Trojaner-Board - Mein Computer öffnet in der Nacht Seiten von Watch4 (von alleine und in massen)

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Mein Computer öffnet in der Nacht Seiten von Watch4 (von alleine und in massen) (https://www.trojaner-board.de/155377-computer-oeffnet-nacht-seiten-watch4-alleine-massen.html)

Mein Computer öffnet in der Nacht Seiten von Watch4 (von alleine und in massen)

Einen wunderschönen guten Tag.

Wie im Titel gesagt, wache ich manchmal auf und mein Pc hat firefox geöffnet und ist auf einer Seite: und zwar Watch4.de
Das ist nun 2x passiert

(Dazu zu sagen wäre vieleicht noch, dass ich immer über meine Externe Festplatte Hörbücher zum einschlafen laufen lasse. Mein Pc macht auch nur in der Nacht was er will. Am Tag nie.)

Beim ersten mal dachte ich, ich wäre vieleicht irgendwie rumgerollt und hätte es selbst geöffnet aber heute habe ich gemerkt das die ganze Nacht Dokumentationen und Nachichten geschaut werden. Meine Historie ist voll von Dingen die angesehen wurden.(so viel kann kein Mensch in einer Nacht gucken!!) Es sind keine Pornos oder unseriöse Dinge, eher Dokus über Öl und die besten Eishokes Tore

Die Seite ist angeblich auch vollkommen umsonst (hab sie mir mal angesehen)
Trotzdem möchte ich nicht das mein Pc sachen von alleine macht und würde gerne wissen, ob ihr mit mir herraus finden konnt, wieso mein PC sowas absurdes macht! Meine Mitbewohner nutzen sie selber Internetverbindung und ich will ja net das sie in Gefahr sind!

Vielen Dank schonmal ^^

Saskia Erichsen

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Danke für die Antwort :))

FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-06-2014

Ran by Scheiß Ding (administrator) on SCHEIßDING-PC on 18-06-2014 11:00:43

Running from C:\Users\Scheiß Ding\Downloads

Platform: Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

(Packard Bell BV) C:\ACER\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe

(Packard Bell BV) C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe

(Packard Bell BV) C:\ACER\Preload\Autorun\DRV\FUJI Keyboard\AOSD.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(acer) C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\NotificationCenter\Framework.NotificationCenter.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

(Microsoft Corporation) C:\Windows\System32\conime.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-07-20] (Intel Corporation)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6495264 2008-09-18] (Realtek Semiconductor)

HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-09-18] (Realtek Semiconductor Corp.)

HKLM\...\Run: [FujiKeyboard] => c:\Acer\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe [79416 2008-09-18] (Packard Bell BV)

HKLM-x32\...\Run: [SmpcSys] => C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe [1038136 2008-07-07] (Packard Bell BV)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [eRecoveryService] => [X]

HKLM-x32\...\Run: [jswtrayutil] => "C:\Program Files (x86)\NETGEAR\WNA1100\jswtrayutil.exe"

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [NBKeyScan] => "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

HKLM-x32\...\Winlogon: [Userinit] C:\Windows\system32\ezShellStart.exe [X]

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [SmpcSys] => C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe [1038136 2008-07-07] (Packard Bell BV)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1754816 2014-05-29] (Valve Corporation)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe [847536 2014-05-14] (Adobe Systems Incorporated)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\MountPoints2: {62ba958e-15ac-11e3-8f07-806e6f6e6963} - H:\autorun.exe

HKU\S-1-5-21-105661227-3028142044-1854552800-1001\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Setup-Assistent.lnk

ShortcutTarget: NETGEAR WNA1100 Setup-Assistent.lnk -> C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [49152 2013-09-05] (EasyBits Software Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Scheiß Ding\AppData\Roaming\Mozilla\Firefox\Profiles\tm5rq79j.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF user.js: detected! => C:\Users\Scheiß Ding\AppData\Roaming\Mozilla\Firefox\Profiles\tm5rq79j.default\user.js

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ []
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 AdobeActiveFileMonitor6.0; C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-11] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-05-27] (Avira Operations GmbH & Co. KG)

R2 ETService; C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe [24576 2008-07-16] () [File not signed]

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2008-12-08] (Macrovision Europe Ltd.) [File not signed]

R2 Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [117648 2011-09-22] (Symantec Corporation)

R2 WSWNA1100; C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe [268768 2010-03-22] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)

R1 BHDrvx64; C:\Windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [334384 2013-11-15] (Symantec Corporation)

R1 ccHP; C:\Windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [561800 2013-11-17] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-19] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-20] (Symantec Corporation) [File not signed]

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20140205.002\IDSvia64.sys [521944 2014-01-19] (Symantec Corporation)

S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1008030.006\SRTSP64.SYS [476720 2010-01-20] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1008030.006\SRTSPX64.SYS [32304 2010-01-20] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1008030.006\SYMEFA64.SYS [402992 2010-01-20] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2013-11-15] (Symantec Corporation)

S3 SYMFW; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [120952 2011-09-22] (Symantec Corporation)

R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2010-01-20] (Symantec Corporation)

S3 SYMNDISV; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [56952 2011-09-22] (Symantec Corporation)

R1 SYMTDI; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMTDI.SYS [279160 2011-09-22] (Symantec Corporation)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140206.003\ENG64.SYS [X]

S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140206.003\EX64.SYS [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

S3 SYMDNS; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SYMDNS.SYS [X]

S3 SYMREDRV; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SYMREDRV.SYS [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-18 11:00 - 2014-06-18 11:01 - 00017905 _____ () C:\Users\Scheiß Ding\Downloads\FRST.txt

2014-06-18 11:00 - 2014-06-18 11:00 - 00000000 ____D () C:\FRST

2014-06-18 10:59 - 2014-06-18 10:59 - 02081280 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64.exe

2014-06-18 01:05 - 2014-06-18 01:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\NVIDIA

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Two Worlds II

2014-06-15 20:01 - 2014-06-15 20:01 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-06-15 20:00 - 2014-06-15 20:01 - 26728448 _____ () C:\Users\Scheiß Ding\Downloads\PhysX-9.12.1031-SystemSoftware.msi

2014-06-15 19:57 - 2014-06-15 19:57 - 00001048 _____ () C:\Users\Public\Desktop\Two Worlds II.lnk

2014-06-15 19:44 - 2014-06-15 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump

2014-06-15 19:40 - 2014-06-15 19:40 - 00000000 ____D () C:\Program Files (x86)\Reality Pump

2014-06-15 18:35 - 2014-06-18 10:03 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-15 18:35 - 2014-06-15 18:35 - 00000830 _____ () C:\Users\Public\Desktop\Steam.lnk

2014-06-15 18:35 - 2014-06-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-10 15:10 - 2014-06-10 15:10 - 00000000 ____D () C:\Users\Scheiß Ding\Documents\Electronic Arts

2014-06-10 15:08 - 2014-06-10 15:08 - 00002055 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Supernatural.lnk

2014-06-10 14:56 - 2014-06-10 14:56 - 00002091 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Einfach tierisch.lnk

2014-06-10 14:44 - 2014-06-10 14:44 - 00002019 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Showtime.lnk

2014-06-10 14:30 - 2014-06-10 14:30 - 00002073 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Traumkarrieren.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00001913 _____ () C:\Users\Public\Desktop\Die*Sims™*3.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft WSE

2014-06-10 13:55 - 2014-06-10 15:04 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts
 

==================== One Month Modified Files and Folders =======
 

2014-06-18 11:01 - 2014-06-18 11:00 - 00017905 _____ () C:\Users\Scheiß Ding\Downloads\FRST.txt

2014-06-18 11:01 - 2013-09-05 00:03 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Temp

2014-06-18 11:00 - 2014-06-18 11:00 - 00000000 ____D () C:\FRST

2014-06-18 11:00 - 2013-09-05 01:10 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\Skype

2014-06-18 10:59 - 2014-06-18 10:59 - 02081280 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64.exe

2014-06-18 10:55 - 2006-11-02 17:22 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-18 10:55 - 2006-11-02 17:22 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-18 10:39 - 2013-09-06 15:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-18 10:03 - 2014-06-15 18:35 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-18 10:03 - 2013-09-05 01:18 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\vlc

2014-06-18 10:03 - 2013-09-05 00:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-18 01:06 - 2014-06-18 01:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-17 23:16 - 2013-09-04 23:55 - 01595714 _____ () C:\Windows\WindowsUpdate.log

2014-06-17 23:04 - 2014-01-23 15:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-17 23:01 - 2006-11-02 14:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-06-17 22:56 - 2013-09-05 00:09 - 00000000 _____ () C:\Windows\system32\LogConfigTemp.xml

2014-06-17 22:55 - 2013-09-05 00:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-17 22:55 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-15 21:15 - 2006-11-02 17:42 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\NVIDIA

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Two Worlds II

2014-06-15 20:01 - 2014-06-15 20:01 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-06-15 20:01 - 2014-06-15 20:00 - 26728448 _____ () C:\Users\Scheiß Ding\Downloads\PhysX-9.12.1031-SystemSoftware.msi

2014-06-15 20:01 - 2013-09-06 03:14 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-06-15 20:01 - 2013-09-05 00:03 - 00000000 ____D () C:\Users\Scheiß Ding

2014-06-15 19:57 - 2014-06-15 19:57 - 00001048 _____ () C:\Users\Public\Desktop\Two Worlds II.lnk

2014-06-15 19:53 - 2008-12-08 18:53 - 00128211 _____ () C:\Windows\DirectX.log

2014-06-15 19:44 - 2014-06-15 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump

2014-06-15 19:40 - 2014-06-15 19:40 - 00000000 ____D () C:\Program Files (x86)\Reality Pump

2014-06-15 18:35 - 2014-06-15 18:35 - 00000830 _____ () C:\Users\Public\Desktop\Steam.lnk

2014-06-15 18:35 - 2014-06-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-10 17:56 - 2013-09-05 13:05 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\foobar2000

2014-06-10 15:10 - 2014-06-10 15:10 - 00000000 ____D () C:\Users\Scheiß Ding\Documents\Electronic Arts

2014-06-10 15:08 - 2014-06-10 15:08 - 00002055 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Supernatural.lnk

2014-06-10 15:04 - 2014-06-10 13:55 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts

2014-06-10 15:04 - 2008-12-08 18:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-06-10 14:56 - 2014-06-10 14:56 - 00002091 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Einfach tierisch.lnk

2014-06-10 14:44 - 2014-06-10 14:44 - 00002019 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Showtime.lnk

2014-06-10 14:30 - 2014-06-10 14:30 - 00002073 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Traumkarrieren.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00001913 _____ () C:\Users\Public\Desktop\Die*Sims™*3.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft WSE

2014-06-04 10:47 - 2008-01-21 13:10 - 01418806 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-04 10:47 - 2008-01-21 13:09 - 00618204 _____ () C:\Windows\system32\perfh007.dat

2014-06-04 10:47 - 2008-01-21 13:09 - 00122636 _____ () C:\Windows\system32\perfc007.dat

2014-06-01 22:09 - 2013-10-29 22:15 - 00000068 _____ () C:\Users\Scheiß Ding\Documents\aionmemo_1e106f8e.dat

2014-06-01 19:16 - 2013-09-05 01:42 - 00000000 ____D () C:\Users\Schei� Ding\Documents\Gameforge Live

2014-06-01 19:09 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\LiveKernelReports

2014-05-30 18:38 - 2013-10-21 17:30 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\TS3Client

2014-05-29 21:54 - 2014-02-28 23:57 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-05-29 21:54 - 2013-09-05 01:09 - 00000000 ____D () C:\ProgramData\Skype

2014-05-27 15:09 - 2013-09-05 00:37 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-05-27 15:09 - 2013-09-05 00:37 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-05-23 10:06 - 2013-09-05 01:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live

2014-05-23 10:06 - 2013-09-05 01:42 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive

2014-05-23 10:05 - 2014-05-17 14:16 - 00000000 ____D () C:\Users\Scheiß Ding\Desktop\Hörspiel

2014-05-19 00:28 - 2014-05-17 14:15 - 00000000 ____D () C:\Users\Scheiß Ding\Desktop\Musik
 

Some content of TEMP:

====================

C:\Users\Scheiß Ding\AppData\Local\Temp\avgnt.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\CmdLineExt03.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\Gw2.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\ICReinstall_Setup.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntf16.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntf32.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntfNT.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\vlc-2.1.2-win32.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\vlc-2.1.3-win32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-17 23:00
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-06-2014

Ran by Scheiß Ding at 2014-06-18 11:01:26

Running from C:\Users\Scheiß Ding\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Norton Internet Security (Disabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
 

==================== Installed Programs ======================
 

2007 Microsoft Office Suite Service Pack 1 (SP1) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}) (Version:  - Microsoft)

2007 Microsoft Office Suite Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 9.0.124.0 - Adobe Systems Incorporated)

Adobe Photoshop Elements 6.0 (HKLM-x32\...\Adobe Photoshop Elements 6) (Version: 6.0 - Adobe Systems, Inc.)

Adobe Photoshop Elements 6.0 (x32 Version: 6.0 - Adobe Systems, Inc.) Hidden

Adobe Reader 9 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)

AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version:  - Gameforge)

AION Free-to-Play PTS Client (HKLM-x32\...\{E9C6FF3B-126F-47F3-8E70-9FFF1340CD37} ; PTS_is1) (Version:  - Gameforge)

Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.38.151 - Electronic Arts)

Die Sims™ 3 Einfach tierisch (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)

Die Sims™ 3 Showtime (HKLM-x32\...\{3BBFD444-5FAB-49F6-98B1-A1954E831399}) (Version: 12.0.273 - Electronic Arts)

Die Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)

Die Sims™ 3 Traumkarrieren (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)

EasyBits Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version:  - )

foobar2000 v1.2.9 (HKLM-x32\...\foobar2000) (Version: 1.2.9 - Peter Pawlowski)

Gameforge Live 2.0.3 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.3 - Gameforge)

Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version:  - )

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)

Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden

JMB36X Raid Configurer (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.00.0000 - JMICRON Technology Corp.)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )

League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden

MetaBoli (HKLM-x32\...\{709817E4-5439-4206-8738-796B34B623BD}) (Version: 1.00.0000 - )

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office Home and Student (HKLM\...\Office2007) (Version:  - )

Microsoft Office Home and Student 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Works (x32 Version: 9.7.0621 - Microsoft Corporation) Hidden

Microsoft Works 9.0 SE (HKLM\...\Works9se) (Version:  - )

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

NETGEAR WNA1100 wireless USB 2.0 adapter (HKLM-x32\...\{A2AE9709-283B-4B48-AA34-729C070A62FB}) (Version: 1.0.0.133 - NETGEAR)

Norton Internet Security (x32 Version: 16.8.3.6 - Symantec Corporation) Hidden

NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)

NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.108.688 - NVIDIA Corporation) Hidden

NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 311.06 (Version: 311.06 - NVIDIA Corporation) Hidden

NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)

NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden

Packard Bell ImageWriter (HKLM-x32\...\{F4EA67C9-6748-4C1E-9AFF-04149AC75D95}) (Version: 1.00.0000 - )

Packard Bell Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 3.1.3003 - Acer Incorporated)

Packard Bell Updator (HKLM-x32\...\{CA786CFF-1D31-4804-B436-F3405B14357F}) (Version: 3.00.0000 - )

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5704 - Realtek Semiconductor Corp.)

Setup My PC (HKLM-x32\...\{28518520-F25C-48C3-A224-861F331602F4}) (Version: 3.00.0000 - )

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

Two Worlds II (HKLM-x32\...\Two Worlds II) (Version: 1.0.0 - )

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)

Update for Office 2007 (KB946691) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A420F522-7395-4872-9882-C591B4B92278}) (Version:  - Microsoft)

VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden

VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)

WinRAR 5.00 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

You Don't Know Jack 4 1.00 (HKLM-x32\...\You Don't Know Jack 4) (Version: 1.00 - Take 2 Interactive)
 

==================== Restore Points  =========================
 

23-05-2014 22:00:14 Geplanter Prüfpunkt

26-05-2014 19:14:33 Geplanter Prüfpunkt

27-05-2014 13:58:07 Geplanter Prüfpunkt

28-05-2014 23:48:53 Geplanter Prüfpunkt

01-06-2014 16:28:23 Windows Update

04-06-2014 08:52:33 Windows Update

10-06-2014 11:42:06 Windows Update

10-06-2014 12:14:53 Installiert The Sims 3

10-06-2014 12:18:13 Installiert The Sims 3 Ambitions

10-06-2014 12:35:25 Installiert The Sims 3

10-06-2014 12:39:34 Installiert TheSims3EP6

10-06-2014 12:50:45 Installiert TheSims3EP5

10-06-2014 13:00:17 Installiert The Sims 3

10-06-2014 13:04:23 Installiert TheSims3EP7

15-06-2014 16:34:08 Steam wird installiert

15-06-2014 16:55:08 Windows Update

15-06-2014 17:37:17 DirectX wurde installiert

15-06-2014 17:46:43 DirectX wurde installiert

15-06-2014 17:51:41 DirectX wurde installiert

15-06-2014 18:01:27 NVIDIA PhysX wird installiert

17-06-2014 20:59:13 Windows Update

17-06-2014 21:15:47 Windows Update
 

==================== Hosts content: ==========================
 

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1             localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)

Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {CF47FB22-BEAB-42F1-9748-B1960BBFDF1B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)

Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-09-05 01:13 - 2010-06-14 14:56 - 04573664 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe

2007-09-11 01:45 - 2007-09-11 01:45 - 00124832 _____ () C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

2013-09-05 00:08 - 2008-07-16 14:00 - 00024576 _____ () C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe

2013-09-05 00:08 - 2013-09-05 00:08 - 00032768 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.Controller\3.0.3010.0__14bcaafdb44b5951\Framework.Model.Controller.dll

2013-09-05 00:08 - 2013-09-05 00:08 - 00009216 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3010.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll

2013-09-05 00:08 - 2013-09-05 00:08 - 00061440 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3010.0__3036420f80dd6947\Framework.Library.dll

2013-09-05 00:08 - 2013-09-05 00:08 - 00015360 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Host\3.0.3010.0__672b450de5a7e94a\Framework.Host.dll

2013-09-05 00:08 - 2013-09-05 00:08 - 00006144 _____ () C:\Windows\assembly\GAC_MSIL\Framework.PluginInterface\3.0.3010.0__9ecdf03bb2054f94\Framework.PluginInterface.dll

2013-09-05 00:09 - 2013-09-05 00:09 - 00036864 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3010.0__4df5dcab8860d239\Framework.Utility.dll

2013-09-05 01:13 - 2010-03-22 20:07 - 00268768 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe

2013-09-05 01:13 - 2009-08-28 16:50 - 00282624 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvcLib.dll

2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2008-01-21 04:49 - 2008-01-21 04:49 - 00368640 _____ () C:\Windows\SysWOW64\msjetoledb40.dll

2013-09-05 01:13 - 2010-03-10 14:50 - 00360448 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WifiLib.dll

2014-06-18 01:05 - 2014-06-18 01:05 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2014-05-14 20:39 - 2014-05-14 20:39 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00113171 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 02396179 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00268307 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00027667 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00031251 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 11148307 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 01248787 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00066579 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 02021395 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00100371 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00240659 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00076307 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00045587 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00060947 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libsmooth_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00531475 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libhttplive_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00708627 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libdash_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00114195 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00040467 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00014867 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00133139 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 01512467 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00296979 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00054291 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00038419 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00189971 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00091667 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00036371 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00291859 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00017939 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 01280019 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00018451 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00336403 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00344595 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00198675 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00027155 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libg711_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00015891 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 01371667 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00146451 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00022035 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00733203 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00018963 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00026131 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00171027 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libopus_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00019475 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00019987 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 10396179 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00724499 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00026643 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00019987 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00555027 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00113683 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00027667 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00019987 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00053779 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00016915 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00015379 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00032275 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00018963 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00020499 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00017427 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00015379 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00015379 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00013843 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll

2014-02-05 03:32 - 2014-02-05 03:32 - 00013843 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00018963 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00130579 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00067091 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00168979 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00058899 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 01496083 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00019475 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00013331 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00014355 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00014867 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00014355 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00015379 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll

2014-02-05 03:31 - 2014-02-05 03:31 - 00025619 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys => ""="FSFilter Activity Monitor"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SymEFA.sys => ""="FSFilter Activity Monitor"
 

==================== EXE Association (whitelisted) =============
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 
 

==================== Faulty Device Manager Devices =============
 

Name: Standardtastatur (PS/2)

Description: Standardtastatur (PS/2)

Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standardtastaturen)

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/17/2014 10:56:35 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/15/2014 08:10:17 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, Ausnahmecode 0xc0000005, Fehleroffset 0x00674d6c,

Prozess-ID 0x254c, Anwendungsstartzeit TwoWorlds2.exe0.
 

Error: (06/15/2014 07:58:58 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul PhysXLoader.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733e1, Ausnahmecode 0xc0000135, Fehleroffset 0x0006f1e7,

Prozess-ID 0x1638, Anwendungsstartzeit TwoWorlds2.exe0.
 

Error: (06/15/2014 07:53:59 PM) (Source: System Restore) (EventID: 8193) (User: )

Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = H:\DirectX\DXSETUP.exe /silent; Beschreibung = ô?u; Hr = 0x80070057).
 

Error: (06/15/2014 07:50:46 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul PhysXLoader.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733e1, Ausnahmecode 0xc0000135, Fehleroffset 0x0006f1e7,

Prozess-ID 0x22a8, Anwendungsstartzeit TwoWorlds2.exe0.
 

Error: (06/15/2014 07:49:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul PhysXLoader.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733e1, Ausnahmecode 0xc0000135, Fehleroffset 0x0006f1e7,

Prozess-ID 0x2484, Anwendungsstartzeit TwoWorlds2.exe0.
 

Error: (06/15/2014 07:48:57 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul PhysXLoader.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733e1, Ausnahmecode 0xc0000135, Fehleroffset 0x0006f1e7,

Prozess-ID 0x23f4, Anwendungsstartzeit TwoWorlds2.exe0.
 

Error: (06/15/2014 07:48:17 PM) (Source: System Restore) (EventID: 8193) (User: )

Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = H:\DirectX\DXSETUP.exe /silent; Beschreibung = ô?u; Hr = 0x80070057).
 

Error: (06/15/2014 07:46:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul PhysXLoader.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733e1, Ausnahmecode 0xc0000135, Fehleroffset 0x0006f1e7,

Prozess-ID 0xd2c, Anwendungsstartzeit TwoWorlds2.exe0.
 

Error: (06/15/2014 07:45:57 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Fehlerhafte Anwendung TwoWorlds2.exe, Version 1.0.0.0, Zeitstempel 0x4cbaf4d7, fehlerhaftes Modul PhysXLoader.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733e1, Ausnahmecode 0xc0000135, Fehleroffset 0x0006f1e7,

Prozess-ID 0x24e8, Anwendungsstartzeit TwoWorlds2.exe0.
 
 

System errors:

=============

Error: (06/17/2014 10:56:37 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: i8042prt
 

Error: (06/17/2014 10:55:32 PM) (Source: HTTP) (EventID: 15016) (User: )

Description: \Device\Http\ReqQueueKerberos
 

Error: (06/15/2014 06:50:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Steam Client Service%%1053
 

Error: (06/15/2014 06:50:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000Steam Client Service
 

Error: (06/15/2014 06:33:04 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: i8042prt
 

Error: (06/15/2014 06:32:10 PM) (Source: HTTP) (EventID: 15016) (User: )

Description: \Device\Http\ReqQueueKerberos
 

Error: (06/11/2014 01:49:17 PM) (Source: bowser) (EventID: 8003) (User: )

Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",

der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{235AFF83-291E-46C5-976F-A3359F12E298}-Transport zu sein scheint.

Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 

Error: (06/11/2014 11:52:07 AM) (Source: bowser) (EventID: 8003) (User: )

Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",

der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{235AFF83-291E-46C5-976F-A3359F12E298}-Transport zu sein scheint.

Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 

Error: (06/11/2014 09:06:53 AM) (Source: bowser) (EventID: 8003) (User: )

Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",

der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{235AFF83-291E-46C5-976F-A3359F12E298}-Transport zu sein scheint.

Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 

Error: (06/10/2014 02:23:30 PM) (Source: cdrom) (EventID: 7) (User: )

Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-06-18 11:01:10.504

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.462

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.419

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.376

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.303

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.259

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.216

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:10.174

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:09.877

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT64x86.SYS" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-06-18 11:01:09.829

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT64x86.SYS" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 58%

Total physical RAM: 4086.26 MB

Available physical RAM: 1683.8 MB

Total Pagefile: 8358.06 MB

Available Pagefile: 5703.62 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:916.86 GB) (Free:623.08 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: () (Removable) (Total:7.3 GB) (Free:3.08 GB) FAT32

Drive i: (INTENSO) (Fixed) (Total:1862.56 GB) (Free:1330.65 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 932 GB) (Disk ID: 819DE479)

Partition 1: (Not Active) - (Size=15 GB) - (Type=27)

Partition 2: (Active) - (Size=917 GB) - (Type=07 NTFS)
 

========================================================

Disk: 3 (Size: 7 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 5 (Size: 1863 GB) (Disk ID: D9903021)

Partition 1: (Active) - (Size=-198624428032) - (Type=0B)
 

==================== End Of Log ============================

bitte =P (ja ich weiss..ich bräuchte mal n neues anti-vieren programm)

Da hier anscheinend viel zu tun ist, werde ich jetzt erstmal andere Dinge erledigen :) Ich melde mich dann später wenn erwünscht

bis später

Saskia

(und jaaa..Doppelpost, aber das Thema ist ja auch schon in bearbeitung ^^)

Jetzt bin ich schon auf Seite 3 gerutscht :( Kann man mir net helfen? :confused: Oder hab ich was falsch gemacht?

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Uff.. Na mal sehen:

Maleware

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 20.06.2014

Suchlauf-Zeit: 09:49:04

Logdatei: Fund1.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.06.20.04

Rootkit Datenbank: v2014.06.19.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows Vista Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: ScheiÃ? Ding
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 301681

Verstrichene Zeit: 9 Min, 1 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 0

(No malicious items detected)
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 2

PUP.Optional.InstallCore.A, C:\Users\ScheiÃ? Ding\AppData\Local\Temp\ICReinstall_Setup.exe, In Quarantäne, [7440c8b2a1dac86ed48392c1df2514ec], 

PUP.Optional.Breitschopp, C:\Users\ScheiÃ? Ding\Downloads\agsetup183se.exe, In Quarantäne, [961e7efc077423138fd271f66c989769], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Das kam da auchnoch

Zitat:

Malwarebytes Anti-Malware
www.malwarebytes.org

Update, 20.06.2014 09:48:18, SYSTEM, SCHEIÃ?DING-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.6.19.1,
Update, 20.06.2014 09:48:23, SYSTEM, SCHEIÃ?DING-PC, Manual, Malware Database, 2014.3.4.9, 2014.6.20.4,

(end)

ADW

AdwCleaner Logfile:

Code:

# AdwCleaner v3.212 - Bericht erstellt am 20/06/2014 um 10:11:02

# Aktualisiert 05/06/2014 von Xplode

# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)

# Benutzername : Scheiß Ding - SCHEIßDING-PC

# Gestartet von : C:\Users\Scheiß Ding\Downloads\adwcleaner_3.212.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

[!] Ordner Gelöscht : C:\Users\Scheiß Ding\AppData\Roaming\Windows Net Data

Datei Gelöscht : C:\Users\Scheiß Ding\AppData\Roaming\Mozilla\Firefox\Profiles\tm5rq79j.default\user.js
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v7.0.6001.18639
 
 

-\\ Mozilla Firefox v30.0 (de)
 

[ Datei : C:\Users\Scheiß Ding\AppData\Roaming\Mozilla\Firefox\Profiles\tm5rq79j.default\prefs.js ]
 
 

-\\ Google Chrome v
 

*************************
 

AdwCleaner[R0].txt - [1252 octets] - [20/06/2014 10:09:37]

AdwCleaner[S0].txt - [1177 octets] - [20/06/2014 10:11:02]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1237 octets] ##########

--- --- ---

JRT

Zitat:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows (TM) Vista Home Premium x64
Ran by Scheiá Ding on 20.06.2014 at 10:16:55,75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ FireFox

Emptied folder: C:\Users\Scheiá Ding\AppData\Roaming\mozilla\firefox\profiles\tm5rq79j.default\minidumps [126 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.06.2014 at 10:23:09,94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und ein aktuelles FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-06-2014

Ran by Scheiß Ding (administrator) on SCHEIßDING-PC on 20-06-2014 10:26:32

Running from C:\Users\Scheiß Ding\Downloads

Platform: Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 7

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

(Packard Bell BV) C:\ACER\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe

(Packard Bell BV) C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

() C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

(Packard Bell BV) C:\ACER\Preload\Autorun\DRV\FUJI Keyboard\AOSD.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe

(acer) C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\NotificationCenter\Framework.NotificationCenter.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Farbar) C:\Users\Scheiß Ding\Downloads\FRST64(1).exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-07-20] (Intel Corporation)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6495264 2008-09-18] (Realtek Semiconductor)

HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-09-18] (Realtek Semiconductor Corp.)

HKLM\...\Run: [FujiKeyboard] => c:\Acer\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe [79416 2008-09-18] (Packard Bell BV)

HKLM-x32\...\Run: [SmpcSys] => C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe [1038136 2008-07-07] (Packard Bell BV)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [eRecoveryService] => [X]

HKLM-x32\...\Run: [jswtrayutil] => "C:\Program Files (x86)\NETGEAR\WNA1100\jswtrayutil.exe"

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [NBKeyScan] => "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

HKLM-x32\...\Winlogon: [Userinit] C:\Windows\system32\ezShellStart.exe [X]

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [SmpcSys] => C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe [1038136 2008-07-07] (Packard Bell BV)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1754816 2014-05-29] (Valve Corporation)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\MountPoints2: {62ba958e-15ac-11e3-8f07-806e6f6e6963} - H:\autorun.exe

HKU\S-1-5-21-105661227-3028142044-1854552800-1001\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Setup-Assistent.lnk

ShortcutTarget: NETGEAR WNA1100 Setup-Assistent.lnk -> C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [49152 2013-09-05] (EasyBits Software Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Scheiß Ding\AppData\Roaming\Mozilla\Firefox\Profiles\tm5rq79j.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ []
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 AdobeActiveFileMonitor6.0; C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-11] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-05-27] (Avira Operations GmbH & Co. KG)

R2 ETService; C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe [24576 2008-07-16] () [File not signed]

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2008-12-08] (Macrovision Europe Ltd.) [File not signed]

R2 Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [117648 2011-09-22] (Symantec Corporation)

R2 WSWNA1100; C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe [268768 2010-03-22] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)

R1 BHDrvx64; C:\Windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [334384 2013-11-15] (Symantec Corporation)

R1 ccHP; C:\Windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [561800 2013-11-17] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-19] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-20] (Symantec Corporation) [File not signed]

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20140205.002\IDSvia64.sys [521944 2014-01-19] (Symantec Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-20] (Malwarebytes Corporation)

S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1008030.006\SRTSP64.SYS [476720 2010-01-20] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1008030.006\SRTSPX64.SYS [32304 2010-01-20] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1008030.006\SYMEFA64.SYS [402992 2010-01-20] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2013-11-15] (Symantec Corporation)

S3 SYMFW; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [120952 2011-09-22] (Symantec Corporation)

R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2010-01-20] (Symantec Corporation)

S3 SYMNDISV; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [56952 2011-09-22] (Symantec Corporation)

R1 SYMTDI; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMTDI.SYS [279160 2011-09-22] (Symantec Corporation)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140206.003\ENG64.SYS [X]

S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140206.003\EX64.SYS [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

S3 SYMDNS; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SYMDNS.SYS [X]

S3 SYMREDRV; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SYMREDRV.SYS [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-20 10:26 - 2014-06-20 10:26 - 02082304 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64(1).exe

2014-06-20 10:23 - 2014-06-20 10:24 - 00001165 _____ () C:\Users\Scheiß Ding\Desktop\JRT.txt

2014-06-20 10:16 - 2014-06-20 10:16 - 01016261 _____ (Thisisu) C:\Users\Scheiß Ding\Downloads\JRT.exe

2014-06-20 10:16 - 2014-06-20 10:16 - 00000000 ____D () C:\Windows\ERUNT

2014-06-20 10:13 - 2014-06-20 10:13 - 00001317 _____ () C:\Users\Scheiß Ding\Desktop\AdwCleaner[S0].txt

2014-06-20 10:09 - 2014-06-20 10:11 - 00000000 ____D () C:\AdwCleaner

2014-06-20 10:09 - 2014-06-20 10:09 - 01333465 _____ () C:\Users\Scheiß Ding\Downloads\adwcleaner_3.212.exe

2014-06-20 10:09 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-06-20 10:08 - 2014-06-20 10:08 - 00000273 _____ () C:\Fund2.txt

2014-06-20 10:07 - 2014-06-20 10:07 - 00001412 _____ () C:\Users\Scheiß Ding\Desktop\Fund1.txt

2014-06-20 10:06 - 2014-06-20 10:06 - 00000273 _____ () C:\Users\Scheiß Ding\Desktop\Fund2.txt

2014-06-20 09:48 - 2014-06-20 10:05 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-20 09:48 - 2014-06-20 09:48 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-20 09:48 - 2014-06-20 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-20 09:47 - 2014-06-20 09:48 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-20 09:47 - 2014-06-20 09:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Scheiß Ding\Downloads\mbam-setup-2.0.2.1012.exe

2014-06-20 09:47 - 2014-06-20 09:47 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-20 09:47 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-20 09:47 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-20 09:47 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-19 11:57 - 2014-06-19 11:57 - 00000885 _____ () C:\Users\Scheiß Ding\Desktop\TERA.lnk

2014-06-19 11:57 - 2014-06-19 11:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA

2014-06-19 11:57 - 2014-06-19 11:57 - 00000000 ____D () C:\Program Files (x86)\TERA

2014-06-19 11:56 - 2014-06-19 11:56 - 15366160 _____ (Gameforge Productions GmbH ) C:\Users\Scheiß Ding\Downloads\TERASetup(1).exe

2014-06-18 11:01 - 2014-06-18 11:06 - 00036058 _____ () C:\Users\Scheiß Ding\Downloads\Addition.txt

2014-06-18 11:00 - 2014-06-20 10:26 - 00017169 _____ () C:\Users\Scheiß Ding\Downloads\FRST.txt

2014-06-18 11:00 - 2014-06-20 10:26 - 00000000 ____D () C:\FRST

2014-06-18 10:59 - 2014-06-18 10:59 - 02081280 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64.exe

2014-06-18 01:05 - 2014-06-18 01:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\NVIDIA

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Two Worlds II

2014-06-15 20:01 - 2014-06-15 20:01 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-06-15 20:00 - 2014-06-15 20:01 - 26728448 _____ () C:\Users\Scheiß Ding\Downloads\PhysX-9.12.1031-SystemSoftware.msi

2014-06-15 19:57 - 2014-06-15 19:57 - 00001048 _____ () C:\Users\Public\Desktop\Two Worlds II.lnk

2014-06-15 19:44 - 2014-06-15 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump

2014-06-15 19:40 - 2014-06-15 19:40 - 00000000 ____D () C:\Program Files (x86)\Reality Pump

2014-06-15 18:35 - 2014-06-20 10:15 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-15 18:35 - 2014-06-15 18:35 - 00000830 _____ () C:\Users\Public\Desktop\Steam.lnk

2014-06-15 18:35 - 2014-06-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-10 15:10 - 2014-06-10 15:10 - 00000000 ____D () C:\Users\Scheiß Ding\Documents\Electronic Arts

2014-06-10 15:08 - 2014-06-10 15:08 - 00002055 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Supernatural.lnk

2014-06-10 14:56 - 2014-06-10 14:56 - 00002091 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Einfach tierisch.lnk

2014-06-10 14:44 - 2014-06-10 14:44 - 00002019 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Showtime.lnk

2014-06-10 14:30 - 2014-06-10 14:30 - 00002073 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Traumkarrieren.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00001913 _____ () C:\Users\Public\Desktop\Die*Sims™*3.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft WSE

2014-06-10 13:55 - 2014-06-10 15:04 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts
 

==================== One Month Modified Files and Folders =======
 

2014-06-20 10:26 - 2014-06-20 10:26 - 02082304 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64(1).exe

2014-06-20 10:26 - 2014-06-18 11:00 - 00017169 _____ () C:\Users\Scheiß Ding\Downloads\FRST.txt

2014-06-20 10:26 - 2014-06-18 11:00 - 00000000 ____D () C:\FRST

2014-06-20 10:24 - 2014-06-20 10:23 - 00001165 _____ () C:\Users\Scheiß Ding\Desktop\JRT.txt

2014-06-20 10:20 - 2013-09-05 01:10 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\Skype

2014-06-20 10:17 - 2013-09-04 23:55 - 01639760 _____ () C:\Windows\WindowsUpdate.log

2014-06-20 10:16 - 2014-06-20 10:16 - 01016261 _____ (Thisisu) C:\Users\Scheiß Ding\Downloads\JRT.exe

2014-06-20 10:16 - 2014-06-20 10:16 - 00000000 ____D () C:\Windows\ERUNT

2014-06-20 10:15 - 2014-06-15 18:35 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-20 10:13 - 2014-06-20 10:13 - 00001317 _____ () C:\Users\Scheiß Ding\Desktop\AdwCleaner[S0].txt

2014-06-20 10:13 - 2013-09-05 00:09 - 00000000 _____ () C:\Windows\system32\LogConfigTemp.xml

2014-06-20 10:12 - 2013-09-05 00:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-20 10:12 - 2008-01-21 05:26 - 00047076 _____ () C:\Windows\PFRO.log

2014-06-20 10:12 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-20 10:12 - 2006-11-02 17:22 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-20 10:12 - 2006-11-02 17:22 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-20 10:11 - 2014-06-20 10:09 - 00000000 ____D () C:\AdwCleaner

2014-06-20 10:11 - 2006-11-02 17:42 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-20 10:09 - 2014-06-20 10:09 - 01333465 _____ () C:\Users\Scheiß Ding\Downloads\adwcleaner_3.212.exe

2014-06-20 10:08 - 2014-06-20 10:08 - 00000273 _____ () C:\Fund2.txt

2014-06-20 10:07 - 2014-06-20 10:07 - 00001412 _____ () C:\Users\Scheiß Ding\Desktop\Fund1.txt

2014-06-20 10:06 - 2014-06-20 10:06 - 00000273 _____ () C:\Users\Scheiß Ding\Desktop\Fund2.txt

2014-06-20 10:05 - 2014-06-20 09:48 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-20 10:01 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\MSAgent

2014-06-20 09:48 - 2014-06-20 09:48 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-20 09:48 - 2014-06-20 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-20 09:48 - 2014-06-20 09:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-20 09:47 - 2014-06-20 09:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Scheiß Ding\Downloads\mbam-setup-2.0.2.1012.exe

2014-06-20 09:47 - 2014-06-20 09:47 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-20 09:39 - 2013-09-06 15:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-19 23:38 - 2013-09-05 01:18 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\vlc

2014-06-19 11:57 - 2014-06-19 11:57 - 00000885 _____ () C:\Users\Scheiß Ding\Desktop\TERA.lnk

2014-06-19 11:57 - 2014-06-19 11:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA

2014-06-19 11:57 - 2014-06-19 11:57 - 00000000 ____D () C:\Program Files (x86)\TERA

2014-06-19 11:56 - 2014-06-19 11:56 - 15366160 _____ (Gameforge Productions GmbH ) C:\Users\Scheiß Ding\Downloads\TERASetup(1).exe

2014-06-19 08:38 - 2014-05-17 14:15 - 00000000 ____D () C:\Users\Scheiß Ding\Desktop\Musik

2014-06-19 08:37 - 2013-09-05 00:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-18 18:47 - 2013-09-05 00:41 - 00212992 _____ () C:\Users\Scheiß Ding\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-06-18 11:06 - 2014-06-18 11:01 - 00036058 _____ () C:\Users\Scheiß Ding\Downloads\Addition.txt

2014-06-18 10:59 - 2014-06-18 10:59 - 02081280 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64.exe

2014-06-18 01:06 - 2014-06-18 01:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-17 23:04 - 2014-01-23 15:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-17 23:01 - 2006-11-02 14:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\NVIDIA

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Two Worlds II

2014-06-15 20:01 - 2014-06-15 20:01 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-06-15 20:01 - 2014-06-15 20:00 - 26728448 _____ () C:\Users\Scheiß Ding\Downloads\PhysX-9.12.1031-SystemSoftware.msi

2014-06-15 20:01 - 2013-09-06 03:14 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-06-15 20:01 - 2013-09-05 00:03 - 00000000 ____D () C:\Users\Scheiß Ding

2014-06-15 19:57 - 2014-06-15 19:57 - 00001048 _____ () C:\Users\Public\Desktop\Two Worlds II.lnk

2014-06-15 19:53 - 2008-12-08 18:53 - 00128211 _____ () C:\Windows\DirectX.log

2014-06-15 19:44 - 2014-06-15 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump

2014-06-15 19:40 - 2014-06-15 19:40 - 00000000 ____D () C:\Program Files (x86)\Reality Pump

2014-06-15 18:35 - 2014-06-15 18:35 - 00000830 _____ () C:\Users\Public\Desktop\Steam.lnk

2014-06-15 18:35 - 2014-06-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-10 17:56 - 2013-09-05 13:05 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\foobar2000

2014-06-10 15:10 - 2014-06-10 15:10 - 00000000 ____D () C:\Users\Scheiß Ding\Documents\Electronic Arts

2014-06-10 15:08 - 2014-06-10 15:08 - 00002055 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Supernatural.lnk

2014-06-10 15:04 - 2014-06-10 13:55 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts

2014-06-10 15:04 - 2008-12-08 18:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-06-10 14:56 - 2014-06-10 14:56 - 00002091 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Einfach tierisch.lnk

2014-06-10 14:44 - 2014-06-10 14:44 - 00002019 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Showtime.lnk

2014-06-10 14:30 - 2014-06-10 14:30 - 00002073 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Traumkarrieren.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00001913 _____ () C:\Users\Public\Desktop\Die*Sims™*3.lnk

2014-06-10 14:10 - 2014-06-10 14:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft WSE

2014-06-04 10:47 - 2008-01-21 13:10 - 01418806 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-04 10:47 - 2008-01-21 13:09 - 00618204 _____ () C:\Windows\system32\perfh007.dat

2014-06-04 10:47 - 2008-01-21 13:09 - 00122636 _____ () C:\Windows\system32\perfc007.dat

2014-06-01 22:09 - 2013-10-29 22:15 - 00000068 _____ () C:\Users\Scheiß Ding\Documents\aionmemo_1e106f8e.dat

2014-06-01 19:16 - 2013-09-05 01:42 - 00000000 ____D () C:\Users\Schei� Ding\Documents\Gameforge Live

2014-06-01 19:09 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\LiveKernelReports

2014-05-30 18:38 - 2013-10-21 17:30 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\TS3Client

2014-05-29 21:54 - 2014-02-28 23:57 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-05-29 21:54 - 2013-09-05 01:09 - 00000000 ____D () C:\ProgramData\Skype

2014-05-27 15:09 - 2013-09-05 00:37 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-05-27 15:09 - 2013-09-05 00:37 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-05-23 10:06 - 2013-09-05 01:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live

2014-05-23 10:06 - 2013-09-05 01:42 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive

2014-05-23 10:05 - 2014-05-17 14:16 - 00000000 ____D () C:\Users\Scheiß Ding\Desktop\Hörspiel
 

Some content of TEMP:

====================

C:\Users\Scheiß Ding\AppData\Local\Temp\avgnt.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\CmdLineExt03.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\Gw2.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\Quarantine.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntf16.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntf32.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntfNT.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\vlc-2.1.2-win32.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\vlc-2.1.3-win32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-20 10:20
 

==================== End Of Log ============================

--- --- ---

..viel spass =P
und vielen vielen vielen dank <3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Mal sehen

Zitat:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=760dd85754f2ae4a976a670f7a47955f
# engine=18813
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-21 10:24:02
# local_time=2014-06-21 12:24:02 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 5047 25012089 0 0
# compatibility_mode_1='Norton Internet Security'
# compatibility_mode=3588 16777213 100 91 18652942 139328426 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 92380 240870148 0 0
# scanned=186732
# found=5
# cleaned=0
# scan_time=4127
sh=76CB10F5828DB2E25CEA5555709A229183E29A00 ft=1 fh=d78f3da79356f4db vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-105661227-3028142044-1854552800-1000\$RI5B161.exe"
sh=AB4F92974839FCEAF91234AAD56929A17098412B ft=1 fh=7b7f357f88e9d25c vn="möglicherweise Variante von Win32/Complitly.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-105661227-3028142044-1854552800-1000\$RRI6VZF.exe"
sh=91A6A37448B95C1BBA932E6515D6206A0B38C70B ft=1 fh=c3ac4263f3c8a3fb vn="Win32/VuuPc.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Scheiß Ding\AppData\Local\Temp\DLG_MtaomV44\exe\clickmein-ltd-vuupc-audiograbber-1.0-de-de\VOPackage.exe"
sh=934B38A3ECC7EC3FB88A15AD1707F19719F71661 ft=1 fh=c71c00111a034b54 vn="Win32/VOPackage.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Scheiß Ding\AppData\Local\Temp\is45637729\18331907_stp\AnyProtectScannerSetup.exe"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Scheiß Ding\AppData\Local\Temp\is643178083\5796122_stp\wajam_validate.exe"

5 funde

Zitat:

Results of screen317's Security Check version 0.99.83
Windows Vista Service Pack 1 x64 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Norton Internet Security
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 13.0.0.214
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (30.0)
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Windows Defender MSASCui.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Windows Defender MSASCui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-06-2014 01

Ran by Scheiß Ding (administrator) on SCHEIßDING-PC on 21-06-2014 12:32:19

Running from C:\Users\Scheiß Ding\Downloads

Platform: Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 7

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

() C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

(Packard Bell BV) C:\ACER\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe

(Packard Bell BV) C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe

(Packard Bell BV) C:\ACER\Preload\Autorun\DRV\FUJI Keyboard\AOSD.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Solid State Networks) C:\Program Files (x86)\TERA\TERA-Launcher.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

(acer) C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\NotificationCenter\Framework.NotificationCenter.exe

(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-07-20] (Intel Corporation)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6495264 2008-09-18] (Realtek Semiconductor)

HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-09-18] (Realtek Semiconductor Corp.)

HKLM\...\Run: [FujiKeyboard] => c:\Acer\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe [79416 2008-09-18] (Packard Bell BV)

HKLM-x32\...\Run: [SmpcSys] => C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe [1038136 2008-07-07] (Packard Bell BV)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()

HKLM-x32\...\Run: [eRecoveryService] => [X]

HKLM-x32\...\Run: [jswtrayutil] => "C:\Program Files (x86)\NETGEAR\WNA1100\jswtrayutil.exe"

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [NBKeyScan] => "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

HKLM-x32\...\Winlogon: [Userinit] C:\Windows\system32\ezShellStart.exe [X]

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [SmpcSys] => C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe [1038136 2008-07-07] (Packard Bell BV)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1754816 2014-05-29] (Valve Corporation)

HKU\S-1-5-21-105661227-3028142044-1854552800-1000\...\MountPoints2: {62ba958e-15ac-11e3-8f07-806e6f6e6963} - H:\autorun.exe

HKU\S-1-5-21-105661227-3028142044-1854552800-1001\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Setup-Assistent.lnk

ShortcutTarget: NETGEAR WNA1100 Setup-Assistent.lnk -> C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0913&m=ipower_i9650_ge

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)

ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [49152 2013-09-05] (EasyBits Software Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Scheiß Ding\AppData\Roaming\Mozilla\Firefox\Profiles\tm5rq79j.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-09-07]

FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn [2013-11-09]
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 AdobeActiveFileMonitor6.0; C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-11] ()

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-05-27] (Avira Operations GmbH & Co. KG)

R2 ETService; C:\Program Files\PACKARDBELL\Packard Bell Recovery Management\Service\ETService.exe [24576 2008-07-16] () [File not signed]

R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2008-12-08] (Macrovision Europe Ltd.) [File not signed]

R2 Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [117648 2011-09-22] (Symantec Corporation)

R2 WSWNA1100; C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe [268768 2010-03-22] ()

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)

R1 BHDrvx64; C:\Windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [334384 2013-11-15] (Symantec Corporation)

R1 ccHP; C:\Windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [561800 2013-11-17] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-19] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-20] (Symantec Corporation) [File not signed]

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20140205.002\IDSvia64.sys [521944 2014-01-19] (Symantec Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-20] (Malwarebytes Corporation)

S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1008030.006\SRTSP64.SYS [476720 2010-01-20] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1008030.006\SRTSPX64.SYS [32304 2010-01-20] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1008030.006\SYMEFA64.SYS [402992 2010-01-20] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2013-11-15] (Symantec Corporation)

S3 SYMFW; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [120952 2011-09-22] (Symantec Corporation)

R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2010-01-20] (Symantec Corporation)

S3 SYMNDISV; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [56952 2011-09-22] (Symantec Corporation)

R1 SYMTDI; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMTDI.SYS [279160 2011-09-22] (Symantec Corporation)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140206.003\ENG64.SYS [X]

S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140206.003\EX64.SYS [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

S3 SYMDNS; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SYMDNS.SYS [X]

S3 SYMREDRV; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SYMREDRV.SYS [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-21 12:32 - 2014-06-21 12:32 - 00000000 ____D () C:\Users\Scheiß Ding\Downloads\FRST-OlderVersion

2014-06-21 12:31 - 2014-06-21 12:31 - 00001142 _____ () C:\Users\Scheiß Ding\Desktop\checkup.txt

2014-06-21 12:28 - 2014-06-21 12:28 - 00854367 _____ () C:\Users\Scheiß Ding\Downloads\SecurityCheck.exe

2014-06-21 12:27 - 2014-06-21 12:31 - 00002035 _____ () C:\Users\Scheiß Ding\Desktop\Neues Textdokument.txt

2014-06-21 11:09 - 2014-06-21 11:09 - 02347384 _____ (ESET) C:\Users\Scheiß Ding\Downloads\esetsmartinstaller_deu.exe

2014-06-21 11:09 - 2014-06-21 11:09 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-06-20 13:57 - 2014-06-20 14:00 - 00000000 ___RD () C:\Users\Scheiß Ding\Desktop\Spiele

2014-06-20 11:07 - 2014-06-20 21:39 - 00000000 ____D () C:\Program Files (x86)\TERA

2014-06-20 11:07 - 2014-06-20 11:07 - 15366160 _____ (Gameforge Productions GmbH ) C:\Users\Scheiß Ding\Downloads\TERASetup(2).exe

2014-06-20 11:07 - 2014-06-20 11:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA

2014-06-20 10:16 - 2014-06-20 10:16 - 01016261 _____ (Thisisu) C:\Users\Scheiß Ding\Downloads\JRT.exe

2014-06-20 10:16 - 2014-06-20 10:16 - 00000000 ____D () C:\Windows\ERUNT

2014-06-20 10:09 - 2014-06-20 10:11 - 00000000 ____D () C:\AdwCleaner

2014-06-20 10:09 - 2014-06-20 10:09 - 01333465 _____ () C:\Users\Scheiß Ding\Downloads\adwcleaner_3.212.exe

2014-06-20 10:09 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-06-20 10:08 - 2014-06-20 10:08 - 00000273 _____ () C:\Fund2.txt

2014-06-20 09:48 - 2014-06-20 10:05 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-20 09:48 - 2014-06-20 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-20 09:47 - 2014-06-20 09:48 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-20 09:47 - 2014-06-20 09:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Scheiß Ding\Downloads\mbam-setup-2.0.2.1012.exe

2014-06-20 09:47 - 2014-06-20 09:47 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-20 09:47 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-20 09:47 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-20 09:47 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-19 11:56 - 2014-06-19 11:56 - 15366160 _____ (Gameforge Productions GmbH ) C:\Users\Scheiß Ding\Downloads\TERASetup(1).exe

2014-06-18 11:01 - 2014-06-18 11:06 - 00036058 _____ () C:\Users\Scheiß Ding\Downloads\Addition.txt

2014-06-18 11:00 - 2014-06-21 12:32 - 00017202 _____ () C:\Users\Scheiß Ding\Downloads\FRST.txt

2014-06-18 11:00 - 2014-06-21 12:32 - 00000000 ____D () C:\FRST

2014-06-18 10:59 - 2014-06-21 12:32 - 02083328 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64.exe

2014-06-18 01:05 - 2014-06-18 01:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\NVIDIA

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Two Worlds II

2014-06-15 20:01 - 2014-06-15 20:01 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-06-15 20:00 - 2014-06-15 20:01 - 26728448 _____ () C:\Users\Scheiß Ding\Downloads\PhysX-9.12.1031-SystemSoftware.msi

2014-06-15 19:44 - 2014-06-15 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump

2014-06-15 19:40 - 2014-06-15 19:40 - 00000000 ____D () C:\Program Files (x86)\Reality Pump

2014-06-15 18:35 - 2014-06-21 10:55 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-15 18:35 - 2014-06-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-10 15:10 - 2014-06-10 15:10 - 00000000 ____D () C:\Users\Scheiß Ding\Documents\Electronic Arts

2014-06-10 14:10 - 2014-06-10 14:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft WSE

2014-06-10 13:55 - 2014-06-10 15:04 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts
 

==================== One Month Modified Files and Folders =======
 

2014-06-21 12:32 - 2014-06-21 12:32 - 00000000 ____D () C:\Users\Scheiß Ding\Downloads\FRST-OlderVersion

2014-06-21 12:32 - 2014-06-18 11:00 - 00017202 _____ () C:\Users\Scheiß Ding\Downloads\FRST.txt

2014-06-21 12:32 - 2014-06-18 11:00 - 00000000 ____D () C:\FRST

2014-06-21 12:32 - 2014-06-18 10:59 - 02083328 _____ (Farbar) C:\Users\Scheiß Ding\Downloads\FRST64.exe

2014-06-21 12:31 - 2014-06-21 12:31 - 00001142 _____ () C:\Users\Scheiß Ding\Desktop\checkup.txt

2014-06-21 12:31 - 2014-06-21 12:27 - 00002035 _____ () C:\Users\Scheiß Ding\Desktop\Neues Textdokument.txt

2014-06-21 12:30 - 2013-09-05 01:10 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\Skype

2014-06-21 12:28 - 2014-06-21 12:28 - 00854367 _____ () C:\Users\Scheiß Ding\Downloads\SecurityCheck.exe

2014-06-21 11:39 - 2013-09-06 15:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-21 11:09 - 2014-06-21 11:09 - 02347384 _____ (ESET) C:\Users\Scheiß Ding\Downloads\esetsmartinstaller_deu.exe

2014-06-21 11:09 - 2014-06-21 11:09 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-06-21 10:59 - 2013-09-04 23:55 - 02082000 _____ () C:\Windows\WindowsUpdate.log

2014-06-21 10:55 - 2014-06-15 18:35 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-21 10:53 - 2013-09-05 00:09 - 00000000 _____ () C:\Windows\system32\LogConfigTemp.xml

2014-06-21 10:53 - 2013-09-05 00:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-21 10:53 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-21 10:53 - 2006-11-02 17:22 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-21 10:53 - 2006-11-02 17:22 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-20 23:53 - 2006-11-02 17:42 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-20 21:41 - 2013-09-05 01:18 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\vlc

2014-06-20 21:41 - 2013-09-05 00:41 - 00214016 _____ () C:\Users\Scheiß Ding\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-06-20 21:39 - 2014-06-20 11:07 - 00000000 ____D () C:\Program Files (x86)\TERA

2014-06-20 14:00 - 2014-06-20 13:57 - 00000000 ___RD () C:\Users\Scheiß Ding\Desktop\Spiele

2014-06-20 13:54 - 2013-10-29 22:15 - 00000068 _____ () C:\Users\Scheiß Ding\Documents\aionmemo_1e106f8e.dat

2014-06-20 11:25 - 2013-09-05 01:42 - 00000000 ____D () C:\Users\Schei� Ding\Documents\Gameforge Live

2014-06-20 11:07 - 2014-06-20 11:07 - 15366160 _____ (Gameforge Productions GmbH ) C:\Users\Scheiß Ding\Downloads\TERASetup(2).exe

2014-06-20 11:07 - 2014-06-20 11:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA

2014-06-20 10:16 - 2014-06-20 10:16 - 01016261 _____ (Thisisu) C:\Users\Scheiß Ding\Downloads\JRT.exe

2014-06-20 10:16 - 2014-06-20 10:16 - 00000000 ____D () C:\Windows\ERUNT

2014-06-20 10:12 - 2008-01-21 05:26 - 00047076 _____ () C:\Windows\PFRO.log

2014-06-20 10:11 - 2014-06-20 10:09 - 00000000 ____D () C:\AdwCleaner

2014-06-20 10:09 - 2014-06-20 10:09 - 01333465 _____ () C:\Users\Scheiß Ding\Downloads\adwcleaner_3.212.exe

2014-06-20 10:08 - 2014-06-20 10:08 - 00000273 _____ () C:\Fund2.txt

2014-06-20 10:05 - 2014-06-20 09:48 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-20 10:01 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\MSAgent

2014-06-20 09:48 - 2014-06-20 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-20 09:48 - 2014-06-20 09:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-20 09:47 - 2014-06-20 09:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Scheiß Ding\Downloads\mbam-setup-2.0.2.1012.exe

2014-06-20 09:47 - 2014-06-20 09:47 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-19 11:56 - 2014-06-19 11:56 - 15366160 _____ (Gameforge Productions GmbH ) C:\Users\Scheiß Ding\Downloads\TERASetup(1).exe

2014-06-19 08:37 - 2013-09-05 00:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-18 11:06 - 2014-06-18 11:01 - 00036058 _____ () C:\Users\Scheiß Ding\Downloads\Addition.txt

2014-06-18 01:06 - 2014-06-18 01:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-17 23:04 - 2014-01-23 15:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-17 23:01 - 2006-11-02 14:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\NVIDIA

2014-06-15 20:02 - 2014-06-15 20:02 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Local\Two Worlds II

2014-06-15 20:01 - 2014-06-15 20:01 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-06-15 20:01 - 2014-06-15 20:00 - 26728448 _____ () C:\Users\Scheiß Ding\Downloads\PhysX-9.12.1031-SystemSoftware.msi

2014-06-15 20:01 - 2013-09-06 03:14 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-06-15 20:01 - 2013-09-05 00:03 - 00000000 ____D () C:\Users\Scheiß Ding

2014-06-15 19:53 - 2008-12-08 18:53 - 00128211 _____ () C:\Windows\DirectX.log

2014-06-15 19:44 - 2014-06-15 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump

2014-06-15 19:40 - 2014-06-15 19:40 - 00000000 ____D () C:\Program Files (x86)\Reality Pump

2014-06-15 18:35 - 2014-06-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-10 17:56 - 2013-09-05 13:05 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\foobar2000

2014-06-10 15:10 - 2014-06-10 15:10 - 00000000 ____D () C:\Users\Scheiß Ding\Documents\Electronic Arts

2014-06-10 15:04 - 2014-06-10 13:55 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts

2014-06-10 15:04 - 2008-12-08 18:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-06-10 14:10 - 2014-06-10 14:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft WSE

2014-06-04 10:47 - 2008-01-21 13:10 - 01418806 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-04 10:47 - 2008-01-21 13:09 - 00618204 _____ () C:\Windows\system32\perfh007.dat

2014-06-04 10:47 - 2008-01-21 13:09 - 00122636 _____ () C:\Windows\system32\perfc007.dat

2014-06-01 19:09 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\LiveKernelReports

2014-05-30 18:38 - 2013-10-21 17:30 - 00000000 ____D () C:\Users\Scheiß Ding\AppData\Roaming\TS3Client

2014-05-29 21:54 - 2014-02-28 23:57 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-05-29 21:54 - 2013-09-05 01:09 - 00000000 ____D () C:\ProgramData\Skype

2014-05-27 15:09 - 2013-09-05 00:37 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-05-27 15:09 - 2013-09-05 00:37 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-05-23 10:06 - 2013-09-05 01:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live

2014-05-23 10:06 - 2013-09-05 01:42 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive
 

Some content of TEMP:

====================

C:\Users\Scheiß Ding\AppData\Local\Temp\avgnt.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\CmdLineExt03.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\Gw2.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\Quarantine.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntf16.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntf32.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\SIntfNT.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\Scheiß Ding\AppData\Local\Temp\vlc-2.1.2-win32.exe

C:\Users\Scheiß Ding\AppData\Local\Temp\vlc-2.1.3-win32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-21 11:00
 

==================== End Of Log ============================

--- --- ---

Gestern hat er nach dem checken von den Daten aufjedenfall versucht die Seite nochmal zu öffnen. also weg ist es nicht... Ich war nur schneller mit dem weg-xen. Ich hab auch gemerkt das wenn ich Modzilla die ganze zeit über auf habe, kann dieser trojaner (oder was auch immer) nichts machen. nur wenn ich nicht im internet bin.

Auf dann =) Schönes WE

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Java und ADobe updaten. WIndows updaten, da fehlt ein Servicepack!!!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

HKLM-x32\...\Winlogon: [Userinit] C:\Windows\system32\ezShellStart.exe [X]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Frisches FRST log bitte.