Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   PC 'friert' nach Start öfter ein und Windows Update lässt sich nicht installieren (https://www.trojaner-board.de/158727-pc-friert-start-oefter-windows-update-laesst-installieren.html)

memyselfandy 15.09.2014 10:50
PC 'friert' nach Start öfter ein und Windows Update lässt sich nicht installieren
 
Hallo,

ich weiß nicht, ob hier richtig bin, hoffe aber ihr könnt mir helfen:

Zum einen kann ich das Windows-Update KB976932 nicht installieren. Bricht immer wieder ab.

Zum anderen bleibt mein Pc nach dem Start fast immer 'eingefroren'. Heißt man kann nichts machen und mußß teilweise 3-4 Minuten warten, bis wieder was geht und dann friert er wieder ein....

Ach ja - eins noch: Wenn ich den PC starte, werden mir immer zwei Windows Versionen angezeigt. Wie kann ich die nicht gebrauchte löschen??

Vielen Dank für eure Hilfe...

schrauber 15.09.2014 11:26
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


memyselfandy 15.09.2014 11:50
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Ich (administrator) on ICH-PC on 15-09-2014 12:30:26
Running from C:\Users\Ich\Downloads
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) G:\Program Files (x86)\iCloudServices.exe
(Spotify Ltd) C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Deutsche Telekom AG) C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) G:\Program Files (x86)\itunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) G:\Windows.old\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Mozilla Corporation) G:\Windows.old\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
() C:\Program Files (x86)\Napster 5\Napster 5.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe
(Apple Inc.) G:\Program Files (x86)\itunes\iTunes.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) G:\Program Files (x86)\ApplePhotoStreams.exe
(Apple Inc.) G:\Program Files (x86)\APSDaemon.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-12-17] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-02-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => G:\Program Files (x86)\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => G:\Program Files (x86)\itunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2772413043-2723522287-3080337467-1000\...\Run: [com.apple.dav.bookmarks.daemon] => G:\Program Files (x86)\BookmarkDAV_client.exe
HKU\S-1-5-21-2772413043-2723522287-3080337467-1000\...\Run: [lollipop] => lollipop
HKU\S-1-5-21-2772413043-2723522287-3080337467-1000\...\Run: [Papa (Epson Stylus Office BX525WD)] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2772413043-2723522287-3080337467-1000\...\Run: [EPSON BX525WD Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2772413043-2723522287-3080337467-1000\...\Run: [KiesPDLR.exe] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
Startup: C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk
ShortcutTarget: Mediencenter.lnk -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 01Mediencenter_InSync -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 02Mediencenter_ToSync -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 03Mediencenter_Failed -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x68C4B176828CCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649
FF Homepage: https://www.facebook.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 -> G:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> G:\Program Files (x86)\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> G:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\webde-suche.xml
FF Extension: GMX MailCheck - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\toolbar@gmx.net [2014-09-05]
FF Extension: Garmin Communicator - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-09]
FF Extension: Cliqz Beta - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\cliqz@cliqz.com.xpi [2014-09-07]
FF Extension: FDislike - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\fbdislike@doweb.fr.xpi [2013-10-09]
FF Extension: Thumbnail Zoom Plus - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\thumbnailZoom@dadler.github.com.xpi [2013-10-09]
FF Extension: eBay Sidebar for Firefox - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2013-10-09]
FF Extension: Adblock Plus - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\extensions\cliqz@cliqz.com
FF StartMenuInternet: FIREFOX.EXE - G:\Windows.old\Program Files\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR HomePage: Default -> FB7F6F72296557E5ABCB79AFD15960C1D024D7CA572F228FF6E52BE41837948B
CHR DefaultSearchKeyword: Default -> 922C4CE5F3F033170AD725A0175E5C28873667907D4DDCC1D0DB9A1809923D9E
CHR DefaultSearchProvider: Default -> 6F6DE16BBB60EC641012CF0CCF1FB01AC9E3D9423F673D81E85936F33B901C1D
CHR DefaultSearchURL: Default -> FB6906C383719F29C5AA83DB7D8943AE20929DA8FC999BD64DD1CEAA2995FCA5
CHR Profile: C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-29]
CHR Extension: (Google Drive) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-29]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-29]
CHR Extension: (Google-Suche) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-29]
CHR Extension: (Amazon-Icon) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2014-07-29]
CHR Extension: (Google Wallet) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-29]
CHR Extension: (Google Mail) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-29]
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Ich\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-01-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-17] ()
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-03-26] (Apple Inc.) [File not signed]
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-15 12:30 - 2014-09-15 12:31 - 00017237 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-09-15 12:30 - 2014-09-15 12:30 - 00000000 ____D () C:\FRST
2014-09-15 12:29 - 2014-09-15 12:29 - 02105856 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-09-13 09:14 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Alexander Knappe - Die zweite
2014-09-13 09:13 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - An End has a Start
2014-09-13 09:13 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Counting Crows - Somewhere under Wonderland
2014-09-13 09:12 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - In this Light and on this Evening
2014-09-13 09:12 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - Push your Head Towards the Air
2014-09-13 09:11 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - The Back Room
2014-09-13 09:11 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Honig - It's not a Hummingbird, It's your Father's Ghost
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Laing - Wechselt die Beleuchtung
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Kraftklub - In Schwarz
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\The Script - No Sound without Silence
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\Miss Platnum - Hüftgold Berlin
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Train - Bulletproof Picasso
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Toxpack - Friss!
2014-09-13 09:07 - 2014-09-13 09:07 - 00000000 ____D () C:\Users\Ich\Desktop\Vance Joy - Dream your Life
2014-09-11 15:10 - 2014-09-11 15:10 - 00001568 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-11 15:09 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 15:09 - 2014-09-11 15:10 - 00000000 ____D () C:\Program Files\iTunes
2014-09-11 15:09 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iPod
2014-09-11 14:38 - 2014-09-11 14:38 - 00000000 ____D () C:\Windows\system32\SPReview
2014-09-10 16:02 - 2014-09-10 16:02 - 00000000 ____D () C:\Users\Ich\Desktop\U2 - Songs of Innocence
2014-09-09 21:27 - 2014-09-15 11:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-09 21:26 - 2014-09-15 11:55 - 00000781 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-09 21:26 - 2014-09-15 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-09 21:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-09 21:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-09 21:26 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-09 21:22 - 2014-09-15 09:35 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-06 10:45 - 2014-09-06 10:46 - 00001133 _____ () C:\Users\Ich\Desktop\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:46 - 00001119 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Telekom
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Local\Telekom
2014-09-06 10:45 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-06 10:45 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-02 15:07 - 2014-09-13 08:13 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-29 16:09 - 2014-08-29 18:58 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe
2014-08-23 10:49 - 2014-08-23 10:49 - 00226807 _____ () C:\Users\Ich\Downloads\FRITZ.Box Fon WLAN 7390 84.06.04_23.08.14_1049.export

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-15 12:31 - 2014-09-15 12:30 - 00017237 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-09-15 12:30 - 2014-09-15 12:30 - 00000000 ____D () C:\FRST
2014-09-15 12:29 - 2014-09-15 12:29 - 02105856 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-09-15 12:27 - 2014-07-29 16:22 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-15 12:24 - 2013-07-02 19:37 - 02305024 ___SH () C:\Users\Ich\Desktop\Thumbs.db
2014-09-15 12:23 - 2014-08-11 11:55 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\vlc
2014-09-15 12:15 - 2014-07-29 14:16 - 00001973 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2014-09-15 12:14 - 2012-10-14 12:17 - 01883559 _____ () C:\Windows\WindowsUpdate.log
2014-09-15 12:14 - 2009-07-14 06:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-15 12:14 - 2009-07-14 06:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-15 12:10 - 2013-09-15 00:19 - 00018056 _____ () C:\Windows\setupact.log
2014-09-15 11:57 - 2014-09-09 21:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-15 11:55 - 2014-09-09 21:26 - 00000781 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-15 11:55 - 2014-09-09 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-15 11:47 - 2012-10-14 13:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-15 09:37 - 2014-08-01 10:26 - 00000000 __HDC () C:\ProgramData\~0
2014-09-15 09:35 - 2014-09-09 21:22 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-09-15 09:29 - 2014-03-07 16:14 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-15 09:29 - 2012-10-14 21:51 - 00696620 _____ () C:\Windows\system32\perfh007.dat
2014-09-15 09:29 - 2012-10-14 21:51 - 00147916 _____ () C:\Windows\system32\perfc007.dat
2014-09-15 09:24 - 2014-07-29 16:22 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-15 09:23 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-13 09:14 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Alexander Knappe - Die zweite
2014-09-13 09:14 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - An End has a Start
2014-09-13 09:14 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Counting Crows - Somewhere under Wonderland
2014-09-13 09:13 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - In this Light and on this Evening
2014-09-13 09:12 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - Push your Head Towards the Air
2014-09-13 09:12 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - The Back Room
2014-09-13 09:11 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Honig - It's not a Hummingbird, It's your Father's Ghost
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Laing - Wechselt die Beleuchtung
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Kraftklub - In Schwarz
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\The Script - No Sound without Silence
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\Miss Platnum - Hüftgold Berlin
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Train - Bulletproof Picasso
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Toxpack - Friss!
2014-09-13 09:07 - 2014-09-13 09:07 - 00000000 ____D () C:\Users\Ich\Desktop\Vance Joy - Dream your Life
2014-09-13 08:14 - 2014-08-14 14:36 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-13 08:13 - 2014-09-02 15:07 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-13 08:13 - 2012-10-14 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-13 08:13 - 2012-10-14 13:09 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-11 21:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-11 19:30 - 2014-07-29 16:24 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00001568 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-11 15:10 - 2014-09-11 15:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 15:10 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iTunes
2014-09-11 15:09 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iPod
2014-09-11 14:38 - 2014-09-11 14:38 - 00000000 ____D () C:\Windows\system32\SPReview
2014-09-11 14:21 - 2013-09-15 00:19 - 00033126 _____ () C:\Windows\PFRO.log
2014-09-10 16:48 - 2012-10-14 13:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 16:48 - 2012-10-14 13:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 16:48 - 2012-10-14 13:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 16:02 - 2014-09-10 16:02 - 00000000 ____D () C:\Users\Ich\Desktop\U2 - Songs of Innocence
2014-09-10 14:18 - 2012-10-17 20:24 - 00000000 ____D () C:\Windows\CheckSur
2014-09-10 14:18 - 2009-07-14 06:45 - 00298304 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-09 21:45 - 2012-10-14 12:24 - 00066064 _____ () C:\Users\Ich\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-09 21:28 - 2013-08-15 22:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 21:26 - 2013-09-15 00:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-09 21:24 - 2012-10-23 10:00 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-06 10:46 - 2014-09-06 10:45 - 00001133 _____ () C:\Users\Ich\Desktop\Mediencenter.lnk
2014-09-06 10:46 - 2014-09-06 10:45 - 00001119 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Telekom
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Local\Telekom
2014-08-31 22:03 - 2012-11-26 17:14 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Spotify
2014-08-31 21:58 - 2012-11-26 17:14 - 00000000 ____D () C:\Users\Ich\AppData\Local\Spotify
2014-08-29 22:45 - 2012-12-10 16:50 - 00000866 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-08-29 22:45 - 2012-12-10 16:50 - 00000804 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-29 18:58 - 2014-08-29 16:09 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe
2014-08-23 10:49 - 2014-08-23 10:49 - 00226807 _____ () C:\Users\Ich\Downloads\FRITZ.Box Fon WLAN 7390 84.06.04_23.08.14_1049.export
2014-08-21 15:06 - 2012-10-14 12:15 - 00000000 ____D () C:\Users\Ich\AppData\Local\VirtualStore
2014-08-16 15:00 - 2013-05-13 16:35 - 00000000 ____D () C:\Users\Ich\Desktop\Bilder

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Ich\AppData\Local\Temp\3nglnfr5.dll
C:\Users\Ich\AppData\Local\Temp\4z2ewxj4.dll
C:\Users\Ich\AppData\Local\Temp\avgnt.exe
C:\Users\Ich\AppData\Local\Temp\bwgufcp3.dll
C:\Users\Ich\AppData\Local\Temp\Execute2App.exe
C:\Users\Ich\AppData\Local\Temp\h2hlylpx.dll
C:\Users\Ich\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Ich\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Ich\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Ich\AppData\Local\Temp\labk3jni.dll
C:\Users\Ich\AppData\Local\Temp\lknsaccm.dll
C:\Users\Ich\AppData\Local\Temp\Mediencenter_3.9.1055.64.exe
C:\Users\Ich\AppData\Local\Temp\mfnry1sa.dll
C:\Users\Ich\AppData\Local\Temp\msvcp90.dll
C:\Users\Ich\AppData\Local\Temp\msvcr90.dll
C:\Users\Ich\AppData\Local\Temp\q00fddhz.dll
C:\Users\Ich\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Ich\AppData\Local\Temp\x1hsm5zb.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-09 18:17

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Ich at 2014-09-15 12:31:22
Running from C:\Users\Ich\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.10.0.0 - Asmedia Technology)
ASUS Ai Charger (HKLM-x32\...\{7FB64E72-9B0E-4460-A821-040C341E414A}) (Version: 1.00.09 - ASUSTeK Computer Inc.)
ATI Catalyst Install Manager (HKLM\...\{2A13EF26-4D68-B2D7-A486-DBBD2FDE366B}) (Version: 3.0.765.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - AVM Berlin)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center Core Implementation (x32 Version: 2010.0210.2206.39615 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0210.2206.39615 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0210.2206.39615 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0210.2206.39615 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0210.2206.39615 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0210.2206.39615 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0210.2206.39615 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help English (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help French (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help German (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0210.2205.39615 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0210.2206.39615 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0210.2206.39615 - ATI) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5000 - CDBurnerXP)
ClipGrab 3.3.0.4 (HKLM-x32\...\{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1) (Version:  - Philipp Schmieder Medien)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.13587 - Landesfinanzdirektion Thüringen)
EPSON BX525WD Series Printer Uninstall (HKLM\...\EPSON BX525WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
foobar2000 v1.1.16 (HKLM-x32\...\foobar2000) (Version: 1.1.16 - Peter Pawlowski)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free YouTube Download version 3.1.42.1212 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.42.1212 - DVDVideoSoft Ltd.)
Garmin Training Center (HKLM-x32\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Codec Pack 9.9.5 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.9.5 - )
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mediencenter 3.9.1055.64 (HKCU\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.1 (x86 de) (HKCU\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 16.0.1 - Mozilla)
Mp3tag v2.53 (HKLM-x32\...\Mp3tag) (Version: v2.53 - Florian Heidenreich)
MPC-HC 1.7.0 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.0.7858 - MPC-HC Team)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
Napster 5 Beta (HKLM-x32\...\com.Rhapsody.Napster5) (Version: 1.0.65 - Rhapsody International, Inc)
Napster 5 Beta (x32 Version: 1.0.65 - Rhapsody International, Inc) Hidden
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
PSD Viewer (HKLM-x32\...\{D8EEDC94-EE82-46A0-A7DB-812E3C6A0A6E}_is1) (Version:  - IdeaMK)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.43.321.2011 - Realtek)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.9 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14083.9 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Spotify (HKCU\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB)
TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
Vistawinexit (HKLM-x32\...\{2FC1B08D-B4B6-42F4-B1BF-C913625EAC6C}_is1) (Version: 7 - hxxp://www.kurt-selzam.de/)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2772413043-2723522287-3080337467-1000_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-2772413043-2723522287-3080337467-1000_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-2772413043-2723522287-3080337467-1000_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-2772413043-2723522287-3080337467-1000_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2013-09-14 14:03 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0556C584-BE65-46CA-B5A0-523E3FDE3CC3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {23856D2E-6B71-4763-8434-A56EF2A50A56} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-29] (Google Inc.)
Task: {23F5EFA0-D4E5-408A-AC6B-A6609D62C356} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-29] (Google Inc.)
Task: {B2D8ECB1-F5C2-414E-B5A0-F7107C4C8E40} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {C6B21181-D398-42F0-AE6A-770E70E7BDCC} - \BitGuard No Task File <==== ATTENTION
Task: {E3404665-ACE2-4572-AB74-B6C1D7013FE6} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {F71E76B0-A62B-403D-B02D-4A9E0C5FFB15} - \DealPly No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-10-14 12:18 - 2010-12-17 14:25 - 00078448 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2012-10-14 12:18 - 2010-12-17 14:25 - 00386160 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2012-10-14 12:18 - 2010-12-17 14:25 - 00105584 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2012-10-14 12:18 - 2010-12-17 14:25 - 64643696 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2012-10-14 12:20 - 2012-10-14 12:20 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-02-07 21:05 - 2014-02-07 21:05 - 00142336 _____ () C:\Program Files (x86)\Napster 5\Napster 5.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () G:\Program Files (x86)\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () G:\Program Files (x86)\libxml2.dll
2014-08-14 14:36 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\Ich\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-09-13 08:27 - 2014-09-13 08:27 - 03716720 _____ () G:\Windows.old\Program Files\Mozilla Firefox\mozjs.dll
2014-03-31 21:35 - 2014-03-31 21:35 - 00282304 _____ () C:\Program Files (x86)\Windows Live\Writer\de\WindowsLive.Writer.Localization.resources.dll
2014-09-10 16:48 - 2014-09-10 16:48 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll
2014-02-17 21:43 - 2014-02-17 21:43 - 04791656 _____ () c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\WebKit.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 00237384 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Ich\Documents\Pass.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Ich\Documents\Pass.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: AmazonMP3DownloaderHelper => C:\Users\Ich\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
MSCONFIG\startupreg: ApplePhotoStreams => G:\Program Files (x86)\ApplePhotoStreams.exe
MSCONFIG\startupreg: ASUS Ai Charger => C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
MSCONFIG\startupreg: DAEMON Tools Lite => "G:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: iCloudServices => G:\Program Files (x86)\iCloudServices.exe
MSCONFIG\startupreg: Spotify => "C:\Users\Ich\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"

==================== Faulty Device Manager Devices =============

Name: ATI High Definition Audio Device
Description: ATI High Definition Audio Device
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: ATI Technologies Inc.
Service: AtiHdmiService
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/15/2014 00:15:33 PM) (Source: VSS) (EventID: 12305) (User: )
Description: Volumeschattenkopie-Dienstfehler: Volume bzw. Datenträger ist nicht richtig angeschlossen oder wurde nicht gefunden.
Fehlerkontext: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3 - 0000000000000118,0x00560034,000000000024FFD0,0,000000000055B790,4096,[0]).


Vorgang:
  PostFinalCommitSnapshots wird verarbeitet

Kontext:
  Ausführungskontext: System Provider

Error: (09/15/2014 10:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9173

Error: (09/15/2014 10:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9173

Error: (09/15/2014 10:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/12/2014 02:53:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13151

Error: (09/12/2014 02:53:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13151

Error: (09/12/2014 02:53:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/12/2014 02:53:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 12152

Error: (09/12/2014 02:53:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 12152

Error: (09/12/2014 02:53:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (09/15/2014 00:15:33 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/15/2014 09:26:25 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/15/2014 09:25:13 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SysMain erreicht.

Error: (09/15/2014 09:24:43 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Spooler erreicht.

Error: (09/13/2014 09:15:43 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (09/13/2014 08:09:27 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/13/2014 00:51:17 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (09/12/2014 01:47:06 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/11/2014 10:46:55 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (09/11/2014 02:41:02 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================
Error: (09/15/2014 00:15:33 PM) (Source: VSS) (EventID: 12305) (User: )
Description: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3 - 0000000000000118,0x00560034,000000000024FFD0,0,000000000055B790,4096,[0])

Vorgang:
  PostFinalCommitSnapshots wird verarbeitet

Kontext:
  Ausführungskontext: System Provider

Error: (09/15/2014 10:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9173

Error: (09/15/2014 10:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9173

Error: (09/15/2014 10:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/12/2014 02:53:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13151

Error: (09/12/2014 02:53:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13151

Error: (09/12/2014 02:53:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/12/2014 02:53:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 12152

Error: (09/12/2014 02:53:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 12152

Error: (09/12/2014 02:53:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


==================== Memory info ===========================

Processor: AMD Athlon(tm) II X2 270 Processor
Percentage of memory in use: 38%
Total physical RAM: 7934.12 MB
Available physical RAM: 4849.88 MB
Total Pagefile: 15866.37 MB
Available Pagefile: 11938.1 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.9 GB) (Free:4.44 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (OSTFRIESLAND) (CDROM) (Total:3.43 GB) (Free:0 GB) UDF
Drive e: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (FILME) (Fixed) (Total:21.56 GB) (Free:12.47 GB) FAT32
Drive g: () (Fixed) (Total:444.09 GB) (Free:121.97 GB) NTFS
Drive h: (Volume) (Fixed) (Total:0.1 GB) (Free:0.08 GB) NTFS
Drive i: () (Fixed) (Total:465.66 GB) (Free:172.27 GB) NTFS
Drive o: () (Fixed) (Total:465.76 GB) (Free:283.62 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 5A7BC773)
Partition 1: (Not Active) - (Size=99 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: A538271F)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=444.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=21.6 GB) - (Type=OF Extended)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: 716D0BC6)
Partition 1: (Active) - (Size=55.9 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 465.8 GB) (Disk ID: 1573BF3B)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 15.09.2014 19:39
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

memyselfandy 15.09.2014 20:53
Code:
ComboFix 14-09-16.01 - Ich 15.09.2014  21:17:11.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.7934.4907 [GMT 2:00]
ausgeführt von:: c:\users\Ich\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Ich\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-08-15 bis 2014-09-15  ))))))))))))))))))))))))))))))
.
.
2014-09-15 19:31 . 2014-09-15 19:31        --------        d-----w-        c:\users\Public\AppData\Local\temp
2014-09-15 19:31 . 2014-09-15 19:31        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-09-15 19:31 . 2014-09-15 19:31        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2014-09-15 15:00 . 2014-09-15 15:00        --------        d-----w-        c:\windows\system32\SPReview
2014-09-15 10:30 . 2014-09-15 10:31        --------        d-----w-        C:\FRST
2014-09-11 13:09 . 2014-09-11 13:09        --------        d-----w-        c:\program files\iPod
2014-09-11 13:09 . 2014-09-11 13:10        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 13:09 . 2014-09-11 13:10        --------        d-----w-        c:\program files\iTunes
2014-09-09 19:27 . 2014-09-15 19:36        122584        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-09 19:26 . 2014-05-12 05:26        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys
2014-09-09 19:26 . 2014-05-12 05:26        91352        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2014-09-09 19:26 . 2014-05-12 05:25        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys
2014-09-09 19:22 . 2014-09-09 19:22        --------        d-----w-        c:\users\Ich\AppData\Roaming\Abelssoft
2014-09-09 19:22 . 2014-09-09 19:22        --------        d-----w-        c:\users\Ich\AppData\Local\Abelssoft
2014-09-09 19:22 . 2014-09-09 19:22        --------        d-----w-        c:\programdata\XDMessagingv4
2014-09-09 19:22 . 2014-09-15 07:35        --------        d-----w-        c:\program files (x86)\CHIP Updater
2014-09-09 19:22 . 2014-09-09 19:22        --------        d-----w-        c:\users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-06 08:45 . 2014-09-06 08:45        --------        d-----w-        c:\users\Ich\AppData\Local\Telekom
2014-09-06 08:45 . 2014-09-06 08:45        --------        d-----w-        c:\users\Ich\AppData\Roaming\Telekom
2014-09-06 08:45 . 2011-05-13 10:16        493056        ----a-w-        c:\windows\SysWow64\dhRichClient3.dll
2014-09-06 08:45 . 2011-03-25 18:42        338432        ----a-w-        c:\windows\SysWow64\sqlite36_engine.dll
2014-08-29 14:09 . 2014-08-29 16:58        --------        d-----w-        c:\users\Ich\AppData\Local\Adobe
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-10 14:48 . 2012-10-14 11:19        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-10 14:48 . 2012-10-14 11:19        701104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-09 19:24 . 2012-10-23 08:00        101694776        ----a-w-        c:\windows\system32\MRT.exe
2014-08-29 11:46 . 2012-07-17 12:37        23256        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-09 10:02 . 2014-08-09 10:02        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-10 12:28 . 2013-05-07 14:02        42040        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2014-06-24 12:26 . 2013-03-30 21:56        117712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lollipop"="lollipop" [X]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-12-17 2489456]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 98304]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-14 751184]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-31 43816]
"QuickTime Task"="g:\program files (x86)\QTTask.exe" [2014-01-17 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"iTunesHelper"="g:\program files (x86)\itunes\iTunesHelper.exe" [2014-09-01 152392]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-27 164656]
.
c:\users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Mediencenter.lnk - c:\users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe [2014-6-12 580416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
S0 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 MBAMScheduler;MBAMScheduler;g:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;g:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;g:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;g:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MBAMWEBACCESSCONTROL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-11 17:27        1096520        ----a-w-        c:\program files (x86)\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-14 14:48]
.
2014-09-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-29 14:22]
.
2014-09-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-29 14:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Mediencenter_InSync]
@="{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}"
"ReferenceCount"=dword:00000001
[HKEY_CLASSES_ROOT\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}]
2013-08-22 07:40        558592        ----a-w-        c:\users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Mediencenter_ToSync]
@="{528EE335-5034-4EFC-834E-63E5F02D2BC2}"
"ReferenceCount"=dword:00000001
[HKEY_CLASSES_ROOT\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}]
2013-08-22 07:40        558592        ----a-w-        c:\users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Mediencenter_Failed]
@="{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}"
"ReferenceCount"=dword:00000001
[HKEY_CLASSES_ROOT\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}]
2013-08-22 07:40        558592        ----a-w-        c:\users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Ich\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-com.apple.dav.bookmarks.daemon - g:\program files (x86)\BookmarkDAV_client.exe
Wow6432Node-HKCU-Run-KiesPDLR.exe - c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
AddRemove-{43B74FAB-FB58-447D-8D3A-5F638AF36FD1} - c:\programdata\{BA58D0EE-89D1-4191-9F19-B6AD920B04F7}\Netzmanager1.081.0201_140124a.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
g:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-15  21:46:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-09-15 19:46
.
Vor Suchlauf: 4.218.826.752 Bytes frei
Nach Suchlauf: 6.694.162.432 Bytes frei
.
- - End Of File - - B78F9BB2DC364D3C8F5A06FEDE530A34
A36C5E4F47E84449FF07ED3517B43A31

schrauber 16.09.2014 12:59
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

memyselfandy 16.09.2014 14:57
mbam.txt

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 16.09.2014
Suchlauf-Zeit: 15:20:11
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.16.04
Rootkit Datenbank: v2014.09.15.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7
CPU: x64
Dateisystem: NTFS
Benutzer: Ich

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 360844
Verstrichene Zeit: 9 Min, 30 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
AdwCleaner

AdwCleaner Logfile:
Code:
# AdwCleaner v3.003 - Bericht erstellt am 15/09/2013 um 00:18:37
# Updated 07/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzername : Ich - ICH-PC
# Gestartet von : C:\Users\Ich\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : IBUpdaterService

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\IBUpdaterService
Ordner Gelöscht : C:\Program Files (x86)\file scout
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\Ich\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Ich\AppData\Roaming\PerformerSoft
Datei Gelöscht : C:\Windows\System32\roboot64.exe

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\performersoft llc
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7600.17267


-\\ Mozilla Firefox v

[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7nh2t7fs.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.crossrider.bic", "1410e0bacc6e9bbca3fe7f24170bfdc9");

*************************

AdwCleaner[R0].txt - [2634 octets] - [15/09/2013 00:18:08]
AdwCleaner[S0].txt - [2262 octets] - [15/09/2013 00:18:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2322 octets] ##########
--- --- ---
AdwCleaner Logfile:
Code:
# AdwCleaner v3.310 - Bericht erstellt am 16/09/2014 um 15:39:41
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzername : Ich - ICH-PC
# Gestartet von : C:\Users\Ich\Desktop\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\~0
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BitGuard
Ordner Gelöscht : C:\Program Files (x86)\iRobinHood
Ordner Gelöscht : C:\Users\Ich\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Ich\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Ich\AppData\LocalLow\iRobinHood
Ordner Gelöscht : C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
Ordner Gelöscht : C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Datei Gelöscht : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\11-suche.xml

***** [ Tasks ] *****

Task Gelöscht : BitGuard
Task Gelöscht : Dealply

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [lollipop]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DEALPL~1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DEALPL~1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Lollipop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Lollipop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyDeltaTB_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyDeltaTB_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKCU\Software\90d9dee635e844
Schlüssel Gelöscht : HKLM\SOFTWARE\90d9dee635e844
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKLM\SOFTWARE\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\Vittalia
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7600.17267


-\\ Mozilla Firefox v

[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\prefs.js ]


-\\ Google Chrome v37.0.2062.103

[ Datei : C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Extension] : mkcedibhemacmilmkpndpkoidlnmgngg

*************************

AdwCleaner[R0].txt - [7535 octets] - [15/09/2013 00:18:08]
AdwCleaner[S0].txt - [6882 octets] - [15/09/2013 00:18:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6942 octets] ##########
--- --- ---


JRT

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.5 (09.16.2014:1)
OS: Windows 7 Home Premium x64
Ran by Ich on 16.09.2014 at 15:46:31,57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2772413043-2723522287-3080337467-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\lyricsbuddy-1-bg_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\lyricsbuddy-1-bg_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsBuddy-1-codedownloader_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsBuddy-1-codedownloader_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsBuddy-1-firefoxinstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsBuddy-1-firefoxinstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsBuddy-1-updater_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsBuddy-1-updater_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\lyricsbuddy-1-bg_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\lyricsbuddy-1-bg_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsBuddy-1-codedownloader_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsBuddy-1-codedownloader_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsBuddy-1-firefoxinstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsBuddy-1-firefoxinstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsBuddy-1-updater_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsBuddy-1-updater_RASMANCS



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.09.2014 at 15:49:34,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Ich (administrator) on ICH-PC on 16-09-2014 15:52:29
Running from C:\Users\Ich\Downloads
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Deutsche Telekom AG) C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) G:\Program Files (x86)\itunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) G:\Windows.old\Program Files\Mozilla Firefox\firefox.exe
(Apple Inc.) G:\Program Files (x86)\itunes\iTunes.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-12-17] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-02-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => G:\Program Files (x86)\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => G:\Program Files (x86)\itunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk
ShortcutTarget: Mediencenter.lnk -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 01Mediencenter_InSync -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 02Mediencenter_ToSync -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 03Mediencenter_Failed -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x68C4B176828CCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649
FF Homepage: https://www.facebook.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 -> G:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> G:\Program Files (x86)\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> G:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\webde-suche.xml
FF Extension: GMX MailCheck - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\toolbar@gmx.net [2014-09-05]
FF Extension: Garmin Communicator - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-09]
FF Extension: Cliqz Beta - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\cliqz@cliqz.com.xpi [2014-09-07]
FF Extension: FDislike - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\fbdislike@doweb.fr.xpi [2013-10-09]
FF Extension: Thumbnail Zoom Plus - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\thumbnailZoom@dadler.github.com.xpi [2013-10-09]
FF Extension: eBay Sidebar for Firefox - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2013-10-09]
FF Extension: Adblock Plus - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\extensions\cliqz@cliqz.com
FF StartMenuInternet: FIREFOX.EXE - G:\Windows.old\Program Files\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR HomePage: Default -> FB7F6F72296557E5ABCB79AFD15960C1D024D7CA572F228FF6E52BE41837948B
CHR DefaultSearchKeyword: Default -> 922C4CE5F3F033170AD725A0175E5C28873667907D4DDCC1D0DB9A1809923D9E
CHR DefaultSearchProvider: Default -> 6F6DE16BBB60EC641012CF0CCF1FB01AC9E3D9423F673D81E85936F33B901C1D
CHR DefaultSearchURL: Default -> FB6906C383719F29C5AA83DB7D8943AE20929DA8FC999BD64DD1CEAA2995FCA5
CHR Profile: C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-29]
CHR Extension: (Google Drive) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-29]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-29]
CHR Extension: (Google-Suche) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-29]
CHR Extension: (No Name) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2014-07-29]
CHR Extension: (Google Wallet) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-29]
CHR Extension: (Google Mail) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
S2 MBAMScheduler; G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-17] ()
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-03-26] (Apple Inc.) [File not signed]
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-16 15:49 - 2014-09-16 15:49 - 00002793 _____ () C:\Users\Ich\Desktop\JRT.txt
2014-09-16 15:45 - 2014-09-16 15:45 - 00007034 _____ () C:\Users\Ich\Desktop\AdwCleaner[S0].txt
2014-09-16 15:33 - 2014-09-16 15:33 - 00001139 _____ () C:\mbam.txt
2014-09-16 15:25 - 2014-09-16 15:25 - 01373475 _____ () C:\Users\Ich\Desktop\AdwCleaner_3.310.exe
2014-09-16 15:25 - 2014-09-16 15:25 - 01016035 _____ (Thisisu) C:\Users\Ich\Desktop\JRT.exe
2014-09-16 15:17 - 2014-09-16 15:52 - 00014852 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-09-15 22:23 - 2014-09-15 22:23 - 00000000 ____D () C:\Windows\system32\SPReview
2014-09-15 21:46 - 2014-09-15 21:46 - 00017488 _____ () C:\ComboFix.txt
2014-09-15 21:13 - 2014-09-15 21:46 - 00000000 ____D () C:\Qoobox
2014-09-15 21:13 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-15 21:13 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-15 21:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-15 21:11 - 2014-09-15 21:11 - 05579386 ____R (Swearware) C:\Users\Ich\Desktop\ComboFix.exe
2014-09-15 12:31 - 2014-09-15 12:31 - 00031163 _____ () C:\Users\Ich\Desktop\Addition.txt
2014-09-15 12:30 - 2014-09-16 15:52 - 00000000 ____D () C:\FRST
2014-09-15 12:30 - 2014-09-15 12:43 - 00032051 _____ () C:\Users\Ich\Desktop\FRST.txt
2014-09-15 12:29 - 2014-09-15 12:29 - 02105856 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-09-13 09:14 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Alexander Knappe - Die zweite
2014-09-13 09:13 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - An End has a Start
2014-09-13 09:13 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Counting Crows - Somewhere under Wonderland
2014-09-13 09:12 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - In this Light and on this Evening
2014-09-13 09:12 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - Push your Head Towards the Air
2014-09-13 09:11 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - The Back Room
2014-09-13 09:11 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Honig - It's not a Hummingbird, It's your Father's Ghost
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Laing - Wechselt die Beleuchtung
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Kraftklub - In Schwarz
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\The Script - No Sound without Silence
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\Miss Platnum - Hüftgold Berlin
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Train - Bulletproof Picasso
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Toxpack - Friss!
2014-09-13 09:07 - 2014-09-13 09:07 - 00000000 ____D () C:\Users\Ich\Desktop\Vance Joy - Dream your Life
2014-09-11 15:10 - 2014-09-11 15:10 - 00001568 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-11 15:09 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 15:09 - 2014-09-11 15:10 - 00000000 ____D () C:\Program Files\iTunes
2014-09-11 15:09 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iPod
2014-09-10 16:02 - 2014-09-10 16:02 - 00000000 ____D () C:\Users\Ich\Desktop\U2 - Songs of Innocence
2014-09-09 21:27 - 2014-09-16 15:44 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-09 21:26 - 2014-09-15 11:55 - 00000781 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-09 21:26 - 2014-09-15 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-09 21:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-09 21:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-09 21:26 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-09 21:22 - 2014-09-15 09:35 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-06 10:45 - 2014-09-06 10:46 - 00001133 _____ () C:\Users\Ich\Desktop\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:46 - 00001119 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Telekom
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Local\Telekom
2014-09-06 10:45 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-06 10:45 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-02 15:07 - 2014-09-13 08:13 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-29 16:09 - 2014-08-29 18:58 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe
2014-08-23 10:49 - 2014-08-23 10:49 - 00226807 _____ () C:\Users\Ich\Downloads\FRITZ.Box Fon WLAN 7390 84.06.04_23.08.14_1049.export

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-16 15:52 - 2014-09-16 15:17 - 00014852 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-09-16 15:52 - 2014-09-15 12:30 - 00000000 ____D () C:\FRST
2014-09-16 15:49 - 2014-09-16 15:49 - 00002793 _____ () C:\Users\Ich\Desktop\JRT.txt
2014-09-16 15:49 - 2009-07-14 06:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-16 15:49 - 2009-07-14 06:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-16 15:47 - 2013-07-02 19:37 - 02315776 ___SH () C:\Users\Ich\Desktop\Thumbs.db
2014-09-16 15:47 - 2012-10-14 13:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-16 15:45 - 2014-09-16 15:45 - 00007034 _____ () C:\Users\Ich\Desktop\AdwCleaner[S0].txt
2014-09-16 15:45 - 2014-03-07 16:14 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-16 15:45 - 2012-10-14 21:51 - 00696620 _____ () C:\Windows\system32\perfh007.dat
2014-09-16 15:45 - 2012-10-14 21:51 - 00147916 _____ () C:\Windows\system32\perfc007.dat
2014-09-16 15:44 - 2014-09-09 21:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-16 15:44 - 2014-07-29 16:22 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-16 15:41 - 2013-09-15 00:19 - 00034396 _____ () C:\Windows\PFRO.log
2014-09-16 15:41 - 2013-09-15 00:19 - 00018224 _____ () C:\Windows\setupact.log
2014-09-16 15:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-16 15:39 - 2013-09-15 00:17 - 00000000 ____D () C:\AdwCleaner
2014-09-16 15:39 - 2012-10-14 12:17 - 01961841 _____ () C:\Windows\WindowsUpdate.log
2014-09-16 15:33 - 2014-09-16 15:33 - 00001139 _____ () C:\mbam.txt
2014-09-16 15:27 - 2014-07-29 16:22 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-16 15:25 - 2014-09-16 15:25 - 01373475 _____ () C:\Users\Ich\Desktop\AdwCleaner_3.310.exe
2014-09-16 15:25 - 2014-09-16 15:25 - 01016035 _____ (Thisisu) C:\Users\Ich\Desktop\JRT.exe
2014-09-15 22:23 - 2014-09-15 22:23 - 00000000 ____D () C:\Windows\system32\SPReview
2014-09-15 22:22 - 2014-08-11 11:55 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\vlc
2014-09-15 21:46 - 2014-09-15 21:46 - 00017488 _____ () C:\ComboFix.txt
2014-09-15 21:46 - 2014-09-15 21:13 - 00000000 ____D () C:\Qoobox
2014-09-15 21:36 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-15 21:34 - 2013-09-14 13:56 - 00000000 ____D () C:\Windows\erdnt
2014-09-15 21:11 - 2014-09-15 21:11 - 05579386 ____R (Swearware) C:\Users\Ich\Desktop\ComboFix.exe
2014-09-15 12:43 - 2014-09-15 12:30 - 00032051 _____ () C:\Users\Ich\Desktop\FRST.txt
2014-09-15 12:31 - 2014-09-15 12:31 - 00031163 _____ () C:\Users\Ich\Desktop\Addition.txt
2014-09-15 12:29 - 2014-09-15 12:29 - 02105856 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-09-15 12:15 - 2014-07-29 14:16 - 00001973 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2014-09-15 11:55 - 2014-09-09 21:26 - 00000781 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-15 11:55 - 2014-09-09 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-15 09:35 - 2014-09-09 21:22 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-09-13 09:14 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Alexander Knappe - Die zweite
2014-09-13 09:14 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - An End has a Start
2014-09-13 09:14 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Counting Crows - Somewhere under Wonderland
2014-09-13 09:13 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - In this Light and on this Evening
2014-09-13 09:12 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - Push your Head Towards the Air
2014-09-13 09:12 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - The Back Room
2014-09-13 09:11 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Honig - It's not a Hummingbird, It's your Father's Ghost
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Laing - Wechselt die Beleuchtung
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Kraftklub - In Schwarz
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\The Script - No Sound without Silence
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\Miss Platnum - Hüftgold Berlin
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Train - Bulletproof Picasso
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Toxpack - Friss!
2014-09-13 09:07 - 2014-09-13 09:07 - 00000000 ____D () C:\Users\Ich\Desktop\Vance Joy - Dream your Life
2014-09-13 08:14 - 2014-08-14 14:36 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-13 08:13 - 2014-09-02 15:07 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-13 08:13 - 2012-10-14 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-13 08:13 - 2012-10-14 13:09 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-11 21:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-11 19:30 - 2014-07-29 16:24 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00001568 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-11 15:10 - 2014-09-11 15:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 15:10 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iTunes
2014-09-11 15:09 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iPod
2014-09-10 16:48 - 2012-10-14 13:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 16:48 - 2012-10-14 13:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 16:48 - 2012-10-14 13:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 16:02 - 2014-09-10 16:02 - 00000000 ____D () C:\Users\Ich\Desktop\U2 - Songs of Innocence
2014-09-10 14:18 - 2012-10-17 20:24 - 00000000 ____D () C:\Windows\CheckSur
2014-09-10 14:18 - 2009-07-14 06:45 - 00298304 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-09 21:45 - 2012-10-14 12:24 - 00066064 _____ () C:\Users\Ich\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-09 21:28 - 2013-08-15 22:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 21:26 - 2013-09-15 00:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-09 21:24 - 2012-10-23 10:00 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-06 10:46 - 2014-09-06 10:45 - 00001133 _____ () C:\Users\Ich\Desktop\Mediencenter.lnk
2014-09-06 10:46 - 2014-09-06 10:45 - 00001119 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Telekom
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Local\Telekom
2014-08-31 22:03 - 2012-11-26 17:14 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Spotify
2014-08-31 21:58 - 2012-11-26 17:14 - 00000000 ____D () C:\Users\Ich\AppData\Local\Spotify
2014-08-29 22:45 - 2012-12-10 16:50 - 00000866 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-08-29 22:45 - 2012-12-10 16:50 - 00000804 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-29 18:58 - 2014-08-29 16:09 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe
2014-08-23 10:49 - 2014-08-23 10:49 - 00226807 _____ () C:\Users\Ich\Downloads\FRITZ.Box Fon WLAN 7390 84.06.04_23.08.14_1049.export
2014-08-21 15:06 - 2012-10-14 12:15 - 00000000 ____D () C:\Users\Ich\AppData\Local\VirtualStore

Some content of TEMP:
====================
C:\Users\Ich\AppData\Local\Temp\avgnt.exe
C:\Users\Ich\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-09 18:17

==================== End Of Log ============================
--- --- ---

schrauber 17.09.2014 05:51

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

memyselfandy 17.09.2014 17:05
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6c2627a9bd431f48a4f853adb21dea28
# engine=20196
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-17 03:42:48
# local_time=2014-09-17 05:42:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 10666 276391858 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 60741484 162598418 0 0
# scanned=540466
# found=12
# cleaned=0
# scan_time=7470
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=A4CE23BF2223D1C4EC6A4FCA8DFBBFAA69FFE3E9 ft=1 fh=c71c00117a940ad8 vn="Variante von Win32/FileScout.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\file scout\filescout.exe.vir"
sh=D11C793DDE90E7C3ED61CB63B2A83EE3AD6EBD78 ft=1 fh=71ae1aaa1ef3c733 vn="Variante von Win32/InstallBrain.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IBUpdaterService\ibsvc.exe.vir"
sh=5353C2021C1DB25B027D5E97680131AC9CB2C43D ft=1 fh=a62584fabc5db667 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=3F20DC68A6AAC23C4702D16C8A5388DCFE591AEA ft=1 fh=e5e2264a283a7f45 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="G:\Program Files (x86)\PSDViewer\MyBabylonTB.exe"
sh=A823D4D557D4DEAFBE264CC8760DBFE85C24C4A0 ft=1 fh=c71c001189d1b3db vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\AppData\Local\Babylon\Setup\BExternal.dll"
sh=E9966958672AFC5363CD47F153CA2ED0C87112DF ft=1 fh=a2f67e8360868780 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\AppData\Local\Babylon\Setup\IECookieLow.dll"
sh=45D1104CA6BE51EDA80B5994403E9ABD523082A3 ft=1 fh=dc60180b3d8151a5 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\AppData\Local\Babylon\Setup\Setup.exe"
sh=D07757756265A117CE2DBB0FF9080E6DB3E2BDFE ft=1 fh=d28bfc5af97fb48a vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\Downloads\Lottoschein-Check-Setup.exe"
sh=A823D4D557D4DEAFBE264CC8760DBFE85C24C4A0 ft=1 fh=c71c001189d1b3db vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\Lokale Einstellungen\Babylon\Setup\BExternal.dll"
sh=E9966958672AFC5363CD47F153CA2ED0C87112DF ft=1 fh=a2f67e8360868780 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\Lokale Einstellungen\Babylon\Setup\IECookieLow.dll"
sh=45D1104CA6BE51EDA80B5994403E9ABD523082A3 ft=1 fh=dc60180b3d8151a5 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="G:\Windows.old\Users\Administrator\Lokale Einstellungen\Babylon\Setup\Setup.exe"
Code:
Results of screen317's Security Check version 0.99.87 
 Windows 7  x64 (UAC is enabled) 
 Out of date service pack!!
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop 
 Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 67 
 Adobe Flash Player 15.0.0.152 
 Adobe Reader XI 
 Google Chrome 37.0.2062.103 
 Google Chrome 37.0.2062.120 
````````Process Check: objlist.exe by Laurent```````` 
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
 Malwarebytes Anti-Malware mbamscheduler.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Ich (administrator) on ICH-PC on 17-09-2014 17:57:48
Running from C:\Users\Ich\Downloads
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) G:\Program Files (x86)\itunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Deutsche Telekom AG) C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) G:\Program Files (x86)\itunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) G:\Windows.old\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
() C:\Users\Ich\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-12-17] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-02-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => G:\Program Files (x86)\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => G:\Program Files (x86)\itunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk
ShortcutTarget: Mediencenter.lnk -> C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 01Mediencenter_InSync -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 02Mediencenter_ToSync -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 03Mediencenter_Failed -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Ich\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x68C4B176828CCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649
FF Homepage: https://www.facebook.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 -> G:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> G:\Program Files (x86)\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> G:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\searchplugins\webde-suche.xml
FF Extension: No Name - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\staged [2014-09-17]
FF Extension: GMX MailCheck - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\toolbar@gmx.net [2014-09-05]
FF Extension: Garmin Communicator - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-09]
FF Extension: Cliqz Beta - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\cliqz@cliqz.com.xpi [2014-09-07]
FF Extension: FDislike - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\fbdislike@doweb.fr.xpi [2013-10-09]
FF Extension: Thumbnail Zoom Plus - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\thumbnailZoom@dadler.github.com.xpi [2013-10-09]
FF Extension: eBay Sidebar for Firefox - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2013-10-09]
FF Extension: Adblock Plus - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\41gwhyyy.default-1381347011649\extensions\cliqz@cliqz.com
FF StartMenuInternet: FIREFOX.EXE - G:\Windows.old\Program Files\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR HomePage: Default ->
CHR DefaultSearchKeyword: Default -> 922C4CE5F3F033170AD725A0175E5C28873667907D4DDCC1D0DB9A1809923D9E
CHR DefaultSearchProvider: Default -> 6F6DE16BBB60EC641012CF0CCF1FB01AC9E3D9423F673D81E85936F33B901C1D
CHR DefaultSearchURL: Default -> FB6906C383719F29C5AA83DB7D8943AE20929DA8FC999BD64DD1CEAA2995FCA5
CHR Profile: C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-29]
CHR Extension: (Google Drive) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-29]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-29]
CHR Extension: (Google-Suche) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-29]
CHR Extension: (Google Wallet) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-29]
CHR Extension: (Google Mail) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; G:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
U4 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-17] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-17] ()
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-03-26] (Apple Inc.) [File not signed]
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-17 17:01 - 2014-09-17 17:01 - 00000000 ____D () C:\Windows\system32\SPReview
2014-09-17 15:25 - 2014-09-17 15:25 - 02347384 _____ (ESET) C:\Users\Ich\Downloads\esetsmartinstaller_deu.exe
2014-09-17 15:25 - 2014-09-17 15:25 - 00854417 _____ () C:\Users\Ich\Downloads\SecurityCheck.exe
2014-09-16 15:49 - 2014-09-16 15:49 - 00002793 _____ () C:\Users\Ich\Desktop\JRT.txt
2014-09-16 15:45 - 2014-09-16 15:45 - 00007034 _____ () C:\Users\Ich\Desktop\AdwCleaner[S0].txt
2014-09-16 15:33 - 2014-09-16 15:33 - 00001139 _____ () C:\mbam.txt
2014-09-16 15:25 - 2014-09-16 15:25 - 01373475 _____ () C:\Users\Ich\Desktop\AdwCleaner_3.310.exe
2014-09-16 15:25 - 2014-09-16 15:25 - 01016035 _____ (Thisisu) C:\Users\Ich\Desktop\JRT.exe
2014-09-16 15:17 - 2014-09-17 17:57 - 00015742 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-09-15 21:46 - 2014-09-15 21:46 - 00017488 _____ () C:\ComboFix.txt
2014-09-15 21:13 - 2014-09-15 21:46 - 00000000 ____D () C:\Qoobox
2014-09-15 21:13 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-15 21:13 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-15 21:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-15 21:13 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-15 21:11 - 2014-09-15 21:11 - 05579386 ____R (Swearware) C:\Users\Ich\Desktop\ComboFix.exe
2014-09-15 12:31 - 2014-09-15 12:31 - 00031163 _____ () C:\Users\Ich\Desktop\Addition.txt
2014-09-15 12:30 - 2014-09-17 17:57 - 00000000 ____D () C:\FRST
2014-09-15 12:30 - 2014-09-16 15:53 - 00031231 _____ () C:\Users\Ich\Desktop\FRST.txt
2014-09-15 12:29 - 2014-09-15 12:29 - 02105856 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-09-13 09:14 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Alexander Knappe - Die zweite
2014-09-13 09:13 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - An End has a Start
2014-09-13 09:13 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Counting Crows - Somewhere under Wonderland
2014-09-13 09:12 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - In this Light and on this Evening
2014-09-13 09:12 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - Push your Head Towards the Air
2014-09-13 09:11 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - The Back Room
2014-09-13 09:11 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Honig - It's not a Hummingbird, It's your Father's Ghost
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Laing - Wechselt die Beleuchtung
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Kraftklub - In Schwarz
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\The Script - No Sound without Silence
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\Miss Platnum - Hüftgold Berlin
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Train - Bulletproof Picasso
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Toxpack - Friss!
2014-09-13 09:07 - 2014-09-13 09:07 - 00000000 ____D () C:\Users\Ich\Desktop\Vance Joy - Dream your Life
2014-09-11 15:10 - 2014-09-11 15:10 - 00001568 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-11 15:09 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 15:09 - 2014-09-11 15:10 - 00000000 ____D () C:\Program Files\iTunes
2014-09-11 15:09 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iPod
2014-09-10 16:02 - 2014-09-10 16:02 - 00000000 ____D () C:\Users\Ich\Desktop\U2 - Songs of Innocence
2014-09-09 21:27 - 2014-09-17 17:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-09 21:26 - 2014-09-15 11:55 - 00000781 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-09 21:26 - 2014-09-15 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-09 21:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-09 21:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-09 21:26 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-09 21:22 - 2014-09-15 09:35 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-06 10:45 - 2014-09-06 10:46 - 00001133 _____ () C:\Users\Ich\Desktop\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:46 - 00001119 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Telekom
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Local\Telekom
2014-09-06 10:45 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-06 10:45 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-02 15:07 - 2014-09-13 08:13 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-29 16:09 - 2014-08-29 18:58 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe
2014-08-23 10:49 - 2014-08-23 10:49 - 00226807 _____ () C:\Users\Ich\Downloads\FRITZ.Box Fon WLAN 7390 84.06.04_23.08.14_1049.export

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-17 17:57 - 2014-09-16 15:17 - 00015742 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-09-17 17:57 - 2014-09-15 12:30 - 00000000 ____D () C:\FRST
2014-09-17 17:47 - 2012-10-14 13:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-17 17:27 - 2014-08-11 11:55 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\vlc
2014-09-17 17:27 - 2014-07-29 16:22 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-17 17:23 - 2014-09-09 21:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-17 17:08 - 2012-10-14 12:17 - 01310457 _____ () C:\Windows\WindowsUpdate.log
2014-09-17 17:01 - 2014-09-17 17:01 - 00000000 ____D () C:\Windows\system32\SPReview
2014-09-17 16:27 - 2014-07-29 16:22 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-17 15:25 - 2014-09-17 15:25 - 02347384 _____ (ESET) C:\Users\Ich\Downloads\esetsmartinstaller_deu.exe
2014-09-17 15:25 - 2014-09-17 15:25 - 00854417 _____ () C:\Users\Ich\Downloads\SecurityCheck.exe
2014-09-17 15:20 - 2013-07-02 19:37 - 02315776 ___SH () C:\Users\Ich\Desktop\Thumbs.db
2014-09-17 15:19 - 2014-02-06 15:23 - 00066064 _____ () C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-17 14:45 - 2009-07-14 06:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-17 14:45 - 2009-07-14 06:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-17 14:41 - 2014-03-07 16:14 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-17 14:41 - 2012-10-14 21:51 - 00696620 _____ () C:\Windows\system32\perfh007.dat
2014-09-17 14:41 - 2012-10-14 21:51 - 00147916 _____ () C:\Windows\system32\perfc007.dat
2014-09-17 14:37 - 2013-09-15 00:19 - 00018280 _____ () C:\Windows\setupact.log
2014-09-17 14:37 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-16 15:53 - 2014-09-15 12:30 - 00031231 _____ () C:\Users\Ich\Desktop\FRST.txt
2014-09-16 15:49 - 2014-09-16 15:49 - 00002793 _____ () C:\Users\Ich\Desktop\JRT.txt
2014-09-16 15:45 - 2014-09-16 15:45 - 00007034 _____ () C:\Users\Ich\Desktop\AdwCleaner[S0].txt
2014-09-16 15:41 - 2013-09-15 00:19 - 00034396 _____ () C:\Windows\PFRO.log
2014-09-16 15:39 - 2013-09-15 00:17 - 00000000 ____D () C:\AdwCleaner
2014-09-16 15:33 - 2014-09-16 15:33 - 00001139 _____ () C:\mbam.txt
2014-09-16 15:25 - 2014-09-16 15:25 - 01373475 _____ () C:\Users\Ich\Desktop\AdwCleaner_3.310.exe
2014-09-16 15:25 - 2014-09-16 15:25 - 01016035 _____ (Thisisu) C:\Users\Ich\Desktop\JRT.exe
2014-09-15 21:46 - 2014-09-15 21:46 - 00017488 _____ () C:\ComboFix.txt
2014-09-15 21:46 - 2014-09-15 21:13 - 00000000 ____D () C:\Qoobox
2014-09-15 21:36 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-15 21:34 - 2013-09-14 13:56 - 00000000 ____D () C:\Windows\erdnt
2014-09-15 21:11 - 2014-09-15 21:11 - 05579386 ____R (Swearware) C:\Users\Ich\Desktop\ComboFix.exe
2014-09-15 12:31 - 2014-09-15 12:31 - 00031163 _____ () C:\Users\Ich\Desktop\Addition.txt
2014-09-15 12:29 - 2014-09-15 12:29 - 02105856 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-09-15 12:15 - 2014-07-29 14:16 - 00001973 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2014-09-15 11:55 - 2014-09-09 21:26 - 00000781 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-15 11:55 - 2014-09-09 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-15 09:35 - 2014-09-09 21:22 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-09-13 09:14 - 2014-09-13 09:14 - 00000000 ____D () C:\Users\Ich\Desktop\Alexander Knappe - Die zweite
2014-09-13 09:14 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - An End has a Start
2014-09-13 09:14 - 2014-09-13 09:13 - 00000000 ____D () C:\Users\Ich\Desktop\Counting Crows - Somewhere under Wonderland
2014-09-13 09:13 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - In this Light and on this Evening
2014-09-13 09:12 - 2014-09-13 09:12 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - Push your Head Towards the Air
2014-09-13 09:12 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Editors - The Back Room
2014-09-13 09:11 - 2014-09-13 09:11 - 00000000 ____D () C:\Users\Ich\Desktop\Honig - It's not a Hummingbird, It's your Father's Ghost
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Laing - Wechselt die Beleuchtung
2014-09-13 09:10 - 2014-09-13 09:10 - 00000000 ____D () C:\Users\Ich\Desktop\Kraftklub - In Schwarz
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\The Script - No Sound without Silence
2014-09-13 09:09 - 2014-09-13 09:09 - 00000000 ____D () C:\Users\Ich\Desktop\Miss Platnum - Hüftgold Berlin
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Train - Bulletproof Picasso
2014-09-13 09:08 - 2014-09-13 09:08 - 00000000 ____D () C:\Users\Ich\Desktop\Toxpack - Friss!
2014-09-13 09:07 - 2014-09-13 09:07 - 00000000 ____D () C:\Users\Ich\Desktop\Vance Joy - Dream your Life
2014-09-13 08:14 - 2014-08-14 14:36 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-13 08:13 - 2014-09-02 15:07 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-13 08:13 - 2012-10-14 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-13 08:13 - 2012-10-14 13:09 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-11 21:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-11 19:30 - 2014-07-29 16:24 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00001568 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-11 15:10 - 2014-09-11 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-11 15:10 - 2014-09-11 15:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-11 15:10 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iTunes
2014-09-11 15:09 - 2014-09-11 15:09 - 00000000 ____D () C:\Program Files\iPod
2014-09-10 16:48 - 2012-10-14 13:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 16:48 - 2012-10-14 13:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 16:48 - 2012-10-14 13:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 16:02 - 2014-09-10 16:02 - 00000000 ____D () C:\Users\Ich\Desktop\U2 - Songs of Innocence
2014-09-10 14:18 - 2012-10-17 20:24 - 00000000 ____D () C:\Windows\CheckSur
2014-09-10 14:18 - 2009-07-14 06:45 - 00298304 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-09 21:45 - 2012-10-14 12:24 - 00066064 _____ () C:\Users\Ich\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-09 21:28 - 2013-08-15 22:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 21:26 - 2013-09-15 00:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-09 21:24 - 2012-10-23 10:00 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\DesktopIconGoodgame
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Abelssoft
2014-09-09 21:22 - 2014-09-09 21:22 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-09-06 10:46 - 2014-09-06 10:45 - 00001133 _____ () C:\Users\Ich\Desktop\Mediencenter.lnk
2014-09-06 10:46 - 2014-09-06 10:45 - 00001119 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Telekom
2014-09-06 10:45 - 2014-09-06 10:45 - 00000000 ____D () C:\Users\Ich\AppData\Local\Telekom
2014-08-31 22:03 - 2012-11-26 17:14 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Spotify
2014-08-31 21:58 - 2012-11-26 17:14 - 00000000 ____D () C:\Users\Ich\AppData\Local\Spotify
2014-08-29 22:45 - 2012-12-10 16:50 - 00000866 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-08-29 22:45 - 2012-12-10 16:50 - 00000804 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-29 18:58 - 2014-08-29 16:09 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe
2014-08-23 10:49 - 2014-08-23 10:49 - 00226807 _____ () C:\Users\Ich\Downloads\FRITZ.Box Fon WLAN 7390 84.06.04_23.08.14_1049.export
2014-08-21 15:06 - 2012-10-14 12:15 - 00000000 ____D () C:\Users\Ich\AppData\Local\VirtualStore

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Ich\AppData\Local\Temp\avgnt.exe
C:\Users\Ich\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-16 19:10

==================== End Of Log ============================
--- --- ---

--- --- ---


Das Update läßt sich noch immer nicht installieren.

8024200D ist der Fehler Code (Unbekannter Fehler bei Windows Update)

schrauber 18.09.2014 08:27
welches Update genau? KB Nummer?

memyselfandy 18.09.2014 14:11
Kb976932

Die Probleme mit dem 'einfrieren' sind auch noch da....

schrauber 19.09.2014 08:20
Mach erst mal nen Clean Boot? Friert er dann auch ein? Wenn ja Hardwareproblem. Dann erstmal dieses beheben.

memyselfandy 20.09.2014 09:39
Kannst du mir helfen, was ein clean boot ist? ?

OK. das mit dem Clean Boot läuft jetzt gerade. Alles deaktiviert und (noch) keine Freezer.
Kann ich eigentlich alles deaktiviert lassen?

schrauber 20.09.2014 17:38
nein, das ist nur zum testen. Einzeln wieder aktivierne, immer rebooten dazwischen, bis er freezed, dann weißt du welcher Dienst es ist. Diesen hier nennen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:14 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131