Trojaner-Board - Hohe Arbeitsspeicherbelastung durch svchost.exe;Gleichzeitig schlechtes Internet

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Hohe Arbeitsspeicherbelastung durch svchost.exe;Gleichzeitig schlechtes Internet (https://www.trojaner-board.de/156766-hohe-arbeitsspeicherbelastung-svchost-exe-gleichzeitig-schlechtes-internet.html)

Hohe Arbeitsspeicherbelastung durch svchost.exe;Gleichzeitig schlechtes Internet

Als ich heute meinen Pc gestartet habe bemerkte ich direkt zu Anfang, dass mein Arbeitsspeicher deutlich mehr ausgelast ist also sonst(normalerweise ca 16-18 %; heute ca 30 %)... habe mir aber zuerst nichts dabei gedacht. Nach ein paar Minuten habe ich dann ein leichtes ruckeln in meiner Internet Verbindung bemerkt...Die Verbindung setzte alle paar Minuten kurz aus. Daraufhin habe ich mal im Ressourcenmonitor nachgeschaut und bemerkt das der Prozess svchost.exe 256.116 KB zugesichert hat. Außerdem habe ich bereits vor ein paar Tagen einen seltsamen Prozess bemerkt (shopwit.exe) der immer wieder Werbung in Chrome sendete und sich nicht entfernen ließ. Daraufhin habe ich gestern mit Avira free einen Scan durchgeführt aber das Programm hat keine Warnungen oder Hinweise ausgeworfen.
Was mich hinzu noch verunsichert ist , dass ich vor ein paar Tagen einen Mod (Nodus für Minecraft xD)heruntergeladen habe wovon mir ein Freund abgeraten hat... Deshalb habe ich den Mod zwar gelöscht aber immerhin einmal gedownloaded und verwendet.

Meine Frage nun: Wie kann ich sichergehen dass im download kein Virus oder gar ein Botnet enthalten war ?

Danke im Vorraus

:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
Bitte kein Crossposting (posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
Speichere alle unsere Tools auf dem Desktop ab.
Poste die Logfiles direkt in Deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.

Los geht's:

Schritt 1
http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://deeprybka.trojaner-board.de/tdss/codetags.gif

Also erstmal vielen Dank für die schnelle Antwort :)

Ich habe das Programm gedownloaded und damit gescannt...
Da nicht beide Codes in eine Nachricht passen sende ich sie getrennt... :)
Hier sind die Scans:
FRST

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2014 01

Ran by Nick (administrator) on NICKS-PC on 23-07-2014 14:39:46

Running from C:\Users\Nick\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Saitek) C:\Program Files\SmartTechnology\Software\ProfilerU.exe

(Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

() C:\Windows\system\cm106eye.exe

(Pay By Ads LTD) C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Logitech Inc.) C:\Program Files\Logitech\SetPoint II\SetPointII.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe

(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe

() C:\Program Files (x86)\USIM Editor\iconcs98561.exe

(Dropbox, Inc.) C:\Users\Nick\AppData\Roaming\Dropbox\bin\Dropbox.exe

(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6549136 2012-07-09] (Realtek Semiconductor)

HKLM\...\Run: [Launch LgDeviceAgent] => C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-06-11] (Logitech Inc.)

HKLM\...\Run: [Launch LCDMon] => C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2413128 2010-06-11] (Logitech Inc.)

HKLM\...\Run: [Launch LGDCore] => C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-06-11] (Logitech Inc.)

HKLM\...\Run: [Cm106Sound] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm106.dll,CMICtrlWnd 

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => KHALMNPR.EXE 

HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2013-04-16] (Saitek)

HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-04-16] (Saitek)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM-x32\...\Run: [USBestCR] => C:\Program Files (x86)\USIM Editor\iconcs98561.exe [7041024 2010-07-02] ()

HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-24] (APN)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-04] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [189520 2014-07-07] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3816784 2014-07-21] (LogMeIn Inc.)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1753280 2014-07-16] (Valve Corporation)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent 

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3595608 2014-06-26] (Electronic Arts)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [BlazeServoTool] => "C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe" 

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21445248 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [shopwit] => C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe [510976 2014-05-13] (Pay By Ads LTD)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPointII.lnk

ShortcutTarget: SetPointII.lnk -> C:\Program Files\Logitech\SetPoint II\SetPointII.exe (Logitech Inc.)

Startup: C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.buenosearch.com/?babsrc=HP_ss&mntrId=A0C1D43D7E93280B&affID=128491&tsp=5180

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com

URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File

URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {6A4E10AA-F1EA-4449-BDAE-C408F95C6DFC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS

SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {6A4E10AA-F1EA-4449-BDAE-C408F95C6DFC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS

SearchScopes: HKCU - DefaultScope {6A4E10AA-F1EA-4449-BDAE-C408F95C6DFC} URL = 

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=A0C1D43D7E93280B&affID=128491&tsp=5180

SearchScopes: HKCU - {3B5C7120-752B-47F2-8FDF-3317DBB55E09} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=%5EU3%5EOSJ000%5EYY%5EDE&gct=&itbv=12.10.6.60&apn_uid=9F3B195F-D249-422E-A66D-77EA6ADE5DE0&apn_ptnrs=%5EU3&apn_dtid=%5EOSJ000%5EYY%5EDE&apn_dbr=cr_27.0.1453.94&doi=2013-05-26&trgb=IE,CR&q={searchTerms}&psv=

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll (APN LLC.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Toolbar: HKCU - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll (APN LLC.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-06-23]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HomePage: hxxp://www.buenosearch.com/?babsrc=HP_ss&mntrId=A0C1D43D7E93280B&affID=128491&tsp=5180

CHR StartupUrls: "hxxp://www.buenosearch.com/?babsrc=HP_ss&mntrId=A0C1D43D7E93280B&affID=128491&tsp=5180", "hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=4CC4001BB1A4AB7F&affID=121962&tsp=4957", "https://www.google.de/search?q=googler&rlz=2C1CHFX_deDE0537DE0537&oq=googler&aqs=chrome.0.69i57j5j0l2&sourceid=chrome&ie=UTF-8"

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Extension: (Doodle Jump Deluxe Flash HD ) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\abkhhgjpfcnmmpmhghohpfkcgoineebk [2013-06-13]

CHR Extension: (Google Docs) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-26]

CHR Extension: (Google Drive) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-26]

CHR Extension: (YouTube) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-26]

CHR Extension: (Adblock Plus) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-06-15]

CHR Extension: (Google-Suche) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-26]

CHR Extension: (Avira Browser Safety) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-05-14]

CHR Extension: (Isoball 3) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\iajlkcpgcnbhfhpdeooockfaincfkjjj [2013-06-17]

CHR Extension: (Google Wallet) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]

CHR Extension: (Google Mail) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-26]

CHR HKLM-x32\...\Chrome\Extension: [aaaaojmikegpiepcfdkkjaplodkpfmlo] - C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ\CRX\ToolbarCR.crx [2014-06-25]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-24] (APN LLC.)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-07] (Avira Operations GmbH & Co. KG)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-06-30] ()

R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-07-16] (LogMeIn, Inc.)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

S2 AfaService; C:\Windows\system32\afasrv64.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [37472 2013-02-14] (Advanced Micro Devices, Inc.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-04] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)

R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [27456 2012-07-09] (Intel Corporation)

R3 ISCT; C:\Windows\system32\drivers\ISCTD64.sys [44992 2012-02-09] ()

S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [164736 2013-12-25] (ITE                      )

S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)

R3 SaiK1708; C:\Windows\System32\DRIVERS\SaiK1708.sys [180544 2012-09-20] (Saitek)

R3 SaiU1708; C:\Windows\System32\DRIVERS\SaiU1708.sys [47168 2012-09-20] (Saitek)

R3 USBET; C:\Windows\System32\DRIVERS\ETdrv.sys [6408576 2010-11-10] (Etron)

R3 USBMULCD; C:\Windows\System32\drivers\CM10664.sys [1307648 2011-03-31] (C-Media Electronics Inc)

S3 DIRECTIO; \??\UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys [X]

S3 MSICDSetup; \??\D:\CDriver64.sys [X]

S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-23 14:39 - 2014-07-23 14:40 - 00024305 _____ () C:\Users\Nick\Desktop\FRST.txt

2014-07-23 14:39 - 2014-07-23 14:39 - 00000000 ____D () C:\FRST

2014-07-23 14:39 - 2014-07-23 14:38 - 02091520 _____ (Farbar) C:\Users\Nick\Desktop\FRST64.exe

2014-07-23 14:38 - 2014-07-23 14:38 - 02091520 _____ (Farbar) C:\Users\Nick\Downloads\FRST64.exe

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi

2014-07-22 14:53 - 2014-07-22 14:53 - 00005871 _____ () C:\Users\Nick\AppData\Local\recently-used.xbel

2014-07-21 18:52 - 2014-07-21 18:52 - 00835002 _____ () C:\Users\Nick\Downloads\MLG Water BKCGameplay.zip

2014-07-20 20:47 - 2014-07-20 20:47 - 00000000 ____D () C:\Windows\symbols

2014-07-20 20:46 - 2014-07-20 20:46 - 00000000 ____D () C:\ProgramData\VS

2014-07-20 18:35 - 2014-07-20 18:39 - 00000000 ____D () C:\Users\Nick\Downloads\Unleashed

2014-07-19 19:35 - 2014-07-20 18:38 - 00000000 ____D () C:\Users\Nick\Downloads\versions

2014-07-19 19:35 - 2014-07-19 19:38 - 00000000 ____D () C:\Users\Nick\Downloads\FTBLite2

2014-07-19 19:35 - 2014-07-19 19:38 - 00000000 ____D () C:\Users\Nick\Downloads\assets

2014-07-19 19:35 - 2014-07-19 19:36 - 00000000 ____D () C:\Users\Nick\Downloads\libraries

2014-07-18 13:38 - 2014-07-18 13:38 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Oracle

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-16 17:30 - 2014-07-16 17:30 - 00000000 ____D () C:\ProgramData\Riot Games

2014-07-11 19:45 - 2014-07-11 19:46 - 00000000 ____D () C:\Users\Nick\Desktop\modpackjar

2014-07-09 18:07 - 2014-07-22 16:47 - 00007602 _____ () C:\Users\Nick\AppData\Local\Resmon.ResmonCfg

2014-07-09 17:32 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-07-09 17:32 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-07-09 17:32 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-07-09 17:32 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-09 17:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-09 17:32 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-09 17:32 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-09 17:32 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-09 17:32 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-09 17:32 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-09 17:32 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-09 17:32 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-09 17:32 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-09 17:32 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-09 17:32 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-09 17:32 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-09 17:32 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-09 17:32 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-09 17:32 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-09 17:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-09 17:32 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-09 17:32 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-09 17:32 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-09 17:32 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-09 17:32 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-09 17:32 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-09 17:32 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-09 17:32 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-09 17:32 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-09 17:32 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-09 17:32 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-09 17:32 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-09 17:32 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-09 17:32 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-09 17:32 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-09 17:32 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-09 17:32 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-09 17:32 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-09 17:32 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-09 17:32 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-09 17:32 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-09 17:32 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-09 17:32 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-09 17:32 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-09 17:32 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-09 17:32 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-09 17:32 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-09 17:32 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-09 17:32 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-09 17:32 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-09 17:32 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-09 17:32 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-09 17:32 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-09 17:32 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-09 17:32 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-09 17:32 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-09 17:32 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-09 17:32 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-09 17:32 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-09 17:32 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-09 17:32 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-09 17:32 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-09 17:32 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-09 17:32 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-09 17:30 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-09 17:30 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-09 17:30 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-08 13:44 - 2014-07-08 13:45 - 00000000 ____D () C:\Users\Nick\Desktop\Moorhuhn

2014-07-06 16:56 - 2014-07-06 16:56 - 00583508 _____ () C:\Users\Nick\Desktop\CustomMobSpawner 3.0.0.zip

2014-07-06 16:47 - 2014-07-11 19:46 - 00000000 ____D () C:\Users\Nick\Desktop\alte jar

2014-07-04 21:16 - 2014-07-04 21:16 - 00046080 ___SH () C:\Users\Nick\AppData\Roaming\Thumbs.db

2014-07-04 21:16 - 2014-07-04 21:16 - 00001435 _____ () C:\Users\Nick\Desktop\.minecraft - Verknüpfung.lnk

2014-07-04 20:36 - 2014-07-06 16:58 - 92465531 _____ () C:\Users\Nick\Desktop\Mod-Pack.zip

2014-07-03 15:42 - 2014-07-19 22:29 - 00000091 _____ () C:\Users\Nick\.atl.properties

2014-07-03 15:41 - 2014-07-19 22:29 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\ATLauncher

2014-07-02 21:04 - 2014-07-02 21:04 - 00001195 _____ () C:\Users\Public\Desktop\ROCCAT Power-Grid.lnk

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ROCCAT

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2014-07-02 21:03 - 2014-07-02 21:03 - 00000000 ____D () C:\Program Files (x86)\ROCCAT

2014-06-30 16:26 - 2014-06-30 16:52 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2 OA

2014-06-30 16:26 - 2014-06-30 16:26 - 00000000 ____D () C:\ProgramData\Bohemia Interactive Studio

2014-06-29 20:58 - 2014-06-29 20:58 - 00000220 _____ () C:\Users\Nick\Desktop\Garry's Mod.url

2014-06-29 18:41 - 2014-06-29 18:42 - 01439475 _____ () C:\Users\Nick\Desktop\Documents\TN_FB.pdn

2014-06-26 17:34 - 2014-06-30 17:08 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ArmA 2

2014-06-26 17:34 - 2014-06-30 16:26 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-26 17:34 - 2014-06-29 18:24 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2

2014-06-26 17:34 - 2014-06-26 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-25 18:24 - 2014-06-25 18:24 - 00000222 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead Beta (Obsolete).url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2.url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead.url

2014-06-24 20:43 - 2014-06-25 18:43 - 03149295 _____ () C:\Users\Nick\Desktop\thumbnail.xcf

2014-06-24 20:38 - 2014-06-24 20:38 - 00000000 ____D () C:\Users\Nick\AppData\Local\AskPartnerNetwork

2014-06-24 20:33 - 2014-06-24 20:33 - 03424147 _____ () C:\Users\Nick\Desktop\Documents\thumbnail.xcf
 

==================== One Month Modified Files and Folders =======
 

2014-07-23 14:40 - 2014-07-23 14:39 - 00024305 _____ () C:\Users\Nick\Desktop\FRST.txt

2014-07-23 14:39 - 2014-07-23 14:39 - 00000000 ____D () C:\FRST

2014-07-23 14:39 - 2013-05-25 11:07 - 01235216 _____ () C:\Windows\WindowsUpdate.log

2014-07-23 14:38 - 2014-07-23 14:39 - 02091520 _____ (Farbar) C:\Users\Nick\Desktop\FRST64.exe

2014-07-23 14:38 - 2014-07-23 14:38 - 02091520 _____ (Farbar) C:\Users\Nick\Downloads\FRST64.exe

2014-07-23 14:37 - 2013-06-12 16:43 - 00000000 ____D () C:\Users\Nick\AppData\Local\LogMeIn Hamachi

2014-07-23 14:37 - 2013-05-29 16:31 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Skype

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi

2014-07-23 14:36 - 2013-12-22 16:48 - 00000000 ____D () C:\ProgramData\Origin

2014-07-23 14:36 - 2013-10-04 21:52 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Dropbox

2014-07-23 14:35 - 2014-05-03 14:44 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\DropboxMaster

2014-07-23 14:35 - 2013-12-22 16:47 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-07-23 14:35 - 2013-10-04 21:53 - 00000000 ___RD () C:\Users\Nick\Dropbox

2014-07-23 14:35 - 2013-09-09 15:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-07-23 14:34 - 2013-05-26 12:50 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-23 14:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-23 14:34 - 2009-07-14 06:51 - 00091387 _____ () C:\Windows\setupact.log

2014-07-22 16:48 - 2014-04-18 11:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-22 16:47 - 2014-07-09 18:07 - 00007602 _____ () C:\Users\Nick\AppData\Local\Resmon.ResmonCfg

2014-07-22 16:14 - 2013-11-08 15:08 - 00000000 ____D () C:\Users\Nick\AppData\Local\PMB Files

2014-07-22 16:14 - 2013-11-08 15:08 - 00000000 ____D () C:\ProgramData\PMB Files

2014-07-22 16:01 - 2013-05-26 12:50 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-22 15:06 - 2013-06-14 20:40 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TS3Client

2014-07-22 14:57 - 2014-05-08 19:05 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\.minecraft

2014-07-22 14:53 - 2014-07-22 14:53 - 00005871 _____ () C:\Users\Nick\AppData\Local\recently-used.xbel

2014-07-22 14:53 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-22 14:53 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-21 19:06 - 2013-08-12 18:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express

2014-07-21 18:52 - 2014-07-21 18:52 - 00835002 _____ () C:\Users\Nick\Downloads\MLG Water BKCGameplay.zip

2014-07-21 14:03 - 2013-05-26 12:51 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-07-20 20:47 - 2014-07-20 20:47 - 00000000 ____D () C:\Windows\symbols

2014-07-20 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2014-07-20 20:46 - 2014-07-20 20:46 - 00000000 ____D () C:\ProgramData\VS

2014-07-20 18:41 - 2014-06-06 21:26 - 00000000 ____D () C:\Users\Nick\AppData\Local\ftblauncher

2014-07-20 18:41 - 2014-06-06 21:18 - 04980105 _____ () C:\Users\Nick\Desktop\FtB.exe

2014-07-20 18:41 - 2013-06-03 18:48 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\ftblauncher

2014-07-20 18:39 - 2014-07-20 18:35 - 00000000 ____D () C:\Users\Nick\Downloads\Unleashed

2014-07-20 18:38 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\versions

2014-07-20 18:34 - 2014-06-07 21:33 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\FileZilla

2014-07-19 22:29 - 2014-07-03 15:42 - 00000091 _____ () C:\Users\Nick\.atl.properties

2014-07-19 22:29 - 2014-07-03 15:41 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\ATLauncher

2014-07-19 19:38 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\FTBLite2

2014-07-19 19:38 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\assets

2014-07-19 19:36 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\libraries

2014-07-18 18:13 - 2010-11-21 05:47 - 00994592 _____ () C:\Windows\PFRO.log

2014-07-18 14:02 - 2013-12-25 19:47 - 00000000 ____D () C:\ProgramData\BlazeVideo

2014-07-18 13:38 - 2014-07-18 13:38 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Oracle

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-18 13:06 - 2014-05-22 18:48 - 00000000 ____D () C:\Users\Nick\AppData\Local\TeamSpeak 3 Client

2014-07-16 17:30 - 2014-07-16 17:30 - 00000000 ____D () C:\ProgramData\Riot Games

2014-07-15 17:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-07-15 14:57 - 2014-05-14 17:55 - 00001157 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-07-15 14:57 - 2014-05-14 17:55 - 00000000 ____D () C:\ProgramData\Package Cache

2014-07-15 14:57 - 2014-05-14 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-07-15 14:57 - 2014-05-14 17:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-07-15 14:56 - 2014-05-16 21:15 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-07-11 19:46 - 2014-07-11 19:45 - 00000000 ____D () C:\Users\Nick\Desktop\modpackjar

2014-07-11 19:46 - 2014-07-06 16:47 - 00000000 ____D () C:\Users\Nick\Desktop\alte jar

2014-07-11 19:44 - 2014-03-07 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends

2014-07-11 19:40 - 2009-07-14 06:45 - 00276576 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-11 19:39 - 2014-05-06 19:56 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-07-11 19:39 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-11 19:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2014-07-11 19:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism

2014-07-09 21:07 - 2013-08-14 16:28 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-09 21:05 - 2013-08-10 12:28 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-07-09 17:48 - 2014-04-18 11:17 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-07-09 17:48 - 2014-04-18 11:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-07-09 17:48 - 2013-10-18 14:52 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-07-08 13:45 - 2014-07-08 13:44 - 00000000 ____D () C:\Users\Nick\Desktop\Moorhuhn

2014-07-07 16:26 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-06 16:58 - 2014-07-04 20:36 - 92465531 _____ () C:\Users\Nick\Desktop\Mod-Pack.zip

2014-07-06 16:56 - 2014-07-06 16:56 - 00583508 _____ () C:\Users\Nick\Desktop\CustomMobSpawner 3.0.0.zip

2014-07-04 21:16 - 2014-07-04 21:16 - 00046080 ___SH () C:\Users\Nick\AppData\Roaming\Thumbs.db

2014-07-04 21:16 - 2014-07-04 21:16 - 00001435 _____ () C:\Users\Nick\Desktop\.minecraft - Verknüpfung.lnk

2014-07-04 20:23 - 2014-05-14 18:02 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-07-04 14:06 - 2013-05-25 11:08 - 00000000 ____D () C:\Users\Nick

2014-07-03 16:56 - 2011-04-12 09:43 - 00699536 _____ () C:\Windows\system32\perfh007.dat

2014-07-03 16:56 - 2011-04-12 09:43 - 00149418 _____ () C:\Windows\system32\perfc007.dat

2014-07-03 16:56 - 2009-07-14 07:13 - 01620796 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-02 21:05 - 2013-08-05 14:28 - 00000620 _____ () C:\Users\Nick\Desktop\lol.txt

2014-07-02 21:04 - 2014-07-02 21:04 - 00001195 _____ () C:\Users\Public\Desktop\ROCCAT Power-Grid.lnk

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ROCCAT

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2014-07-02 21:03 - 2014-07-02 21:03 - 00000000 ____D () C:\Program Files (x86)\ROCCAT

2014-06-30 17:08 - 2014-06-26 17:34 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ArmA 2

2014-06-30 16:52 - 2014-06-30 16:26 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2 OA

2014-06-30 16:26 - 2014-06-30 16:26 - 00000000 ____D () C:\ProgramData\Bohemia Interactive Studio

2014-06-30 16:26 - 2014-06-26 17:34 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-30 16:25 - 2013-04-23 10:20 - 00258341 _____ () C:\Windows\DirectX.log

2014-06-30 04:09 - 2014-07-09 17:32 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-30 04:04 - 2014-07-09 17:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-29 21:39 - 2014-05-08 20:09 - 00000106 _____ () C:\Users\Nick\Desktop\Fragenbattle.txt

2014-06-29 20:58 - 2014-06-29 20:58 - 00000220 _____ () C:\Users\Nick\Desktop\Garry's Mod.url

2014-06-29 20:58 - 2014-06-20 23:35 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-29 18:42 - 2014-06-29 18:41 - 01439475 _____ () C:\Users\Nick\Desktop\Documents\TN_FB.pdn

2014-06-29 18:24 - 2014-06-26 17:34 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2

2014-06-26 17:34 - 2014-06-26 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-25 19:19 - 2014-04-16 21:03 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork

2014-06-25 18:43 - 2014-06-24 20:43 - 03149295 _____ () C:\Users\Nick\Desktop\thumbnail.xcf

2014-06-25 18:43 - 2014-01-13 19:08 - 00000000 ____D () C:\Users\Nick\AppData\Local\gtk-2.0

2014-06-25 18:43 - 2014-01-13 19:07 - 00000000 ____D () C:\Users\Nick\.gimp-2.8

2014-06-25 18:24 - 2014-06-25 18:24 - 00000222 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead Beta (Obsolete).url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2.url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead.url

2014-06-24 20:38 - 2014-06-24 20:38 - 00000000 ____D () C:\Users\Nick\AppData\Local\AskPartnerNetwork

2014-06-24 20:33 - 2014-06-24 20:33 - 03424147 _____ () C:\Users\Nick\Desktop\Documents\thumbnail.xcf
 

Some content of TEMP:

====================

C:\Users\Nick\AppData\Local\Temp\avgnt.exe

C:\Users\Nick\AppData\Local\Temp\BuenoSearchTB.exe

C:\Users\Nick\AppData\Local\Temp\DevSetup32.dll

C:\Users\Nick\AppData\Local\Temp\DevSetup64.dll

C:\Users\Nick\AppData\Local\Temp\DriverInstall32.exe

C:\Users\Nick\AppData\Local\Temp\DriverInstall64.exe

C:\Users\Nick\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_yc5_h.dll

C:\Users\Nick\AppData\Local\Temp\i4jdel0.exe

C:\Users\Nick\AppData\Local\Temp\KillProcess.exe

C:\Users\Nick\AppData\Local\Temp\PhoneSMSAPI.dll

C:\Users\Nick\AppData\Local\Temp\setup.exe

C:\Users\Nick\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Nick\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\Nick\AppData\Local\Temp\USmartEditor.exe

C:\Users\Nick\AppData\Local\Temp\xmlUpdater.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-07-21 16:49
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Und hier Addition leider als Anhang...

als ich das Programm startete kam eine Nachricht, welche sagte ,dass ich das Programm nur von einer bestimmten URL downloaden sollte... diese stimmte allerdings nicht mit deiner überein..schlimm??

Danke im Vorraus :)

Hi, so geht's weiter... ;)

Schritt 1

Bitte deinstalliere folgende Programme:

Ask Shopping Toolbar
Java 7 Update 25

Versuche es bei Windows 7 http://deeprybka.trojaner-board.de/b...ne/revo/w7.png zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhttp://deeprybka.trojaner-board.de/b...ninstaller.png hier herunter. Entpacke die zip-Datei auf den Desktop.

Starte die Revouninstaller.exe http://deeprybka.trojaner-board.de/b...o/revoport.PNG
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
Klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
http://deeprybka.trojaner-board.de/b.../uninstall.PNG http://deeprybka.trojaner-board.de/b...o/moderat2.PNG
Reste löschen:
Klicke auf http://deeprybka.trojaner-board.de/b.../selectall.PNG dann auf http://deeprybka.trojaner-board.de/b...evo/delete.PNG und dann auf http://deeprybka.trojaner-board.de/b...evo/weiter.PNG.

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:

Schritt 2
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3
Vor dem Scan den Echtzeitscanner von Avira deaktivieren.

http://www.trojaner-board.de/attachm...iten-avira.png

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Ok hier zuerst mal das Ergebnis vom AdwCleaner:

Code:

# AdwCleaner v3.216 - Bericht erstellt am 23/07/2014 um 19:19:45

# Aktualisiert 17/07/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Nick - NICKS-PC

# Gestartet von : C:\Users\Nick\Desktop\adwcleaner_3.216.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Ask

Ordner Gelöscht : C:\Users\Nick\AppData\Local\Temp\OCS

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.buenosearch.com_0.localstorage

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.buenosearch.com_0.localstorage-journal

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.de_0.localstorage

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.de_0.localstorage-journal

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage

Datei Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage-journal
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{828DC97A-2277-4E10-92A9-4907FA0922A9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F1C81E40-2485-4DB6-8C9D-04BD596B281E}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{828DC97A-2277-4E10-92A9-4907FA0922A9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F1C81E40-2485-4DB6-8C9D-04BD596B281E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\InstallCore

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17207
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
 

-\\ Google Chrome v36.0.1985.125
 

[ Datei : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=9F3B195F-D249-422E-A66D-77EA6ADE5DE0&apn_ptnrs=U3&apn_sauid=F8F8CA1C-3C53-4F75-BE20-FAF4C5CD87DF&apn_dtid=OSJ000YYDE&q={searchTerms}

Gelöscht [Search Provider] : hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=4CC4001BB1A4AB7F&affID=121962&tsp=4957

Gelöscht [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}

Gelöscht [Startup_urls] : hxxp://www.buenosearch.com/?babsrc=HP_ss&mntrId=A0C1D43D7E93280B&affID=128491&tsp=5180

Gelöscht [Startup_urls] : hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=4CC4001BB1A4AB7F&affID=121962&tsp=4957

Gelöscht [Homepage] : hxxp://www.buenosearch.com/?babsrc=HP_ss&mntrId=A0C1D43D7E93280B&affID=128491&tsp=5180

Gelöscht [Extension] : aaaaojmikegpiepcfdkkjaplodkpfmlo
 

*************************
 

AdwCleaner[R0].txt - [7338 octets] - [23/07/2014 19:19:14]

AdwCleaner[S0].txt - [6840 octets] - [23/07/2014 19:19:45]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6900 octets] ##########

Ich scanne jetzt mit Combofix:)
Danke nochmals im Voraus :)

Zitat:

Zitat von OvSilver (Beitrag 1334213)

Danke nochmals im Voraus :)

Gerne!

Soo Combofix ist fertig... :)Es hat nicht gemeckert aber Avira hat trotz Deaktivierung etwas wegen dem Zugriff auf die Registry gesagt... ich hab einfach nix gemacht und Combofix hat mir nun folgende Datei gegeben:

Code:

ComboFix 14-07-22.01 - Nick 23.07.2014  19:32:20.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16317.13468 [GMT 2:00]

ausgeführt von:: c:\users\Nick\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\users\Nick\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

c:\windows\ico.ico

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-06-23 bis 2014-07-23  ))))))))))))))))))))))))))))))

.

.

2014-07-23 17:37 . 2014-07-23 17:37        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-07-23 17:19 . 2010-08-30 06:34        536576        ----a-w-        c:\windows\SysWow64\sqlite3.dll

2014-07-23 17:19 . 2014-07-23 17:19        --------        d-----w-        C:\AdwCleaner

2014-07-23 12:39 . 2014-07-23 12:50        --------        d-----w-        C:\FRST

2014-07-23 12:36 . 2014-07-23 12:36        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi

2014-07-20 18:47 . 2014-07-20 18:47        --------        d-----w-        c:\windows\symbols

2014-07-20 18:46 . 2014-07-20 18:46        --------        d-----w-        c:\programdata\VS

2014-07-18 11:38 . 2014-07-18 11:38        --------        d-----w-        c:\programdata\Oracle

2014-07-18 11:38 . 2014-07-18 11:38        --------        d-----w-        c:\program files (x86)\Common Files\Java

2014-07-18 11:38 . 2014-07-18 11:38        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2014-07-18 11:38 . 2014-07-18 11:38        --------        d-----w-        c:\program files (x86)\Java

2014-07-16 15:30 . 2014-07-16 15:30        --------        d-----w-        c:\programdata\Riot Games

2014-07-09 15:30 . 2014-06-05 14:45        1460736        ----a-w-        c:\windows\system32\lsasrv.dll

2014-07-09 15:30 . 2014-06-05 14:26        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2014-07-09 15:30 . 2014-06-05 14:25        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2014-07-03 13:41 . 2014-07-19 20:29        --------        d-----w-        c:\users\Nick\AppData\Roaming\ATLauncher

2014-07-02 19:03 . 2014-07-02 19:03        --------        d-----w-        c:\program files (x86)\ROCCAT

2014-06-30 14:26 . 2014-06-30 14:52        --------        d-----w-        c:\users\Nick\AppData\Local\ArmA 2 OA

2014-06-30 14:26 . 2014-06-30 14:26        --------        d-----w-        c:\programdata\Bohemia Interactive Studio

2014-06-30 14:26 . 2014-06-30 14:26        --------        d-----w-        c:\program files (x86)\Common Files\BattlEye

2014-06-26 15:34 . 2014-06-29 16:24        --------        d-----w-        c:\users\Nick\AppData\Local\ArmA 2

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-07-21 17:06 . 2014-05-09 20:50        188896        ----a-w-        c:\programdata\Microsoft\VCSExpress\10.0\1031\ResourceCache.dll

2014-07-15 12:56 . 2014-05-16 19:15        42040        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2014-07-09 19:05 . 2013-08-10 10:28        96441528        ----a-w-        c:\windows\system32\MRT.exe

2014-07-09 15:48 . 2014-04-18 09:17        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-07-09 15:48 . 2013-10-18 12:52        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-07-04 18:23 . 2014-05-14 16:02        117712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-06-03 15:22 . 2014-05-14 16:02        130584        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-05-10 12:52 . 2013-06-02 17:05        113440        ----a-w-        c:\programdata\Microsoft\VCExpress\10.0\1031\ResourceCache.dll

2014-05-08 09:32 . 2014-06-11 17:18        3178496        ----a-w-        c:\windows\system32\rdpcorets.dll

2014-05-08 09:32 . 2014-06-11 17:18        16384        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll

2014-04-25 02:34 . 2014-06-11 17:18        801280        ----a-w-        c:\windows\system32\usp10.dll

2014-04-25 02:06 . 2014-06-11 17:18        626688        ----a-w-        c:\windows\SysWow64\usp10.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2014-03-15 14:19        222920        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2014-03-15 14:19        222920        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2014-03-15 14:19        222920        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        131248        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        131248        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        131248        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2014-07-16 1753280]

"EADM"="c:\program files (x86)\Origin\Origin.exe" [2014-06-26 3595608]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21445248]

"shopwit"="c:\users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe" [2014-05-13 510976]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"USBestCR"="c:\program files (x86)\USIM Editor\iconcs98561.exe" [2010-07-02 7041024]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-07-04 750160]

"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-07 189520]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-07-21 3816784]

.

c:\users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Nick\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]

SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetPointII.exe [2009-7-21 815104]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

R2 AfaService;Afa Card Reader Service;c:\windows\system32\afasrv64.exe;c:\windows\SYSNATIVE\afasrv64.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]

R3 DIRECTIO;DIRECTIO;UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys;UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\Drivers\IT9135BDA.sys;c:\windows\SYSNATIVE\Drivers\IT9135BDA.sys [x]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]

R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10x64.sys;c:\windows\SYSNATIVE\Drivers\MHIKEY10x64.sys [x]

R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]

R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\drivers\amdkmpfd.sys;c:\windows\SYSNATIVE\drivers\amdkmpfd.sys [x]

S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]

S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]

S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\drivers\ISCTD64.sys;c:\windows\SYSNATIVE\drivers\ISCTD64.sys [x]

S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]

S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]

S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 SaiK1708;SaiK1708;c:\windows\system32\DRIVERS\SaiK1708.sys;c:\windows\SYSNATIVE\DRIVERS\SaiK1708.sys [x]

S3 SaiU1708;SaiU1708;c:\windows\system32\DRIVERS\SaiU1708.sys;c:\windows\SYSNATIVE\DRIVERS\SaiU1708.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

S3 USBET;SPEEDLINK REFLECT;c:\windows\system32\DRIVERS\ETdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ETdrv.sys [x]

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys;c:\windows\SYSNATIVE\drivers\CM10664.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-07-21 12:02        1104200        ----a-w-        c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-07-23 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-18 15:48]

.

2014-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-26 10:50]

.

2014-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-26 10:50]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2014-03-15 14:19        261832        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2014-03-15 14:19        261832        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2014-03-15 14:19        261832        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-07-09 6549136]

"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-06-11 415816]

"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-06-11 2413128]

"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-06-11 4725320]

"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2011-03-31 8151040]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]

"ProfilerU"="c:\program files\SmartTechnology\Software\ProfilerU.exe" [2013-04-16 454144]

"SaiMfd"="c:\program files\SmartTechnology\Software\SaiMfd.exe" [2013-04-16 158208]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-Overwolf - c:\program files (x86)\Overwolf\Overwolf.exe

Wow6432Node-HKCU-Run-BlazeServoTool - c:\program files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

AddRemove-BattlEye for A2 - c:\program files (x86)\Steam\steamapps\common\Arma 2BattlEye\UnInstallBE.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,

   d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,

   eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c

"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,

   06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64

"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,

   07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,

   f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95

"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,

   fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

.

[HKEY_USERS\S-1-5-21-2093199856-2832982660-2437927299-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-2093199856-2832982660-2437927299-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-07-23  19:43:21 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-07-23 17:43

.

Vor Suchlauf: 18 Verzeichnis(se), 1.601.112.838.144 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 1.602.299.809.792 Bytes frei

.

- - End Of File - - 030C71FAFEE4A3904D5FCC8AD7865359

Hi,

Schritt 1
Downloade Dir HitmanProhttp://deeprybka.trojaner-board.de/b.../hitmanpro.pngauf Deinen Desktop:

HitmanPro-32 Bit Version
HitmanPro-64 Bit Version

Starte die HitmanPro.exe
Klicke auf
http://deeprybka.trojaner-board.de/b...ro/hitman1.PNG
Entferne den Haken bei
http://deeprybka.trojaner-board.de/b...ro/hitman2.PNG
Klicke auf
http://deeprybka.trojaner-board.de/b...ro/hitman3.PNG und http://deeprybka.trojaner-board.de/b...ro/hitman4.PNG
Akzeptiere die Lizenzbedingungen und klicke auf http://deeprybka.trojaner-board.de/b...ro/hitman4.PNG
Klicke auf
http://deeprybka.trojaner-board.de/b...ro/hitman5.PNG
und auf http://deeprybka.trojaner-board.de/b...ro/hitman4.PNG
Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
http://deeprybka.trojaner-board.de/b...ro/hitman6.PNGund speichere die Logdatei auf Deinem Desktop.
Schließe HitmanPro und poste mir das Log.

Schritt 2

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

AAlso erstmal der Hitman log:

Code:

ComboFix 14-07-22.01 - Nick 23.07.2014  19:32:20.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16317.13468 [GMT 2:00]

ausgeführt von:: c:\users\Nick\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\users\Nick\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

c:\windows\ico.ico

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-06-23 bis 2014-07-23  ))))))))))))))))))))))))))))))

.

.

2014-07-23 17:37 . 2014-07-23 17:37        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-07-23 17:19 . 2010-08-30 06:34        536576        ----a-w-        c:\windows\SysWow64\sqlite3.dll

2014-07-23 17:19 . 2014-07-23 17:19        --------        d-----w-        C:\AdwCleaner

2014-07-23 12:39 . 2014-07-23 12:50        --------        d-----w-        C:\FRST

2014-07-23 12:36 . 2014-07-23 12:36        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi

2014-07-20 18:47 . 2014-07-20 18:47        --------        d-----w-        c:\windows\symbols

2014-07-20 18:46 . 2014-07-20 18:46        --------        d-----w-        c:\programdata\VS

2014-07-18 11:38 . 2014-07-18 11:38        --------        d-----w-        c:\programdata\Oracle

2014-07-18 11:38 . 2014-07-18 11:38        --------        d-----w-        c:\program files (x86)\Common Files\Java

2014-07-18 11:38 . 2014-07-18 11:38        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2014-07-18 11:38 . 2014-07-18 11:38        --------        d-----w-        c:\program files (x86)\Java

2014-07-16 15:30 . 2014-07-16 15:30        --------        d-----w-        c:\programdata\Riot Games

2014-07-09 15:30 . 2014-06-05 14:45        1460736        ----a-w-        c:\windows\system32\lsasrv.dll

2014-07-09 15:30 . 2014-06-05 14:26        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2014-07-09 15:30 . 2014-06-05 14:25        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2014-07-03 13:41 . 2014-07-19 20:29        --------        d-----w-        c:\users\Nick\AppData\Roaming\ATLauncher

2014-07-02 19:03 . 2014-07-02 19:03        --------        d-----w-        c:\program files (x86)\ROCCAT

2014-06-30 14:26 . 2014-06-30 14:52        --------        d-----w-        c:\users\Nick\AppData\Local\ArmA 2 OA

2014-06-30 14:26 . 2014-06-30 14:26        --------        d-----w-        c:\programdata\Bohemia Interactive Studio

2014-06-30 14:26 . 2014-06-30 14:26        --------        d-----w-        c:\program files (x86)\Common Files\BattlEye

2014-06-26 15:34 . 2014-06-29 16:24        --------        d-----w-        c:\users\Nick\AppData\Local\ArmA 2

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-07-21 17:06 . 2014-05-09 20:50        188896        ----a-w-        c:\programdata\Microsoft\VCSExpress\10.0\1031\ResourceCache.dll

2014-07-15 12:56 . 2014-05-16 19:15        42040        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2014-07-09 19:05 . 2013-08-10 10:28        96441528        ----a-w-        c:\windows\system32\MRT.exe

2014-07-09 15:48 . 2014-04-18 09:17        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-07-09 15:48 . 2013-10-18 12:52        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-07-04 18:23 . 2014-05-14 16:02        117712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-06-03 15:22 . 2014-05-14 16:02        130584        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-05-10 12:52 . 2013-06-02 17:05        113440        ----a-w-        c:\programdata\Microsoft\VCExpress\10.0\1031\ResourceCache.dll

2014-05-08 09:32 . 2014-06-11 17:18        3178496        ----a-w-        c:\windows\system32\rdpcorets.dll

2014-05-08 09:32 . 2014-06-11 17:18        16384        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll

2014-04-25 02:34 . 2014-06-11 17:18        801280        ----a-w-        c:\windows\system32\usp10.dll

2014-04-25 02:06 . 2014-06-11 17:18        626688        ----a-w-        c:\windows\SysWow64\usp10.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2014-03-15 14:19        222920        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2014-03-15 14:19        222920        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2014-03-15 14:19        222920        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        131248        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        131248        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        131248        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2014-07-16 1753280]

"EADM"="c:\program files (x86)\Origin\Origin.exe" [2014-06-26 3595608]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21445248]

"shopwit"="c:\users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe" [2014-05-13 510976]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"USBestCR"="c:\program files (x86)\USIM Editor\iconcs98561.exe" [2010-07-02 7041024]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-07-04 750160]

"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-07 189520]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-07-21 3816784]

.

c:\users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Nick\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]

SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetPointII.exe [2009-7-21 815104]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

R2 AfaService;Afa Card Reader Service;c:\windows\system32\afasrv64.exe;c:\windows\SYSNATIVE\afasrv64.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]

R3 DIRECTIO;DIRECTIO;UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys;UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\Drivers\IT9135BDA.sys;c:\windows\SYSNATIVE\Drivers\IT9135BDA.sys [x]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]

R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10x64.sys;c:\windows\SYSNATIVE\Drivers\MHIKEY10x64.sys [x]

R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]

R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\drivers\amdkmpfd.sys;c:\windows\SYSNATIVE\drivers\amdkmpfd.sys [x]

S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]

S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]

S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\drivers\ISCTD64.sys;c:\windows\SYSNATIVE\drivers\ISCTD64.sys [x]

S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]

S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]

S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 SaiK1708;SaiK1708;c:\windows\system32\DRIVERS\SaiK1708.sys;c:\windows\SYSNATIVE\DRIVERS\SaiK1708.sys [x]

S3 SaiU1708;SaiU1708;c:\windows\system32\DRIVERS\SaiU1708.sys;c:\windows\SYSNATIVE\DRIVERS\SaiU1708.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

S3 USBET;SPEEDLINK REFLECT;c:\windows\system32\DRIVERS\ETdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ETdrv.sys [x]

S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys;c:\windows\SYSNATIVE\drivers\CM10664.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-07-21 12:02        1104200        ----a-w-        c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-07-23 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-18 15:48]

.

2014-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-26 10:50]

.

2014-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-26 10:50]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2014-03-15 14:19        261832        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2014-03-15 14:19        261832        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2014-03-15 14:19        261832        ----a-w-        c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09        164016        ----a-w-        c:\users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-07-09 6549136]

"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-06-11 415816]

"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-06-11 2413128]

"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-06-11 4725320]

"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2011-03-31 8151040]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]

"ProfilerU"="c:\program files\SmartTechnology\Software\ProfilerU.exe" [2013-04-16 454144]

"SaiMfd"="c:\program files\SmartTechnology\Software\SaiMfd.exe" [2013-04-16 158208]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-Overwolf - c:\program files (x86)\Overwolf\Overwolf.exe

Wow6432Node-HKCU-Run-BlazeServoTool - c:\program files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

AddRemove-BattlEye for A2 - c:\program files (x86)\Steam\steamapps\common\Arma 2BattlEye\UnInstallBE.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,

   d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,

   eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c

"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,

   06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64

"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,

   07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,

   f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95

"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,

   fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

.

[HKEY_USERS\S-1-5-21-2093199856-2832982660-2437927299-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-2093199856-2832982660-2437927299-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-07-23  19:43:21 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-07-23 17:43

.

Vor Suchlauf: 18 Verzeichnis(se), 1.601.112.838.144 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 1.602.299.809.792 Bytes frei

.

- - End Of File - - 030C71FAFEE4A3904D5FCC8AD7865359

Ich scanne dann jetzt mit FRSt nochmal :) bis gleich und danke

Oh... falscher text in der zwischenablage :)

hier ist hitman

Code:



        Code:


        
HitmanPro 3.7.9.221

www.hitmanpro.com
 

   Computer name . . . . : NICKS-PC

   Windows . . . . . . . : 6.1.1.7601.X64/4

   User name . . . . . . : Nicks-Pc\Nick

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free
 

   Scan date . . . . . . : 2014-07-23 20:07:37

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 5m 5s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 18
 

   Objects scanned . . . : 2.087.949

   Files scanned . . . . : 104.112

   Remnants scanned  . . : 904.994 files / 1.078.843 keys
 

Suspicious files ____________________________________________________________
 

   C:\Users\Nick\Desktop\FRST64.exe

      Size . . . . . . . : 2.091.520 bytes

      Age  . . . . . . . : 0.2 days (2014-07-23 14:39:02)

      Entropy  . . . . . : 7.5

      SHA-256  . . . . . : 886EF2C3EA6FE32369349A7BF0032E1D9347F28BE2D09CEF0429CC57588BC5E2

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.

      References

         HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Users\Nick\Desktop\FRST64.exe

      Forensic Cluster

         -2.7s C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab

          0.0s C:\Users\Nick\Desktop\FRST64.exe

          8.1s C:\Windows\Prefetch\FRST64.EXE-98511E55.pf

          9.3s C:\Windows\Prefetch\NVTRAY.EXE-DB83881B.pf

          9.3s C:\Windows\Prefetch\NVTRAY.EXE-DB83881B.pf

         39.7s C:\FRST\

         39.7s C:\FRST\Hives\

         39.7s C:\FRST\Logs\

         39.7s C:\FRST\Quarantine\

         40.0s C:\FRST\Hives\ERDNT.INF

         40.0s C:\FRST\Hives\ERDNT.CON

         40.0s C:\FRST\Hives\BCD

         40.0s C:\FRST\Hives\SYSTEM

         40.1s C:\FRST\Hives\SOFTWARE

         40.1s C:\FRST\Hives\SOFTWARE

         40.6s C:\FRST\Hives\DEFAULT

         40.7s C:\FRST\Hives\SECURITY

         40.7s C:\FRST\Hives\SAM

         40.7s C:\FRST\Hives\Users\

         40.7s C:\FRST\Hives\Users\00000001\

         40.7s C:\FRST\Hives\Users\00000001\NTUSER.DAT

         40.7s C:\FRST\Hives\Users\00000002\

         40.7s C:\FRST\Hives\Users\00000002\UsrClass.dat

         40.8s C:\FRST\Hives\COMPONENTS

         41.2s C:\FRST\Hives\ERDNT.EXE

         41.2s C:\FRST\Hives\ERDNT.EXE

         41.2s C:\FRST\Hives\ERDNTWIN.LOC

         41.2s C:\FRST\Hives\ERDNTDOS.LOC

         41.2s C:\Windows\Prefetch\ERUNT.EXE-518CFD10.pf

         41.2s C:\Windows\Prefetch\CMD.EXE-4A81B364.pf

         44.7s C:\Users\Nick\Desktop\FRST.txt

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf

         70.0s C:\Windows\Prefetch\JAVA.EXE-07FE5A9A.pf
 

   C:\Users\Nick\Downloads\FRST64.exe

      Size . . . . . . . : 2.091.520 bytes

      Age  . . . . . . . : 0.2 days (2014-07-23 14:38:50)

      Entropy  . . . . . : 7.5

      SHA-256  . . . . . : 886EF2C3EA6FE32369349A7BF0032E1D9347F28BE2D09CEF0429CC57588BC5E2

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.

      Forensic Cluster

          0.0s C:\Users\Nick\Downloads\FRST64.exe

          0.0s C:\Users\Nick\Downloads\FRST64.exe

          0.2s C:\Users\Nick\AppData\Roaming\Dropbox\shellext\l\53cfacda

          0.2s C:\Users\Nick\AppData\Roaming\Dropbox\shellext\l\53cfacda
 
 

Potential Unwanted Programs _________________________________________________
 

   C:\ProgramData\APN\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF\ (AskBar)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E\ (AskBar)

   HKU\.DEFAULT\Software\AskPartnerNetwork\ (AskBar)

   HKU\S-1-5-18\Software\AskPartnerNetwork\ (AskBar)

:) sry

OK und hier FRST

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2014 01

Ran by Nick (administrator) on NICKS-PC on 23-07-2014 20:17:54

Running from C:\Users\Nick\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Pay By Ads LTD) C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6549136 2012-07-09] (Realtek Semiconductor)

HKLM\...\Run: [Launch LgDeviceAgent] => C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-06-11] (Logitech Inc.)

HKLM\...\Run: [Launch LCDMon] => C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2413128 2010-06-11] (Logitech Inc.)

HKLM\...\Run: [Launch LGDCore] => C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-06-11] (Logitech Inc.)

HKLM\...\Run: [Cm106Sound] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm106.dll,CMICtrlWnd 

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => KHALMNPR.EXE 

HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2013-04-16] (Saitek)

HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-04-16] (Saitek)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM-x32\...\Run: [USBestCR] => C:\Program Files (x86)\USIM Editor\iconcs98561.exe [7041024 2010-07-02] ()

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-04] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [189520 2014-07-07] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3816784 2014-07-21] (LogMeIn Inc.)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1753280 2014-07-16] (Valve Corporation)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3595608 2014-06-26] (Electronic Arts)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21445248 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-2093199856-2832982660-2437927299-1000\...\Run: [shopwit] => C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe [510976 2014-05-13] (Pay By Ads LTD)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPointII.lnk

ShortcutTarget: SetPointII.lnk -> C:\Program Files\Logitech\SetPoint II\SetPointII.exe (Logitech Inc.)

Startup: C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {6A4E10AA-F1EA-4449-BDAE-C408F95C6DFC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {6A4E10AA-F1EA-4449-BDAE-C408F95C6DFC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS

SearchScopes: HKCU - {3B5C7120-752B-47F2-8FDF-3317DBB55E09} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=%5EU3%5EOSJ000%5EYY%5EDE&gct=&itbv=12.10.6.60&apn_uid=9F3B195F-D249-422E-A66D-77EA6ADE5DE0&apn_ptnrs=%5EU3&apn_dtid=%5EOSJ000%5EYY%5EDE&apn_dbr=cr_27.0.1453.94&doi=2013-05-26&trgb=IE,CR&q={searchTerms}&psv=

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-06-23]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "https://www.google.de/search?q=googler&rlz=2C1CHFX_deDE0537DE0537&oq=googler&aqs=chrome.0.69i57j5j0l2&sourceid=chrome&ie=UTF-8"

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Extension: (Doodle Jump Deluxe Flash HD ) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\abkhhgjpfcnmmpmhghohpfkcgoineebk [2013-06-13]

CHR Extension: (Google Docs) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-26]

CHR Extension: (Google Drive) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-26]

CHR Extension: (YouTube) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-26]

CHR Extension: (Adblock Plus) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-06-15]

CHR Extension: (Google-Suche) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-26]

CHR Extension: (Avira Browser Safety) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-05-14]

CHR Extension: (Isoball 3) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\iajlkcpgcnbhfhpdeooockfaincfkjjj [2013-06-17]

CHR Extension: (Google Wallet) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]

CHR Extension: (Google Mail) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-26]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-07] (Avira Operations GmbH & Co. KG)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-06-30] ()

R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-07-16] (LogMeIn, Inc.)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

S2 AfaService; C:\Windows\system32\afasrv64.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [37472 2013-02-14] (Advanced Micro Devices, Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-04] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)

R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [27456 2012-07-09] (Intel Corporation)

R3 ISCT; C:\Windows\system32\drivers\ISCTD64.sys [44992 2012-02-09] ()

S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [164736 2013-12-25] (ITE                      )

S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)

R3 SaiK1708; C:\Windows\System32\DRIVERS\SaiK1708.sys [180544 2012-09-20] (Saitek)

R3 SaiU1708; C:\Windows\System32\DRIVERS\SaiU1708.sys [47168 2012-09-20] (Saitek)

R3 USBET; C:\Windows\System32\DRIVERS\ETdrv.sys [6408576 2010-11-10] (Etron)

R3 USBMULCD; C:\Windows\System32\drivers\CM10664.sys [1307648 2011-03-31] (C-Media Electronics Inc)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 DIRECTIO; \??\UNC\srv1c027-b.wds8-b.intern\reminst\Test\BitPro64\DirectIo.sys [X]

S3 MSICDSetup; \??\D:\CDriver64.sys [X]

S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-23 20:13 - 2014-07-23 20:13 - 00013624 _____ () C:\Users\Nick\Desktop\HitmanPro_20140723_2013.log

2014-07-23 20:06 - 2014-07-23 20:13 - 00000000 ____D () C:\ProgramData\HitmanPro

2014-07-23 20:06 - 2014-07-23 20:06 - 11188736 _____ (SurfRight B.V.) C:\Users\Nick\Downloads\HitmanPro_x64.exe

2014-07-23 20:06 - 2014-07-23 20:06 - 11188736 _____ (SurfRight B.V.) C:\Users\Nick\Desktop\HitmanPro_x64.exe

2014-07-23 19:43 - 2014-07-23 19:43 - 00024124 _____ () C:\ComboFix.txt

2014-07-23 19:31 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-07-23 19:31 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-07-23 19:31 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-07-23 19:31 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-07-23 19:31 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-07-23 19:31 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-07-23 19:31 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-07-23 19:31 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-07-23 19:30 - 2014-07-23 19:43 - 00000000 ____D () C:\Qoobox

2014-07-23 19:30 - 2014-07-23 19:42 - 00000000 ____D () C:\Windows\erdnt

2014-07-23 19:29 - 2014-07-23 19:29 - 05562024 ____R (Swearware) C:\Users\Nick\Desktop\ComboFix.exe

2014-07-23 19:29 - 2014-07-23 19:29 - 05562024 _____ (Swearware) C:\Users\Nick\Downloads\ComboFix.exe

2014-07-23 19:19 - 2014-07-23 19:19 - 00000000 ____D () C:\AdwCleaner

2014-07-23 19:19 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-07-23 19:17 - 2014-07-23 19:17 - 01354223 _____ () C:\Users\Nick\Downloads\adwcleaner_3.216.exe

2014-07-23 19:17 - 2014-07-23 19:17 - 01354223 _____ () C:\Users\Nick\Desktop\adwcleaner_3.216.exe

2014-07-23 14:56 - 2014-07-23 14:56 - 00010831 _____ () C:\Users\Nick\Desktop\Addition.rar

2014-07-23 14:40 - 2014-07-23 14:41 - 00138668 _____ () C:\Users\Nick\Desktop\Addition.txt

2014-07-23 14:39 - 2014-07-23 20:17 - 00017364 _____ () C:\Users\Nick\Desktop\FRST.txt

2014-07-23 14:39 - 2014-07-23 20:17 - 00000000 ____D () C:\FRST

2014-07-23 14:39 - 2014-07-23 14:38 - 02091520 _____ (Farbar) C:\Users\Nick\Desktop\FRST64.exe

2014-07-23 14:38 - 2014-07-23 14:38 - 02091520 _____ (Farbar) C:\Users\Nick\Downloads\FRST64.exe

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi

2014-07-22 14:53 - 2014-07-22 14:53 - 00005871 _____ () C:\Users\Nick\AppData\Local\recently-used.xbel

2014-07-21 18:52 - 2014-07-21 18:52 - 00835002 _____ () C:\Users\Nick\Downloads\MLG Water BKCGameplay.zip

2014-07-20 20:47 - 2014-07-20 20:47 - 00000000 ____D () C:\Windows\symbols

2014-07-20 20:46 - 2014-07-20 20:46 - 00000000 ____D () C:\ProgramData\VS

2014-07-20 18:35 - 2014-07-20 18:39 - 00000000 ____D () C:\Users\Nick\Downloads\Unleashed

2014-07-19 19:35 - 2014-07-20 18:38 - 00000000 ____D () C:\Users\Nick\Downloads\versions

2014-07-19 19:35 - 2014-07-19 19:38 - 00000000 ____D () C:\Users\Nick\Downloads\FTBLite2

2014-07-19 19:35 - 2014-07-19 19:38 - 00000000 ____D () C:\Users\Nick\Downloads\assets

2014-07-19 19:35 - 2014-07-19 19:36 - 00000000 ____D () C:\Users\Nick\Downloads\libraries

2014-07-18 13:38 - 2014-07-18 13:38 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Oracle

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-16 17:30 - 2014-07-16 17:30 - 00000000 ____D () C:\ProgramData\Riot Games

2014-07-11 19:45 - 2014-07-11 19:46 - 00000000 ____D () C:\Users\Nick\Desktop\modpackjar

2014-07-09 18:07 - 2014-07-22 16:47 - 00007602 _____ () C:\Users\Nick\AppData\Local\Resmon.ResmonCfg

2014-07-09 17:32 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-07-09 17:32 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-07-09 17:32 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-07-09 17:32 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-09 17:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-09 17:32 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-09 17:32 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-09 17:32 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-09 17:32 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-09 17:32 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-09 17:32 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-09 17:32 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-09 17:32 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-09 17:32 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-09 17:32 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-09 17:32 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-09 17:32 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-09 17:32 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-09 17:32 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-09 17:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-09 17:32 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-09 17:32 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-09 17:32 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-09 17:32 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-09 17:32 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-09 17:32 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-09 17:32 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-09 17:32 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-09 17:32 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-09 17:32 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-09 17:32 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-09 17:32 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-09 17:32 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-09 17:32 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-09 17:32 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-09 17:32 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-09 17:32 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-09 17:32 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-09 17:32 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-09 17:32 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-09 17:32 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-09 17:32 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-09 17:32 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-09 17:32 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-09 17:32 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-09 17:32 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-09 17:32 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-09 17:32 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-09 17:32 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-09 17:32 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-09 17:32 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-09 17:32 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-09 17:32 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-09 17:32 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-09 17:32 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-09 17:32 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-09 17:32 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-09 17:32 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-09 17:32 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-09 17:32 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-09 17:32 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-09 17:32 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-09 17:32 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-09 17:32 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-09 17:32 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-09 17:32 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-09 17:30 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-09 17:30 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-09 17:30 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-08 13:44 - 2014-07-08 13:45 - 00000000 ____D () C:\Users\Nick\Desktop\Moorhuhn

2014-07-06 16:56 - 2014-07-06 16:56 - 00583508 _____ () C:\Users\Nick\Desktop\CustomMobSpawner 3.0.0.zip

2014-07-06 16:47 - 2014-07-11 19:46 - 00000000 ____D () C:\Users\Nick\Desktop\alte jar

2014-07-04 21:16 - 2014-07-04 21:16 - 00046080 ___SH () C:\Users\Nick\AppData\Roaming\Thumbs.db

2014-07-04 21:16 - 2014-07-04 21:16 - 00001435 _____ () C:\Users\Nick\Desktop\.minecraft - Verknüpfung.lnk

2014-07-04 20:36 - 2014-07-06 16:58 - 92465531 _____ () C:\Users\Nick\Desktop\Mod-Pack.zip

2014-07-03 15:42 - 2014-07-19 22:29 - 00000091 _____ () C:\Users\Nick\.atl.properties

2014-07-03 15:41 - 2014-07-19 22:29 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\ATLauncher

2014-07-02 21:04 - 2014-07-02 21:04 - 00001195 _____ () C:\Users\Public\Desktop\ROCCAT Power-Grid.lnk

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ROCCAT

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2014-07-02 21:03 - 2014-07-02 21:03 - 00000000 ____D () C:\Program Files (x86)\ROCCAT

2014-06-30 16:26 - 2014-06-30 16:52 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2 OA

2014-06-30 16:26 - 2014-06-30 16:26 - 00000000 ____D () C:\ProgramData\Bohemia Interactive Studio

2014-06-29 20:58 - 2014-06-29 20:58 - 00000220 _____ () C:\Users\Nick\Desktop\Garry's Mod.url

2014-06-29 18:41 - 2014-06-29 18:42 - 01439475 _____ () C:\Users\Nick\Desktop\Documents\TN_FB.pdn

2014-06-26 17:34 - 2014-06-30 17:08 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ArmA 2

2014-06-26 17:34 - 2014-06-30 16:26 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-26 17:34 - 2014-06-29 18:24 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2

2014-06-26 17:34 - 2014-06-26 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-25 18:24 - 2014-06-25 18:24 - 00000222 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead Beta (Obsolete).url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2.url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead.url

2014-06-24 20:43 - 2014-06-25 18:43 - 03149295 _____ () C:\Users\Nick\Desktop\thumbnail.xcf

2014-06-24 20:33 - 2014-06-24 20:33 - 03424147 _____ () C:\Users\Nick\Desktop\Documents\thumbnail.xcf
 

==================== One Month Modified Files and Folders =======
 

2014-07-23 20:18 - 2014-07-23 14:39 - 00017364 _____ () C:\Users\Nick\Desktop\FRST.txt

2014-07-23 20:17 - 2014-07-23 14:39 - 00000000 ____D () C:\FRST

2014-07-23 20:13 - 2014-07-23 20:13 - 00013624 _____ () C:\Users\Nick\Desktop\HitmanPro_20140723_2013.log

2014-07-23 20:13 - 2014-07-23 20:06 - 00000000 ____D () C:\ProgramData\HitmanPro

2014-07-23 20:13 - 2013-05-29 16:31 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Skype

2014-07-23 20:06 - 2014-07-23 20:06 - 11188736 _____ (SurfRight B.V.) C:\Users\Nick\Downloads\HitmanPro_x64.exe

2014-07-23 20:06 - 2014-07-23 20:06 - 11188736 _____ (SurfRight B.V.) C:\Users\Nick\Desktop\HitmanPro_x64.exe

2014-07-23 20:04 - 2014-05-08 19:05 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\.minecraft

2014-07-23 20:03 - 2013-09-09 15:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-07-23 20:01 - 2013-05-26 12:50 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-23 19:48 - 2014-04-18 11:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-23 19:47 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-23 19:47 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-23 19:43 - 2014-07-23 19:43 - 00024124 _____ () C:\ComboFix.txt

2014-07-23 19:43 - 2014-07-23 19:30 - 00000000 ____D () C:\Qoobox

2014-07-23 19:43 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-07-23 19:42 - 2014-07-23 19:30 - 00000000 ____D () C:\Windows\erdnt

2014-07-23 19:39 - 2013-06-12 16:43 - 00000000 ____D () C:\Users\Nick\AppData\Local\LogMeIn Hamachi

2014-07-23 19:39 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-07-23 19:38 - 2013-05-26 12:50 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-23 19:38 - 2013-05-25 11:07 - 01253732 _____ () C:\Windows\WindowsUpdate.log

2014-07-23 19:38 - 2010-11-21 05:47 - 00995458 _____ () C:\Windows\PFRO.log

2014-07-23 19:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-23 19:38 - 2009-07-14 06:51 - 00091667 _____ () C:\Windows\setupact.log

2014-07-23 19:37 - 2013-12-22 16:48 - 00000000 ____D () C:\ProgramData\Origin

2014-07-23 19:29 - 2014-07-23 19:29 - 05562024 ____R (Swearware) C:\Users\Nick\Desktop\ComboFix.exe

2014-07-23 19:29 - 2014-07-23 19:29 - 05562024 _____ (Swearware) C:\Users\Nick\Downloads\ComboFix.exe

2014-07-23 19:23 - 2014-05-03 14:44 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\DropboxMaster

2014-07-23 19:23 - 2013-10-04 21:53 - 00000000 ___RD () C:\Users\Nick\Dropbox

2014-07-23 19:23 - 2013-10-04 21:52 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Dropbox

2014-07-23 19:22 - 2013-12-22 16:47 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-07-23 19:19 - 2014-07-23 19:19 - 00000000 ____D () C:\AdwCleaner

2014-07-23 19:17 - 2014-07-23 19:17 - 01354223 _____ () C:\Users\Nick\Downloads\adwcleaner_3.216.exe

2014-07-23 19:17 - 2014-07-23 19:17 - 01354223 _____ () C:\Users\Nick\Desktop\adwcleaner_3.216.exe

2014-07-23 14:56 - 2014-07-23 14:56 - 00010831 _____ () C:\Users\Nick\Desktop\Addition.rar

2014-07-23 14:41 - 2014-07-23 14:40 - 00138668 _____ () C:\Users\Nick\Desktop\Addition.txt

2014-07-23 14:38 - 2014-07-23 14:39 - 02091520 _____ (Farbar) C:\Users\Nick\Desktop\FRST64.exe

2014-07-23 14:38 - 2014-07-23 14:38 - 02091520 _____ (Farbar) C:\Users\Nick\Downloads\FRST64.exe

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-07-23 14:36 - 2014-07-23 14:36 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi

2014-07-22 16:47 - 2014-07-09 18:07 - 00007602 _____ () C:\Users\Nick\AppData\Local\Resmon.ResmonCfg

2014-07-22 16:14 - 2013-11-08 15:08 - 00000000 ____D () C:\Users\Nick\AppData\Local\PMB Files

2014-07-22 16:14 - 2013-11-08 15:08 - 00000000 ____D () C:\ProgramData\PMB Files

2014-07-22 15:06 - 2013-06-14 20:40 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TS3Client

2014-07-22 14:53 - 2014-07-22 14:53 - 00005871 _____ () C:\Users\Nick\AppData\Local\recently-used.xbel

2014-07-21 19:06 - 2013-08-12 18:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express

2014-07-21 18:52 - 2014-07-21 18:52 - 00835002 _____ () C:\Users\Nick\Downloads\MLG Water BKCGameplay.zip

2014-07-21 14:03 - 2013-05-26 12:51 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-07-20 20:47 - 2014-07-20 20:47 - 00000000 ____D () C:\Windows\symbols

2014-07-20 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2014-07-20 20:46 - 2014-07-20 20:46 - 00000000 ____D () C:\ProgramData\VS

2014-07-20 18:41 - 2014-06-06 21:26 - 00000000 ____D () C:\Users\Nick\AppData\Local\ftblauncher

2014-07-20 18:41 - 2014-06-06 21:18 - 04980105 _____ () C:\Users\Nick\Desktop\FtB.exe

2014-07-20 18:41 - 2013-06-03 18:48 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\ftblauncher

2014-07-20 18:39 - 2014-07-20 18:35 - 00000000 ____D () C:\Users\Nick\Downloads\Unleashed

2014-07-20 18:38 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\versions

2014-07-20 18:34 - 2014-06-07 21:33 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\FileZilla

2014-07-19 22:29 - 2014-07-03 15:42 - 00000091 _____ () C:\Users\Nick\.atl.properties

2014-07-19 22:29 - 2014-07-03 15:41 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\ATLauncher

2014-07-19 19:38 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\FTBLite2

2014-07-19 19:38 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\assets

2014-07-19 19:36 - 2014-07-19 19:35 - 00000000 ____D () C:\Users\Nick\Downloads\libraries

2014-07-18 14:02 - 2013-12-25 19:47 - 00000000 ____D () C:\ProgramData\BlazeVideo

2014-07-18 13:38 - 2014-07-18 13:38 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-18 13:38 - 2014-07-18 13:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Oracle

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-07-18 13:38 - 2014-07-18 13:38 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-18 13:06 - 2014-05-22 18:48 - 00000000 ____D () C:\Users\Nick\AppData\Local\TeamSpeak 3 Client

2014-07-16 17:30 - 2014-07-16 17:30 - 00000000 ____D () C:\ProgramData\Riot Games

2014-07-15 17:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-07-15 14:57 - 2014-05-14 17:55 - 00001157 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-07-15 14:57 - 2014-05-14 17:55 - 00000000 ____D () C:\ProgramData\Package Cache

2014-07-15 14:57 - 2014-05-14 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-07-15 14:57 - 2014-05-14 17:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-07-15 14:56 - 2014-05-16 21:15 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-07-11 19:46 - 2014-07-11 19:45 - 00000000 ____D () C:\Users\Nick\Desktop\modpackjar

2014-07-11 19:46 - 2014-07-06 16:47 - 00000000 ____D () C:\Users\Nick\Desktop\alte jar

2014-07-11 19:44 - 2014-03-07 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends

2014-07-11 19:40 - 2009-07-14 06:45 - 00276576 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-11 19:39 - 2014-05-06 19:56 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-07-11 19:39 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-11 19:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2014-07-11 19:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism

2014-07-09 21:07 - 2013-08-14 16:28 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-09 21:05 - 2013-08-10 12:28 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-07-09 17:48 - 2014-04-18 11:17 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-07-09 17:48 - 2014-04-18 11:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-07-09 17:48 - 2013-10-18 14:52 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-07-08 13:45 - 2014-07-08 13:44 - 00000000 ____D () C:\Users\Nick\Desktop\Moorhuhn

2014-07-07 16:26 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-06 16:58 - 2014-07-04 20:36 - 92465531 _____ () C:\Users\Nick\Desktop\Mod-Pack.zip

2014-07-06 16:56 - 2014-07-06 16:56 - 00583508 _____ () C:\Users\Nick\Desktop\CustomMobSpawner 3.0.0.zip

2014-07-04 21:16 - 2014-07-04 21:16 - 00046080 ___SH () C:\Users\Nick\AppData\Roaming\Thumbs.db

2014-07-04 21:16 - 2014-07-04 21:16 - 00001435 _____ () C:\Users\Nick\Desktop\.minecraft - Verknüpfung.lnk

2014-07-04 20:23 - 2014-05-14 18:02 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-07-04 14:06 - 2013-05-25 11:08 - 00000000 ____D () C:\Users\Nick

2014-07-03 16:56 - 2011-04-12 09:43 - 00699536 _____ () C:\Windows\system32\perfh007.dat

2014-07-03 16:56 - 2011-04-12 09:43 - 00149418 _____ () C:\Windows\system32\perfc007.dat

2014-07-03 16:56 - 2009-07-14 07:13 - 01620796 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-02 21:05 - 2013-08-05 14:28 - 00000620 _____ () C:\Users\Nick\Desktop\lol.txt

2014-07-02 21:04 - 2014-07-02 21:04 - 00001195 _____ () C:\Users\Public\Desktop\ROCCAT Power-Grid.lnk

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ROCCAT

2014-07-02 21:04 - 2014-07-02 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2014-07-02 21:03 - 2014-07-02 21:03 - 00000000 ____D () C:\Program Files (x86)\ROCCAT

2014-06-30 17:08 - 2014-06-26 17:34 - 00000000 ____D () C:\Users\Nick\Desktop\Documents\ArmA 2

2014-06-30 16:52 - 2014-06-30 16:26 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2 OA

2014-06-30 16:26 - 2014-06-30 16:26 - 00000000 ____D () C:\ProgramData\Bohemia Interactive Studio

2014-06-30 16:26 - 2014-06-26 17:34 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-30 16:25 - 2013-04-23 10:20 - 00258341 _____ () C:\Windows\DirectX.log

2014-06-30 04:09 - 2014-07-09 17:32 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-30 04:04 - 2014-07-09 17:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-29 21:39 - 2014-05-08 20:09 - 00000106 _____ () C:\Users\Nick\Desktop\Fragenbattle.txt

2014-06-29 20:58 - 2014-06-29 20:58 - 00000220 _____ () C:\Users\Nick\Desktop\Garry's Mod.url

2014-06-29 20:58 - 2014-06-20 23:35 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2014-06-29 18:42 - 2014-06-29 18:41 - 01439475 _____ () C:\Users\Nick\Desktop\Documents\TN_FB.pdn

2014-06-29 18:24 - 2014-06-26 17:34 - 00000000 ____D () C:\Users\Nick\AppData\Local\ArmA 2

2014-06-26 17:34 - 2014-06-26 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive

2014-06-25 18:43 - 2014-06-24 20:43 - 03149295 _____ () C:\Users\Nick\Desktop\thumbnail.xcf

2014-06-25 18:43 - 2014-01-13 19:08 - 00000000 ____D () C:\Users\Nick\AppData\Local\gtk-2.0

2014-06-25 18:43 - 2014-01-13 19:07 - 00000000 ____D () C:\Users\Nick\.gimp-2.8

2014-06-25 18:24 - 2014-06-25 18:24 - 00000222 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead Beta (Obsolete).url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2.url

2014-06-25 18:24 - 2014-06-25 18:24 - 00000221 _____ () C:\Users\Nick\Desktop\Arma 2 Operation Arrowhead.url

2014-06-24 20:33 - 2014-06-24 20:33 - 03424147 _____ () C:\Users\Nick\Desktop\Documents\thumbnail.xcf
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-07-21 16:49
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Schon OK... ;)

Schritt 1

http://filepony.de/icon/malwarebytes_anti_malware.png Malwarebytes Antimalware

Download-Link
Installiere das Programm in den vorgegebenen Pfad.
Starte Malwarebytes' Anti-Malware (MBAM).
Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 2

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, markiere auch die checkbox http://deeprybka.trojaner-board.de/b...t/addition.pngund drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Sooo :) hier das Verlaufsprotokoll von MBAM

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 25.07.2014

Suchlauf-Zeit: 16:40:39

Logdatei: 

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.07.25.04

Rootkit Datenbank: v2014.07.17.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Nick
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 308254

Verstrichene Zeit: 13 Min, 41 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 1

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe, 3800, Löschen bei Neustart, [faa7a7f9accfd2646cc937aa1aea0cf4]
 

Module: 1

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\chrmXtn.dll, Löschen bei Neustart, [465be8b89ae1e94dc628704f20e2b44c], 
 

Registrierungsschlüssel: 1

PUP.Optional.PayByAds.A, HKU\S-1-5-21-2093199856-2832982660-2437927299-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\shopwit, Löschen bei Neustart, [faa7a7f9accfd2646cc937aa1aea0cf4], 
 

Registrierungswerte: 1

PUP.Optional.PayByAds.A, HKU\S-1-5-21-2093199856-2832982660-2437927299-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|shopwit, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe, Löschen bei Neustart, [faa7a7f9accfd2646cc937aa1aea0cf4]
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 3

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit, Löschen bei Neustart, [465be8b89ae1e94dc628704f20e2b44c], 

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit, Löschen bei Neustart, [465be8b89ae1e94dc628704f20e2b44c], 

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10, Löschen bei Neustart, [465be8b89ae1e94dc628704f20e2b44c], 
 

Dateien: 8

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe, Löschen bei Neustart, [faa7a7f9accfd2646cc937aa1aea0cf4], 

PUP.Optional.Ciuvo.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage, In Quarantäne, [d9c8b4ec98e3f046dc5bf9dac83ae41c], 

PUP.Optional.Ciuvo.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage-journal, In Quarantäne, [e0c1514f6e0d53e3290eddf6c83aec14], 

PUP.Optional.ShoppingGate.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, Löschen bei Neustart, [4b56fda386f5d5614b91f8e1d131629e], 

PUP.Optional.ShoppingGate.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, Löschen bei Neustart, [722f1789730804328e4e2eab7191e818], 

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\app.ini, In Quarantäne, [465be8b89ae1e94dc628704f20e2b44c], 

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\chrmXtn.dll, Löschen bei Neustart, [465be8b89ae1e94dc628704f20e2b44c], 

PUP.Optional.PayByAds.A, C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\ffxtn.dll, In Quarantäne, [465be8b89ae1e94dc628704f20e2b44c], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

aalso hier ist die log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=c32259f05fd5df4cbb9aba7b430bee56

# engine=19349

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-07-25 04:29:26

# local_time=2014-07-25 06:29:26 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 6489 12988102 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 6222726 157935616 0 0

# scanned=289453

# found=1

# cleaned=0

# scan_time=4664

sh=DAE3B80A567AA739FA54D4C896A2CFE0F9718180 ft=1 fh=09c2f22f47670a60 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Nick\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"

und hier die logs von frst
FRST

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=c32259f05fd5df4cbb9aba7b430bee56

# engine=19349

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-07-25 04:29:26

# local_time=2014-07-25 06:29:26 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 6489 12988102 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 6222726 157935616 0 0

# scanned=289453

# found=1

# cleaned=0

# scan_time=4664

sh=DAE3B80A567AA739FA54D4C896A2CFE0F9718180 ft=1 fh=09c2f22f47670a60 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Nick\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014 01

Ran by Nick at 2014-07-25 18:43:40

Running from C:\Users\Nick\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden

6500_E709_eDocs (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden

6500_E709_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden

6500_E709n (x32 Version: 50.0.165.000 - Hewlett-Packard) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden

Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)

Adobe Download Assistant (x32 Version: 1.2.6 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 10 ActiveX (HKLM-x32\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 4.1 64-bit (HKLM\...\{F7ADB493-B913-4D61-9A63-DA736C20C3F2}) (Version: 4.1.2 - Adobe)

Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)

ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)

Arma 2 (HKLM-x32\...\Steam App 33910) (Version:  - Bohemia Interactive)

Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)

Arma 2: Operation Arrowhead Beta (Obsolete) (HKLM-x32\...\Steam App 219540) (Version:  - )

Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)

Avira (HKLM-x32\...\{142be4a8-895b-4ed9-b1ff-11c76357e3df}) (Version: 1.1.17.31000 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.17.31000 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)

BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )

BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version:  - )

Blender (HKLM\...\Blender) (Version: 2.67b - Blender Foundation)

Blobby Volley 2.0 Version 0.9b (HKLM-x32\...\Blobby Volley 2.0 Version 0.9b_is1) (Version:  - )

bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden

BPDSoftware (x32 Version: 50.0.165.000 - Hewlett-Packard) Hidden

BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden

BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden

Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version:  - )

CodeBlocks (HKCU\...\CodeBlocks) (Version: 12.11 - The Code::Blocks Team)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden

Die ersten 10 Jahre (HKLM-x32\...\{1C12B0B2-91FB-439A-A64D-1A239F0B7FAB}) (Version: 1.00.0000 - )

DocMgr (x32 Version: 130.0.000.000 - Ihr Firmenname) Hidden

DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden

Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)

Edna Bricht Aus - Sammler Edition (HKLM-x32\...\EdnaSE) (Version: 1.1 - Daedalic Entertainment)

erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden

Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden

FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.0.0.0 - Electronic Arts)

FileZilla Client 3.7.4.1 (HKCU\...\FileZilla Client) (Version: 3.7.4.1 - Tim Kosse)

Fotogalerie (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )

Galerie de photos (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)

GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

Harveys Neue Augen Demo (HKLM-x32\...\Harvey) (Version: 1.0 - Daedalic Entertainment)

Hotfix für Microsoft Visual C# 2010 Express - DEU (KB2635973) (HKLM-x32\...\{D81641E8-ABF1-3D07-803B-60E8FC619368}.KB2635973) (Version: 1 - Microsoft Corporation)

HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)

HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)

HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)

HP Officejet 6500 E709 Series (HKLM\...\{2E1B4B42-069F-4F53-9966-9B9B938D7FE5}) (Version: 13.0 - HP)

HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)

HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

Inkscape 0.48.4 (HKLM-x32\...\Inkscape) (Version: 0.48.4 - )

Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)

Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden

JStock (remove only) (HKLM-x32\...\JStock) (Version:  - )

Junk Mail filter update (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )

League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden

LIMBO (HKCU\...\Limbo) (Version:  - )

Logitech GamePanel Software 3.05.151 (HKLM\...\{BF9FD124-1112-4C8D-8F79-779A11C6287D}) (Version: 3.05.151 - Logitech Inc.)

Logitech SetPoint 5.20 (HKLM\...\{D3120436-1358-4253-9EB2-257FFE8CE1D9}) (Version: 5.20 - Logitech)

LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.227 - LogMeIn, Inc.)

LogMeIn Hamachi (x32 Version: 2.2.0.227 - LogMeIn, Inc.) Hidden

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden

MEDUSA NX USB 5.1 Gaming Headset (HKLM\...\C-Media CM106 Like Sound Driver) (Version:  - )

Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (FRA) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Français) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1036) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden

Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)

Microsoft Help Viewer 1.0 Language Pack - DEU (Version: 1.0.30319 - Microsoft Corporation) Hidden

Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)

Microsoft Help Viewer 1.1 (Version: 1.1.40219 - Microsoft Corporation) Hidden

Microsoft Help Viewer 1.1 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.1 Language Pack - DEU) (Version: 1.1.40219 - Microsoft Corporation)

Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219 - Microsoft Corporation) Hidden

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden

Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4024.1220 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}) (Version: 10.50.1750.9 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)

Microsoft SQL Server System CLR Types (HKLM-x32\...\{C668416A-9213-4058-B7F2-01A42D85559D}) (Version: 10.50.1750.9 - Microsoft Corporation)

Microsoft Visual C# 2010 Express - DEU (HKLM-x32\...\Microsoft Visual C# 2010 Express - DEU) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C# 2010 Express - DEU (x32 Version: 10.0.40219 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219 (HKLM\...\{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (HKLM-x32\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM-x32\...\{616C6F39-4CE1-3434-A665-2F6A04C09A7F}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Service Pack 1 (HKLM-x32\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Service Pack 1 (x32 Version: 10.0.40219 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.40303 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40308 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.40303 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.40303 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Network64 (Version: 130.0.579.000 - Hewlett-Packard) Hidden

Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.3.2 - Notepad++ Team)

NVIDIA Install Application (Version: 2.1002.115.743 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 314.22 (Version: 314.22 - NVIDIA Corporation) Hidden

OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)

Origin (HKLM-x32\...\Origin) (Version: 9.0.10.69 - Electronic Arts, Inc.)

Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41418}) (Version: 3.61.0 - dotPDN LLC)

Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)

Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)

Photo Gallery (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )

ProductContext (x32 Version: 50.0.165.000 - Hewlett-Packard) Hidden

R.U.S.E (HKLM-x32\...\Steam App 21970) (Version:  - Eugen Systems)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6675 - Realtek Semiconductor Corp.)

ROCCAT Power-Grid Version 0.459 (HKLM-x32\...\{953CF6E6-4EC8-4E55-A263-720CEBD591FE}_is1) (Version: 0.459 - ROCCAT GmbH)

Samsung i-Launcher 1.0.1.22 (HKLM-x32\...\Samsung i-Launcher) (Version: 1.0.1.22 - Samsung Electronics Co., Ltd.)

Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

Smart Technology Programming Software 7.0.27.13 (HKLM\...\{C9193CBB-C31A-412A-A074-AD08F0F2CF3D}) (Version: 7.0.27.13 - Mad Catz)

SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden

SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden

SPEEDLINK REFLECT (HKLM-x32\...\{ED1674F5-5165-49BF-B546-AE5343111540}) (Version: 1.0.3.5 - SPEEDLINK)

Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version:  - Pandemic Studios)

Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)

TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version:  - Nadeo)

Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden

TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden

User's Guides (HKLM\...\{B48E1FFD-A85D-45DB-9070-C06CDF6BD427}) (Version: 1.20.0000 - Logitech)

USIM Editor 1.0.33.0 (HKLM-x32\...\Card Reader Driver and USIM Editor Program_is1) (Version:  - )

Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{CFCB8616-A5D1-4281-80E8-389F685BFAE2}) (Version: 4.0.8080.0 - Microsoft Corporation)

Webocton - Scriptly 0.8.95.6 (HKLM-x32\...\Webocton - Scriptly_is1) (Version: 0.8.95.6 - Webocton)

WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden

Windows Live (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Communications Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Family Safety (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Family Safety (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Messenger (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Writer (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live Writer Resources (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

WorldPainter 1.8.5 (HKLM\...\4144-4862-0472-7103) (Version: 1.8.5 - pepsoft.org)

XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-3 - Bitnami)

Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version:  - )
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\FileSyncApi64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2093199856-2832982660-2437927299-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nick\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

18-07-2014 11:38:15 Installed Java 7 Update 65

20-07-2014 17:00:08 Windows-Sicherung

20-07-2014 18:44:32 Windows Update

21-07-2014 17:05:11 Windows Update

23-07-2014 17:16:31 Removed Java 7 Update 25 (64-bit)

23-07-2014 18:13:03 Prüfpunkt von HitmanPro

24-07-2014 11:51:20 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2014-07-23 19:37 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {10E20190-DF4E-4BDC-99DA-27871F02E8AD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)

Task: {449AED61-1E93-44B1-A017-3B8C6E7A803D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-26] (Google Inc.)

Task: {6C15F5E7-C1AA-427C-999C-582F99D6DC85} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-26] (Google Inc.)

Task: {7B69BB7C-FAE9-47AB-A122-0ECF3C9E0E11} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {80113F21-F93F-45EE-A746-2FB9B8EC1903} - System32\Tasks\{E83A90AD-AAC7-404A-ADAC-C19B9A6231AB} => Chrome.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/go/help.faq.installer?LastError=1604

Task: {B7DF45C2-A1DC-4912-A0C7-49FC5793C5C9} - System32\Tasks\Shop-wit => C:\Users\Nick\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe

Task: {F491C524-E202-4A4F-A565-E5330A6D0534} - System32\Tasks\{41B5DFA3-6523-464B-9ED1-78671AAEAEA3} => Chrome.exe hxxp://ui.skype.com/ui/0/6.3.0.107/de/abandoninstall?source=lightinstaller&amp;page=tsProgressBar

Task: {F88DABE5-4C16-4B9D-B0E8-295651AEE9E8} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-05-22 11:52 - 2013-03-15 06:16 - 00086304 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll

2013-05-25 12:10 - 2011-03-31 05:37 - 00221184 ____N () C:\Windows\system\Cm106eye.exe

2013-08-10 12:26 - 2010-07-02 11:07 - 07041024 _____ () C:\Program Files (x86)\USIM Editor\iconcs98561.exe

2014-07-07 13:53 - 2014-07-07 13:53 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll

2014-07-07 13:52 - 2014-07-07 13:52 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll

2014-05-22 18:37 - 2014-07-12 02:53 - 01116672 _____ () C:\Program Files (x86)\Steam\libavcodec-55.dll

2014-04-23 13:26 - 2014-07-12 02:53 - 00438784 _____ () C:\Program Files (x86)\Steam\libavutil-53.dll

2014-05-22 18:37 - 2014-07-12 02:53 - 00399360 _____ () C:\Program Files (x86)\Steam\libavformat-55.dll

2014-01-08 13:15 - 2014-07-12 02:53 - 00331264 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll

2013-08-21 14:18 - 2014-06-27 00:40 - 00764416 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2014-05-22 18:37 - 2014-07-16 04:28 - 02139328 _____ () C:\Program Files (x86)\Steam\video.dll

2014-05-22 18:37 - 2014-04-29 02:37 - 00519168 _____ () C:\Program Files (x86)\Steam\libswscale-2.dll

2013-08-28 13:47 - 2014-07-16 04:28 - 01116864 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2013-08-07 11:31 - 2014-05-02 01:35 - 20628160 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

2014-07-25 17:50 - 2014-07-25 17:50 - 00155232 ___HT () C:\Users\Nick\AppData\Local\Temp\~4B43.tmp

2014-01-29 16:38 - 2014-07-25 16:37 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll

2014-01-29 16:38 - 2014-07-25 16:37 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll

2014-07-25 16:57 - 2014-07-25 16:57 - 00043008 _____ () c:\users\nick\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzewo6z.dll

2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Nick\AppData\Roaming\Dropbox\bin\libcef.dll

2013-05-25 12:10 - 2011-03-31 05:37 - 00491520 ____N () C:\Windows\system\CmAu106.dll

2014-07-24 11:49 - 2014-07-07 13:53 - 00049744 _____ () C:\Users\Nick\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

2014-02-11 21:29 - 2014-02-11 21:29 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll

2014-07-21 14:03 - 2014-07-15 11:24 - 00718664 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libglesv2.dll

2014-07-21 14:03 - 2014-07-15 11:24 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libegl.dll

2014-07-21 14:03 - 2014-07-15 11:24 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll

2014-07-21 14:03 - 2014-07-15 11:24 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll

2014-07-21 14:03 - 2014-07-15 11:24 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll

2013-07-15 14:32 - 2014-07-16 04:28 - 00359104 _____ () C:\Program Files (x86)\Steam\steam.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

==================== Faulty Device Manager Devices =============
 

Name: Officejet 6500 E709n

Description: Officejet 6500 E709n

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: Officejet 6500 E709n

Description: Officejet 6500 E709n

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: HP

Service: StillCam

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/25/2014 06:40:15 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/25/2014 05:30:39 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm rundll32.exe, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: ac8
 

Startzeit: 01cfa81d492166c5
 

Endzeit: 5
 

Anwendungspfad: C:\Windows\system32\rundll32.exe
 

Berichts-ID: 96eab115-1410-11e4-976a-d43d7e93280b
 

Error: (07/25/2014 05:07:09 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/25/2014 05:07:03 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/25/2014 05:07:03 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/25/2014 05:07:01 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/25/2014 04:59:01 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/25/2014 04:37:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/24/2014 03:12:57 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/24/2014 11:51:17 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (07/25/2014 04:57:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Afa Card Reader Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (07/25/2014 04:49:20 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 107.
 

Error: (07/25/2014 04:49:20 PM) (Source: Schannel) (EventID: 4106) (User: NT-AUTORITÄT)

Description: Eine SSL 3.0-Verbindungsanforderung wurde von einer Remoteclientanwendung übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.
 

Error: (07/25/2014 04:49:20 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 107.
 

Error: (07/25/2014 04:49:20 PM) (Source: Schannel) (EventID: 4106) (User: NT-AUTORITÄT)

Description: Eine SSL 3.0-Verbindungsanforderung wurde von einer Remoteclientanwendung übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.
 

Error: (07/25/2014 04:35:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Afa Card Reader Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (07/24/2014 03:11:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Afa Card Reader Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (07/24/2014 01:51:07 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (07/24/2014 11:49:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Afa Card Reader Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (07/24/2014 01:02:51 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 
 

Microsoft Office Sessions:

=========================

Error: (07/25/2014 06:40:15 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (07/25/2014 05:30:39 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: rundll32.exe6.1.7600.16385ac801cfa81d492166c55C:\Windows\system32\rundll32.exe96eab115-1410-11e4-976a-d43d7e93280b
 

Error: (07/25/2014 05:07:09 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Desktop\esetsmartinstaller_deu.exe
 

Error: (07/25/2014 05:07:03 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Desktop\esetsmartinstaller_deu.exe
 

Error: (07/25/2014 05:07:03 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Desktop\esetsmartinstaller_deu.exe
 

Error: (07/25/2014 05:07:01 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Desktop\esetsmartinstaller_deu.exe
 

Error: (07/25/2014 04:59:01 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/25/2014 04:37:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/24/2014 03:12:57 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (07/24/2014 11:51:17 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-07-23 19:36:44.351

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-07-23 19:36:44.312

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 30%

Total physical RAM: 16317.41 MB

Available physical RAM: 11421.22 MB

Total Pagefile: 32633.01 MB

Available Pagefile: 26380.66 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (Nicks 2TB Festplatte) (Fixed) (Total:1851.64 GB) (Free:1490.5 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 5593A727)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=-210842419200) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=11 GB) - (Type=27)
 

==================== End Of Log ============================

Also erstmal vielen vielen Dank dafür... und was genau war jetzt eig auf meinem PC?? :)

Hi, tausche ein ESET-Log gegen FRST.txt...deal? ;)