-04-11 22:20 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\vlc

2014-02-05 09:56 - 2013-06-27 19:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-05 09:44 - 2014-01-07 11:18 - 00021932 _____ () C:\Windows\PFRO.log

2014-02-05 09:43 - 2014-01-30 14:08 - 91521024 _____ () C:\Users\Halbig\Downloads\barfu1ck_cony_clay.part3.rar.part

2014-02-05 09:13 - 2014-02-05 09:13 - 00000000 _____ () C:\Users\Halbig\Downloads\barfu1ck_cony_clay.part3.rar

2014-02-05 01:43 - 2013-04-28 00:20 - 00062464 _____ () C:\Users\Halbig\Desktop\Amazon Verkauf.xls

2014-02-05 00:57 - 2014-02-05 00:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-05 00:16 - 2014-02-05 00:15 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Halbig\Downloads\mbam-setup-1.75.0.1300.exe

2014-02-04 19:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-01-30 14:06 - 2011-06-22 20:02 - 00000000 ____D () C:\Users\Halbig\dwhelper

2014-01-30 10:19 - 2013-07-09 22:04 - 00000000 ____D () C:\Users\Halbig\Desktop\Bewerbung 08.07.13

2014-01-29 22:02 - 2014-01-29 16:27 - 00000000 ____D () C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint

2014-01-29 21:59 - 2014-01-29 16:23 - 00000934 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk

2014-01-29 16:27 - 2012-04-18 17:19 - 00000000 ____D () C:\ProgramData\ABBYY

2014-01-29 16:26 - 2014-01-29 16:26 - 00002171 _____ () C:\Users\Public\Desktop\Epson Easy Photo Print.lnk

2014-01-29 16:26 - 2012-04-18 17:18 - 00000000 ____D () C:\ProgramData\UDL

2014-01-29 16:25 - 2014-01-29 16:25 - 00000000 ____D () C:\Program Files\Epson Software

2014-01-29 16:25 - 2012-04-18 17:17 - 00000306 _____ () C:\Windows\setup.iss

2014-01-29 16:25 - 2012-04-18 17:16 - 00000000 ____D () C:\Program Files (x86)\Epson Software

2014-01-29 16:25 - 2010-05-10 12:55 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-01-29 16:24 - 2012-04-18 17:14 - 00000000 ____D () C:\Program Files (x86)\epson

2014-01-29 16:23 - 2014-01-29 16:23 - 00000000 ____D () C:\Program Files\EpsonNet

2014-01-29 15:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-29 15:16 - 2014-01-29 15:15 - 00030322 ____H () C:\Users\Halbig\Downloads\Addition.txt

2014-01-29 14:35 - 2014-01-29 13:20 - 00000000 ____D () C:\Users\Halbig\Desktop\Pc Problem

2014-01-29 12:47 - 2014-01-29 12:47 - 01166132 ____H () C:\Users\Halbig\Downloads\adwcleaner.exe

2014-01-29 10:46 - 2014-01-13 02:20 - 00000000 ____D () C:\Program Files (x86)\Google

2014-01-29 10:46 - 2011-06-20 13:42 - 00000000 ____D () C:\Users\Halbig\AppData\Local\Google

2014-01-29 02:00 - 2014-01-05 20:43 - 00014336 _____ () C:\Users\Halbig\Desktop\Arbeitszeiten.xls

2014-01-29 00:59 - 2014-01-29 00:59 - 00275304 _____ () C:\Windows\Minidump\012914-40638-01.dmp

2014-01-29 00:59 - 2011-08-14 21:21 - 00000000 ____D () C:\Windows\Minidump

2014-01-28 14:33 - 2011-06-29 03:13 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\dvdcss

2014-01-27 09:22 - 2013-09-29 19:38 - 00000000 ____D () C:\Users\Halbig\Desktop\Auto Unfall

2014-01-26 22:01 - 2014-01-13 02:21 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-26 18:53 - 2014-01-26 18:53 - 00279432 _____ () C:\Windows\Minidump\012614-46597-01.dmp

2014-01-25 11:32 - 2014-01-25 11:32 - 00001299 _____ () C:\Users\Halbig\Desktop\Unbenannt - Verknüpfung.lnk

2014-01-24 23:36 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-01-23 21:15 - 2014-01-23 20:50 - 00000000 ____D () C:\Users\Halbig\.gimp-2.8

2014-01-23 20:50 - 2014-01-23 20:50 - 00000000 ____D () C:\Users\Halbig\AppData\Local\gegl-0.2

2014-01-23 20:50 - 2011-06-18 15:09 - 00000000 ____D () C:\Users\Halbig

2014-01-23 20:48 - 2013-01-28 21:54 - 00000000 ____D () C:\Users\Halbig\Desktop\Aktuelles

2014-01-23 20:35 - 2014-01-23 20:35 - 00000000 ____D () C:\Program Files\GIMP 2

2014-01-23 20:32 - 2014-01-23 20:31 - 00000000 ____D () C:\Program Files (x86)\GIMP 2

2014-01-23 01:50 - 2014-01-06 01:12 - 00000000 ____D () C:\Users\Halbig\Desktop\Verschiedenes

2014-01-23 01:48 - 2014-01-23 01:47 - 00000000 ____D () C:\Users\Halbig\Desktop\Phantom der Oper

2014-01-23 01:48 - 2014-01-21 14:21 - 00000000 ____D () C:\Users\Halbig\Desktop\Bewerbungen 2014

2014-01-19 10:17 - 2013-09-15 02:46 - 00000000 ____D () C:\Users\Halbig\Desktop\Wohnungen

2014-01-16 14:34 - 2010-05-10 13:19 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-01-16 14:13 - 2011-06-21 17:12 - 00000000 ____D () C:\Users\Halbig\AppData\Local\Adobe

2014-01-16 14:08 - 2013-06-27 19:40 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-01-16 14:08 - 2012-07-13 13:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-01-16 14:08 - 2011-10-14 03:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-16 14:07 - 2014-01-16 14:07 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-16 14:07 - 2014-01-16 14:07 - 00000000 ____D () C:\Program Files\Java

2014-01-16 01:36 - 2011-06-19 00:26 - 00709900 _____ () C:\Windows\system32\perfh007.dat

2014-01-16 01:36 - 2011-06-19 00:26 - 00154336 _____ () C:\Windows\system32\perfc007.dat

2014-01-16 01:36 - 2009-07-14 06:13 - 01649492 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-01-16 01:28 - 2009-07-14 05:45 - 00286776 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-15 23:39 - 2013-07-12 18:18 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-15 23:35 - 2011-10-13 17:02 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00125440 _____ () C:\Windows\system32\DlProtectSvc.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00118784 _____ () C:\Windows\system32\amxreadd.exe

2014-01-13 09:43 - 2014-01-13 09:43 - 00002746 _____ () C:\Users\Halbig\Desktop\Rkill.txt

2014-01-13 03:26 - 2011-06-22 19:52 - 00000000 ____D () C:\Program Files\WinRAR

2014-01-13 02:56 - 2012-07-29 23:52 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2014-01-13 02:52 - 2014-01-13 02:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-13 02:40 - 2014-01-13 02:40 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView

2014-01-13 02:39 - 2014-01-13 02:39 - 00003138 _____ () C:\Windows\System32\Tasks\{C5C75039-A08B-4E61-8475-E111EEA94580}

2014-01-13 02:36 - 2011-06-20 13:43 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Adobe

2014-01-13 02:22 - 2014-01-13 02:22 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-13 02:22 - 2014-01-13 02:22 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\AVAST Software

2014-01-13 02:21 - 2014-01-13 02:20 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-13 02:20 - 2014-01-13 02:20 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\Program Files\AVAST Software

2014-01-13 01:57 - 2014-01-13 01:57 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Mozilla

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-01-11 13:01 - 2013-07-19 08:07 - 00031744 ___SH () C:\Users\Halbig\Downloads\Thumbs.db

2014-01-07 10:57 - 2014-01-01 23:44 - 00000650 _____ () C:\Windows\wiso.ini

2014-01-07 10:44 - 2014-01-07 10:44 - 00001268 _____ () C:\Users\Halbig\Desktop\Revo Uninstaller.lnk

2014-01-07 10:44 - 2011-10-06 00:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-01-06 01:26 - 2013-11-01 18:09 - 00000000 ____D () C:\Users\Halbig\Desktop\Ebay neu
 

Files to move or delete:

====================

C:\ProgramData\dlprotect.exe
 
 

Some content of TEMP:

====================

C:\Users\Halbig\AppData\Local\Temp\avgnt.exe

C:\Users\Halbig\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-29 21:30
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

VIELEN DANK !!!

Ich hoffe mir kann bald geholfen werden ? - Ich bitte daher um weitere Unterstützung - Bitte lest meine durchgeführten Berichte vom 05.02.14 !!! Ich brauche dazu noch Erklärungen bzw. weis nicht wie es jetzt weiter geht? Abstürze habe ich zwar keine mehr, aber ich mache mir Gedanken wie es weiter geht mit den infizierten Dateien, die sich im Quarantäneverzeichnis von der kostenlosen Testversion von Avast befinden. Was ist mit diesen Dateien ? Können diese bedenkenlos gelöscht werden? Das sind System32 Dateien da bin ich eher vorsichtig. Wie geht es jetzt weiter? Die Testversion von Avast läuft bald ab und ich habe Angst, dass dann wieder alles von vorne losgeht und mein Pc wieder diese Ausfälle hat. Aktuell läuft alles einwandfrei, ausser, dass der Windows-Explorer öfter abstürzt bzw. ich immer eine Meldung bekomme, dass der Windows-Explorer nicht mehr richtig funktioniert oder es länger dauert bis ich auf meine Laufwerke zugreifen kann bzw. wenn ich links unten Start und dann auf Computer gehen möchte dauert es oder er stürzt ab.
Ich wünsche erst mal eine gute Nacht :abklatsch:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=da11dd865ae499429a7c90b626f3a4fe
# engine=16967
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-06 07:42:20
# local_time=2014-02-06 08:42:20 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 71 77 113039 113620 0 0
# compatibility_mode=1799 16775165 100 96 14838 137482360 7616 0
# compatibility_mode=5893 16776574 100 94 18148624 143345590 0 0
# scanned=496225
# found=0
# cleaned=0
# scan_time=7529

UND NOCH DER SECURITY CHECK

Results of screen317's Security Check version 0.99.79
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Adobe Flash Player 12.0.0.43 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox (26.0)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-02-2014

Ran by Halbig (administrator) on BENJI on 06-02-2014 21:38:08

Running from C:\Users\Halbig\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 

Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forums
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Wireless) C:\Program Files (x86)\TP-LINK\QSS\jswpbapi.exe

() C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHLE.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe

() C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

() C:\OEM\USBDECTION\USBS3S4Detection.exe

() C:\Program Files (x86)\TP-LINK\QSS\jswtrayutil.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

() C:\Users\Halbig\Downloads\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9955872 2010-01-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [609312 2010-05-06] ()

HKLM-x32\...\Run: [MDS_Menu] - C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [jswtrayutil] - C:\Program Files (x86)\TP-LINK\QSS\jswtrayutil.exe [32871 2010-04-21] ()

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-05] (AVAST Software)

HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-774404752-444102748-1486131240-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bing

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - {38DD9B2C-D2EF-4626-96F0-D356DA985CEC} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=937811&p={searchTerms}

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU - No Name - {CB789373-04D5-4EF4-9C16-871463FD0830} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\searchplugins\google-default.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: DownloadHelper - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-13]

FF Extension: Hide My Ass Proxy Extension - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\extension@hidemyass.com.xpi [2014-01-13]

FF Extension: ebayitemdescriptionsaveenlargedp - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{ba2430e0-5b72-4cac-bc9e-7d1aaca75d3d}.xpi [2014-01-13]

FF Extension: Adblock Plus - C:\Users\Halbig\AppData\Roaming\Mozilla\Firefox\Profiles\5jr09hrn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-13]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-13]
 

==================== Services (Whitelisted) =================
 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-05] (AVAST Software)

R2 jswpbapi; C:\Program Files (x86)\TP-LINK\QSS\jswpbapi.exe [265216 2010-04-20] (Wireless)

S3 jswpsapi; C:\Program Files (x86)\TP-LINK\QSS\jswpsapi.exe [954368 2010-04-20] (Wireless)

R2 MagicTuneEngine; C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 RichVideo; C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904 2010-02-03] ()

R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
 

==================== Drivers (Whitelisted) ====================
 

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.)

R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138400 2012-08-26] (SlySoft, Inc.)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-05] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-13] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-13] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-05] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-05] (AVAST Software)

S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-05] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-06 21:28 - 2014-02-06 21:28 - 00987425 _____ () C:\Users\Halbig\Downloads\SecurityCheck.exe

2014-02-06 18:32 - 2014-02-06 18:32 - 02347384 _____ (ESET) C:\Users\Halbig\Downloads\esetsmartinstaller_enu.exe

2014-02-06 16:18 - 2014-02-06 17:43 - 246415360 _____ () C:\Users\Halbig\Downloads\30mm-11-2013-1.part1.rar

2014-02-06 14:04 - 2014-02-06 14:04 - 00214377 _____ () C:\Users\Halbig\Downloads\bookmarks-2014-02-06.json

2014-02-05 14:19 - 2014-02-05 14:19 - 00000000 ____D () C:\Users\Halbig\Documents\AnyDVDHD

2014-02-05 10:22 - 2014-02-06 21:38 - 00000000 ____D () C:\Users\Halbig\Downloads\FRST-OlderVersion

2014-02-05 10:13 - 2014-02-05 10:13 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 10:10 - 2014-02-05 10:10 - 01037530 _____ (Thisisu) C:\Users\Halbig\Downloads\JRT.exe

2014-02-05 00:57 - 2014-02-05 00:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-05 00:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-02-05 00:15 - 2014-02-05 00:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Halbig\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-29 16:27 - 2014-01-29 22:02 - 00000000 ____D () C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint

2014-01-29 16:26 - 2014-01-29 16:26 - 00002171 _____ () C:\Users\Public\Desktop\Epson Easy Photo Print.lnk

2014-01-29 16:25 - 2014-01-29 16:25 - 00000000 ____D () C:\Program Files\Epson Software

2014-01-29 16:23 - 2014-01-29 21:59 - 00000934 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk

2014-01-29 16:23 - 2014-01-29 16:23 - 00000000 ____D () C:\Program Files\EpsonNet

2014-01-29 16:23 - 2011-08-30 13:40 - 00535040 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\ensppui.dll

2014-01-29 16:23 - 2011-08-30 13:40 - 00535040 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enppui.dll

2014-01-29 16:23 - 2011-08-30 13:38 - 00558080 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\ensppmon.dll

2014-01-29 16:23 - 2011-08-30 13:38 - 00558080 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enppmon.dll

2014-01-29 16:23 - 2011-08-10 00:00 - 00464384 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll

2014-01-29 16:23 - 2011-08-01 18:24 - 00250880 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enspres.dll

2014-01-29 16:23 - 2011-08-01 18:24 - 00250880 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\enpres.dll

2014-01-29 16:23 - 2009-10-16 00:00 - 00132560 _____ (Seiko Epson Corporation) C:\Windows\system32\esdevapp.exe

2014-01-29 16:23 - 2009-10-16 00:00 - 00013824 _____ (Seiko Epson Corporation) C:\Windows\system32\esxcdev.dll

2014-01-29 15:15 - 2014-01-29 15:16 - 00030322 ____H () C:\Users\Halbig\Downloads\Addition.txt

2014-01-29 15:14 - 2014-02-06 21:38 - 02079744 _____ (Farbar) C:\Users\Halbig\Downloads\FRST64.exe

2014-01-29 15:14 - 2014-02-06 21:38 - 00014068 _____ () C:\Users\Halbig\Downloads\FRST.txt

2014-01-29 15:14 - 2014-02-06 21:38 - 00000000 ____D () C:\FRST

2014-01-29 13:20 - 2014-02-06 12:16 - 00000000 ____D () C:\Users\Halbig\Desktop\Pc Problem

2014-01-29 12:47 - 2014-01-29 12:47 - 01166132 ____H () C:\Users\Halbig\Downloads\adwcleaner.exe

2014-01-29 00:59 - 2014-01-29 00:59 - 00275304 _____ () C:\Windows\Minidump\012914-40638-01.dmp

2014-01-26 18:53 - 2014-01-26 18:53 - 00279432 _____ () C:\Windows\Minidump\012614-46597-01.dmp

2014-01-25 11:32 - 2014-01-25 11:32 - 00001299 _____ () C:\Users\Halbig\Desktop\Unbenannt - Verknüpfung.lnk

2014-01-23 20:50 - 2014-01-23 21:15 - 00000000 ____D () C:\Users\Halbig\.gimp-2.8

2014-01-23 20:50 - 2014-01-23 20:50 - 00000000 ____D () C:\Users\Halbig\AppData\Local\gegl-0.2

2014-01-23 20:35 - 2014-01-23 20:35 - 00000000 ____D () C:\Program Files\GIMP 2

2014-01-23 20:31 - 2014-01-23 20:32 - 00000000 ____D () C:\Program Files (x86)\GIMP 2

2014-01-23 01:47 - 2014-01-23 01:48 - 00000000 ____D () C:\Users\Halbig\Desktop\Phantom der Oper

2014-01-21 14:21 - 2014-02-06 16:42 - 00000000 ____D () C:\Users\Halbig\Desktop\Bewerbungen 2014

2014-01-16 14:07 - 2014-01-16 14:07 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-16 14:07 - 2014-01-16 14:07 - 00000000 ____D () C:\Program Files\Java

2014-01-15 23:34 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 23:34 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 23:34 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 23:34 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-13 17:40 - 2014-01-13 17:40 - 00125440 _____ () C:\Windows\system32\DlProtectSvc.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00118784 _____ () C:\Windows\system32\amxreadd.exe

2014-01-13 14:21 - 2014-02-05 10:05 - 00000000 ____D () C:\AdwCleaner

2014-01-13 02:52 - 2014-01-13 02:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-13 02:40 - 2014-01-13 02:40 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView

2014-01-13 02:39 - 2014-01-13 02:39 - 00003138 _____ () C:\Windows\System32\Tasks\{C5C75039-A08B-4E61-8475-E111EEA94580}

2014-01-13 02:22 - 2014-02-05 14:09 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-13 02:22 - 2014-01-13 02:22 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\AVAST Software

2014-01-13 02:21 - 2014-02-05 14:09 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-13 02:20 - 2014-02-05 14:08 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-13 02:20 - 2014-02-05 14:08 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-13 02:20 - 2014-02-05 14:08 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-13 02:20 - 2014-02-05 14:08 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-13 02:20 - 2014-02-05 14:08 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-13 02:20 - 2014-02-05 14:08 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-13 02:20 - 2014-01-29 10:46 - 00000000 ____D () C:\Program Files (x86)\Google

2014-01-13 02:20 - 2014-01-13 02:20 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\Program Files\AVAST Software

2014-01-13 01:57 - 2014-01-13 01:57 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Mozilla

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-01-07 11:18 - 2014-02-05 14:16 - 00022286 _____ () C:\Windows\PFRO.log

2014-01-07 10:44 - 2014-01-07 10:44 - 00001268 _____ () C:\Users\Halbig\Desktop\Revo Uninstaller.lnk
 

==================== One Month Modified Files and Folders =======
 

2014-02-06 21:38 - 2014-02-05 10:22 - 00000000 ____D () C:\Users\Halbig\Downloads\FRST-OlderVersion

2014-02-06 21:38 - 2014-01-29 15:14 - 02079744 _____ (Farbar) C:\Users\Halbig\Downloads\FRST64.exe

2014-02-06 21:38 - 2014-01-29 15:14 - 00014068 _____ () C:\Users\Halbig\Downloads\FRST.txt

2014-02-06 21:38 - 2014-01-29 15:14 - 00000000 ____D () C:\FRST

2014-02-06 21:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-02-06 21:33 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-06 21:33 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-06 21:28 - 2014-02-06 21:28 - 00987425 _____ () C:\Users\Halbig\Downloads\SecurityCheck.exe

2014-02-06 21:28 - 2013-12-29 14:59 - 00981105 _____ () C:\Windows\WindowsUpdate.log

2014-02-06 20:56 - 2013-06-27 19:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-06 18:32 - 2014-02-06 18:32 - 02347384 _____ (ESET) C:\Users\Halbig\Downloads\esetsmartinstaller_enu.exe

2014-02-06 17:43 - 2014-02-06 16:18 - 246415360 _____ () C:\Users\Halbig\Downloads\30mm-11-2013-1.part1.rar

2014-02-06 16:56 - 2013-04-28 00:20 - 00062464 _____ () C:\Users\Halbig\Desktop\Amazon Verkauf.xls

2014-02-06 16:42 - 2014-01-21 14:21 - 00000000 ____D () C:\Users\Halbig\Desktop\Bewerbungen 2014

2014-02-06 16:41 - 2014-01-05 20:43 - 00014336 _____ () C:\Users\Halbig\Desktop\Arbeitszeiten.xls

2014-02-06 15:04 - 2013-04-11 22:20 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\vlc

2014-02-06 14:04 - 2014-02-06 14:04 - 00214377 _____ () C:\Users\Halbig\Downloads\bookmarks-2014-02-06.json

2014-02-06 12:16 - 2014-01-29 13:20 - 00000000 ____D () C:\Users\Halbig\Desktop\Pc Problem

2014-02-06 11:29 - 2013-12-30 13:44 - 00005376 _____ () C:\Windows\setupact.log

2014-02-06 11:29 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-06 04:32 - 2011-06-29 03:13 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\dvdcss

2014-02-06 02:15 - 2013-03-03 23:24 - 00000040 ___SH () C:\ProgramData\.zreglib

2014-02-06 00:56 - 2013-06-27 19:40 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-06 00:56 - 2012-07-13 13:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-06 00:56 - 2011-10-14 03:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-06 00:05 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-02-05 14:22 - 2011-06-19 00:26 - 00709900 _____ () C:\Windows\system32\perfh007.dat

2014-02-05 14:22 - 2011-06-19 00:26 - 00154336 _____ () C:\Windows\system32\perfc007.dat

2014-02-05 14:22 - 2009-07-14 06:13 - 01649492 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-05 14:19 - 2014-02-05 14:19 - 00000000 ____D () C:\Users\Halbig\Documents\AnyDVDHD

2014-02-05 14:16 - 2014-01-07 11:18 - 00022286 _____ () C:\Windows\PFRO.log

2014-02-05 14:09 - 2014-01-13 02:22 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-02-05 14:09 - 2014-01-13 02:21 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-02-05 14:08 - 2014-01-13 02:20 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-02-05 14:08 - 2014-01-13 02:20 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-02-05 14:08 - 2014-01-13 02:20 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-02-05 14:08 - 2014-01-13 02:20 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-02-05 14:08 - 2014-01-13 02:20 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-02-05 14:08 - 2014-01-13 02:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-02-05 10:13 - 2014-02-05 10:13 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 10:10 - 2014-02-05 10:10 - 01037530 _____ (Thisisu) C:\Users\Halbig\Downloads\JRT.exe

2014-02-05 10:05 - 2014-01-13 14:21 - 00000000 ____D () C:\AdwCleaner

2014-02-05 00:57 - 2014-02-05 00:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-05 00:56 - 2014-02-05 00:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-05 00:16 - 2014-02-05 00:15 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Halbig\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-30 14:06 - 2011-06-22 20:02 - 00000000 ____D () C:\Users\Halbig\dwhelper

2014-01-30 10:19 - 2013-07-09 22:04 - 00000000 ____D () C:\Users\Halbig\Desktop\Bewerbung 08.07.13

2014-01-29 22:02 - 2014-01-29 16:27 - 00000000 ____D () C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint

2014-01-29 21:59 - 2014-01-29 16:23 - 00000934 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk

2014-01-29 16:27 - 2012-04-18 17:19 - 00000000 ____D () C:\ProgramData\ABBYY

2014-01-29 16:26 - 2014-01-29 16:26 - 00002171 _____ () C:\Users\Public\Desktop\Epson Easy Photo Print.lnk

2014-01-29 16:26 - 2012-04-18 17:18 - 00000000 ____D () C:\ProgramData\UDL

2014-01-29 16:25 - 2014-01-29 16:25 - 00000000 ____D () C:\Program Files\Epson Software

2014-01-29 16:25 - 2012-04-18 17:17 - 00000306 _____ () C:\Windows\setup.iss

2014-01-29 16:25 - 2012-04-18 17:16 - 00000000 ____D () C:\Program Files (x86)\Epson Software

2014-01-29 16:25 - 2010-05-10 12:55 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-01-29 16:24 - 2012-04-18 17:14 - 00000000 ____D () C:\Program Files (x86)\epson

2014-01-29 16:23 - 2014-01-29 16:23 - 00000000 ____D () C:\Program Files\EpsonNet

2014-01-29 15:16 - 2014-01-29 15:15 - 00030322 ____H () C:\Users\Halbig\Downloads\Addition.txt

2014-01-29 12:47 - 2014-01-29 12:47 - 01166132 ____H () C:\Users\Halbig\Downloads\adwcleaner.exe

2014-01-29 10:46 - 2014-01-13 02:20 - 00000000 ____D () C:\Program Files (x86)\Google

2014-01-29 10:46 - 2011-06-20 13:42 - 00000000 ____D () C:\Users\Halbig\AppData\Local\Google

2014-01-29 00:59 - 2014-01-29 00:59 - 00275304 _____ () C:\Windows\Minidump\012914-40638-01.dmp

2014-01-29 00:59 - 2011-08-14 21:21 - 00000000 ____D () C:\Windows\Minidump

2014-01-27 09:22 - 2013-09-29 19:38 - 00000000 ____D () C:\Users\Halbig\Desktop\Auto Unfall

2014-01-26 18:53 - 2014-01-26 18:53 - 00279432 _____ () C:\Windows\Minidump\012614-46597-01.dmp

2014-01-25 11:32 - 2014-01-25 11:32 - 00001299 _____ () C:\Users\Halbig\Desktop\Unbenannt - Verknüpfung.lnk

2014-01-24 23:36 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-01-23 21:15 - 2014-01-23 20:50 - 00000000 ____D () C:\Users\Halbig\.gimp-2.8

2014-01-23 20:50 - 2014-01-23 20:50 - 00000000 ____D () C:\Users\Halbig\AppData\Local\gegl-0.2

2014-01-23 20:50 - 2011-06-18 15:09 - 00000000 ____D () C:\Users\Halbig

2014-01-23 20:48 - 2013-01-28 21:54 - 00000000 ____D () C:\Users\Halbig\Desktop\Aktuelles

2014-01-23 20:35 - 2014-01-23 20:35 - 00000000 ____D () C:\Program Files\GIMP 2

2014-01-23 20:32 - 2014-01-23 20:31 - 00000000 ____D () C:\Program Files (x86)\GIMP 2

2014-01-23 01:50 - 2014-01-06 01:12 - 00000000 ____D () C:\Users\Halbig\Desktop\Verschiedenes

2014-01-23 01:48 - 2014-01-23 01:47 - 00000000 ____D () C:\Users\Halbig\Desktop\Phantom der Oper

2014-01-19 10:17 - 2013-09-15 02:46 - 00000000 ____D () C:\Users\Halbig\Desktop\Wohnungen

2014-01-16 14:34 - 2010-05-10 13:19 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-01-16 14:13 - 2011-06-21 17:12 - 00000000 ____D () C:\Users\Halbig\AppData\Local\Adobe

2014-01-16 14:07 - 2014-01-16 14:07 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-16 14:07 - 2014-01-16 14:07 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-16 14:07 - 2014-01-16 14:07 - 00000000 ____D () C:\Program Files\Java

2014-01-16 01:28 - 2009-07-14 05:45 - 00286776 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-15 23:39 - 2013-07-12 18:18 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-15 23:35 - 2011-10-13 17:02 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00125440 _____ () C:\Windows\system32\DlProtectSvc.exe

2014-01-13 17:40 - 2014-01-13 17:40 - 00118784 _____ () C:\Windows\system32\amxreadd.exe

2014-01-13 03:26 - 2011-06-22 19:52 - 00000000 ____D () C:\Program Files\WinRAR

2014-01-13 02:56 - 2012-07-29 23:52 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2014-01-13 02:52 - 2014-01-13 02:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-13 02:40 - 2014-01-13 02:40 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView

2014-01-13 02:39 - 2014-01-13 02:39 - 00003138 _____ () C:\Windows\System32\Tasks\{C5C75039-A08B-4E61-8475-E111EEA94580}

2014-01-13 02:36 - 2011-06-20 13:43 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Adobe

2014-01-13 02:22 - 2014-01-13 02:22 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\AVAST Software

2014-01-13 02:20 - 2014-01-13 02:20 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-13 02:20 - 2014-01-13 02:20 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-01-13 02:19 - 2014-01-13 02:19 - 00000000 ____D () C:\Program Files\AVAST Software

2014-01-13 01:57 - 2014-01-13 01:57 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Users\Halbig\AppData\Roaming\Mozilla

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-13 01:57 - 2014-01-13 01:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-01-11 13:01 - 2013-07-19 08:07 - 00031744 ___SH () C:\Users\Halbig\Downloads\Thumbs.db

2014-01-07 10:57 - 2014-01-01 23:44 - 00000650 _____ () C:\Windows\wiso.ini

2014-01-07 10:44 - 2014-01-07 10:44 - 00001268 _____ () C:\Users\Halbig\Desktop\Revo Uninstaller.lnk

2014-01-07 10:44 - 2011-10-06 00:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
 

Files to move or delete:

====================

C:\ProgramData\dlprotect.exe
 
 

Some content of TEMP:

====================

C:\Users\Halbig\AppData\Local\Temp\avgnt.exe

C:\Users\Halbig\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-29 21:30
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Okay, also bis jetzt stürzt nur noch der Windows Explorer ab - Meist wenn ich links unten auf Start gehe und dann auf Systemsteuerung... dann dreht sich der Anzeiger und die Meldung, dass der Windows explorer nicht mehr funktioniert erscheint.

Eine Frage brennt mir noch auf der Zunge - Was mache ich mit der Testversion von Avast? Diese läuft bald ab und die infizierten Dateien befinden sich weiterhin in der Quarantäne - Siehe meinen ersten Beitrag - Kann ich diese Dateien löschen? Es sind auch System32 Dateien dabei... - Und was für einen Schutz emfpehlen Sie mir? Nicht lachen aber ich nutze seit über 10 Jahren die freeversion von Antivir und habe sonst nur die Windows Firewall laufen und hatte noch nie ein Problem.

Danke erst mal für den Aufwand, die Mühe und Zeit :)

Hier nochmal mein aktuelles Quarantäneverzeichnis von Avast:

Hier noch ein Hinweis - Ich kann die Datei nicht automatisch durch Avast in Ordnung bringen lassen. Zugriff verweigert. Ist da etwa meine Firewall oder ein Virenprogramm drann schuld?

Diese Sache mit dem Windows explorer wird langsam echt nervig, ich verstehe das nicht, dass der immer wieder abstpürzt, sobald ich über Start auf die Systemsteuerung oder Computer zugreife :dummguck:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\ProgramData\dlprotect.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Lass die amxreead Datei die Avast anmeckert bitte mal bei www.virustotal.com scannen.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-02-2014
Ran by Halbig at 2014-02-08 02:07:28 Run:1
Running from C:\Users\Halbig\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\ProgramData\dlprotect.exe
*****************

C:\ProgramData\dlprotect.exe => Moved successfully.

==== End of Fixlog ====

Und was ist mit den anderen Dateien im Quarantäneverzeichnis? Habe ich doch extra nochmal drauf hingewiesen :-(

Und hier nochmal der Hinweis von Avast

So der Scan ist durch:

SHA256: d61fd2d685243780dd90a81a7d6c0f82bd444a20bc11b00ccdbb879e0b616709
Dateiname: amxread.dll
Erkennungsrate: 0 / 50
Analyse-Datum: 2014-02-08 01:16:28 UTC ( vor 0 Minuten )
1
0
Probably harmless! There are strong indicators suggesting that this file is safe to use.

FILE DETAIL:

Copyright
© Microsoft Corporation. All rights reserved.

Publisher Microsoft Windows
Product Microsoft® Windows® Operating System
Original name amxread.dll
Internal name amxread.dll
File version 6.1.7600.16385 (win7_rtm.090713-1255)
Description API Tracing Manifest Read Library
Signature verification Signed file, verified signature
Signing date 4:17 AM 7/14/2009
Signers
[+] Microsoft Windows
[+] Microsoft Windows Verification PCA
[+] Microsoft Root Certificate Authority
Counter signers
[+] Microsoft Time-Stamp Service
[+] Microsoft Time-Stamp PCA
[+] Microsoft Root Certificate Authority
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2009-07-14 01:04:21
Entry Point 0x000047CB
Number of sections 4
PE sections
Name Virtual address Virtual size Raw size Entropy MD5
.text 4096 19952 19968 6.46 7546ed8dd551256e3f31160e3c567072
.data 24576 884 512 0.18 70b6b440c9c37085d848554832ed7914
.rsrc 28672 1032 1536 2.52 3780761c20957f489a9b3e68d780954b
.reloc 32768 666 1024 2.58 2a3ad0326efc96ad5bdd0bf087dec212
PE imports
[+] KERNEL32.dll
[+] ntdll.dll
PE exports
AmxCloseManifest
AmxGetCharacteristics
AmxGetModuleGroupName
AmxGetModuleType
AmxGetProviderDescription
AmxGetProviderName
AmxGetRecordDataSize
AmxGetRecordID
AmxGetRecordStatus
AmxGetRecordType
Number of PE resources by type
RT_VERSION 1
Number of PE resources by language
ENGLISH US 1
ExifTool file metadata
SubsystemVersion
6.1

LinkerVersion
9.0

ImageVersion
6.1

FileSubtype
0

FileVersionNumber
6.1.7600.16385

UninitializedDataSize
0

LanguageCode
English (U.S.)

FileFlagsMask
0x003f

CharacterSet
Unicode

InitializedDataSize
3584

FileOS
Windows NT 32-bit

MIMEType
application/octet-stream

LegalCopyright
Microsoft Corporation. All rights reserved.

FileVersion
6.1.7600.16385 (win7_rtm.090713-1255)

TimeStamp
2009:07:14 02:04:21+01:00

FileType
Win32 DLL

PEType
PE32

InternalName
amxread.dll

FileAccessDate
2014:02:08 02:16:38+01:00

ProductVersion
6.1.7600.16385

FileDescription
API Tracing Manifest Read Library

OSVersion
6.1

FileCreateDate
2014:02:08 02:16:38+01:00

OriginalFilename
amxread.dll

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Microsoft Corporation

CodeSize
19968

ProductName
Microsoft Windows Operating System

ProductVersionNumber
6.1.7600.16385

EntryPoint
0x47cb

ObjectFileType
Dynamic link library

ZUSÄTZLICHE INFORMATIONEN:

File identification
MD5 ab4ec6d80de12bed0630d672e7719447
SHA1 5154d943b4afcb603cf7db438ae14edf0c9f4f3a
SHA256 d61fd2d685243780dd90a81a7d6c0f82bd444a20bc11b00ccdbb879e0b616709
ssdeep
384:8C0tGpoWIOfst4Wh6Zv1lBTpPa4kRPINYoLgjUFp1StkmIHPWWJJbGWW+:dbU4WhGv1ltHkRPigjzk9

imphash 25ea4fdd3e66478da8d23d66f402db63
File size 23.5 KB ( 24064 bytes )
File type Win32 DLL
Magic literal
PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit

TrID Win32 Dynamic Link Library (generic) (43.5%)
Win32 Executable (generic) (29.8%)
Generic Win/DOS Executable (13.2%)
DOS Executable Generic (13.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
Tags
signed pedll

VirusTotal metadata
First submission 2009-07-17 13:51:04 UTC ( vor 4 Jahre, 6 Monate )
Last submission 2014-02-08 01:16:28 UTC ( vor 4 Minuten )
Dateinamen Trainervip.dll
9377644600B7664F5E720072155D2B00E53F6AFF.dll
amxread.dll
smona132522429899555702245
ab4ec6d80de12bed0630d672e7719447
5154d943b4afcb603cf7db438ae14edf0c9f4f3a
smona131490376190359000933
ab4ec6d80de12bed0630d672e7719447
amxread.dll.VIRUS
ab4ec6d80de12bed0630d672e7719447
amxread_dll_ab4ec6d80de12bed0630d672e7719447
amxread.dll
amxread.dll
file-3389957_dll
smona131056354928792094535
file-667307_dll
smona_d61fd2d685243780dd90a81a7d6c0f82bd444a20bc11b00ccdbb879e0b616709.bin
Advanced heuristic and reputation engines

Dieses Nachricht bzw. Absturz hatte ich heute

Problemsignatur:
Problemereignisname: BlueScreen
Betriebsystemversion: 6.1.7601.2.1.0.768.3
Gebietsschema-ID: 1031

Zusatzinformationen zum Problem:
BCCode: 1000007e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF800033D1E52
BCP3: FFFFF8800338BF18
BCP4: FFFFF8800338B770
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Dateien, die bei der Beschreibung des Problems hilfreich sind:
C:\Windows\Minidump\020814-27471-01.dmp
C:\Users\Halbig\AppData\Local\Temp\WER-101806-0.sysdata.xml

Lesen Sie unsere Datenschutzbestimmungen online:
Datenschutzbestimmungen für Windows*7 - Microsoft Windows

Wenn die Onlinedatenschutzbestimmungen nicht verfügbar sind, lesen Sie unsere Datenschutzbestimmungen offline:
C:\Windows\system32\de-DE\erofflps.txt

3 sind in den Temps > nicht wild, regeln wir mit TFC
1 im Java Cache > TFC

Der einzige Fund der mich intressiert war der den Du bei VT geprüft hast, Fehlalarm :)

Schick die DAtei bitte zu Avast.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.