Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Firefox & Chrome öffnen automatisch Seiten mit Werbung (https://www.trojaner-board.de/160213-firefox-chrome-oeffnen-automatisch-seiten-werbung.html)

Fatan1c 29.10.2014 20:24
Firefox & Chrome öffnen automatisch Seiten mit Werbung
 
Hallo Community,

da ich nach langer Suche nichts gefunden habe, wende ich mich nun an euch.
Mein Problem ist, das alle 5-15 Minuten sich automatisch Tabs bei Firefox & Google Chrome (je nach Verwendung) öffnen. :killpc:
Das geht schon seit 3-4 Tagen so.

Ich hoffe mir kann einer helfen. :rolleyes:

Gruß

schrauber 29.10.2014 20:29
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Fatan1c 29.10.2014 21:23
Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-10-2014 01
Ran by gogo72 at 2014-10-29 21:16:32
Running from C:\Users\gogo72\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BitTorrent (HKCU\...\BitTorrent) (Version: 7.9.2.34312 - BitTorrent Inc.)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.9.4.4078 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{152E0B21-19D5-4772-9EF8-8E76074B0C0A}) (Version: 0.9.4.4078 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
Chatango Message Catcher (HKLM-x32\...\Chatango) (Version:  - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
EdenEternal-DE (HKLM-x32\...\EdenEternal-DE) (Version:  - )
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
iOS6 Skin Pack 6.0-Win7X86 (HKLM-x32\...\iOS6 Skin Pack) (Version: 6.0-Win7X86 - skinpack)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.600 - Oracle)
Java SE Development Kit 7 Update 45 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0170450}) (Version: 1.7.0.450 - Oracle)
Java-Editor 12.4a, 2013.11.16 (HKLM-x32\...\{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1) (Version:  - Gerhard Röhner)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{307a22b8-8353-4c5e-b67b-2404c5734558}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MyPublicWiFi 5.1 (HKLM-x32\...\{C08D782B-9281-406B-ABCE-326DA70B8A1F}_is1) (Version:  - TRUE Software)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Oracle VM VirtualBox 4.3.12 (HKLM\...\{B5121457-0126-4E62-BCBF-6DC7C73D9E4A}) (Version: 4.3.12 - Oracle Corporation)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.990 - Even Balance, Inc.)
Quake Live (HKLM-x32\...\Quake Live) (Version:  - id Software)
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab CYRI (HKLM-x32\...\{19B0831B-0C18-4103-86E4-90FCD04CD3B9}) (Version: 6.0.12.5 - Husdawg, LLC)
System Requirements Lab Detection (HKLM-x32\...\{A407FC22-36BF-4C82-A516-59D94BC505A9}) (Version: 1.0.5.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Unity (HKLM-x32\...\Unity) (Version: 4.5.3f3 - Unity Technologies ApS)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)
UxStyle Core Beta (HKLM\...\{8E363055-15E5-4D8A-9C69-A0A9DE9A3337}) (Version: 0.2.1.1 - The Within Network, LLC)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Warsow 1.02 (HKLM-x32\...\{24508D50-EB8F-4FE6-B69D-B4935D8745EF}_is1) (Version: 1.02 - Chasseur de bots)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Utils (HKLM-x32\...\Windows Utils) (Version:  - )
Windows-Treiberpaket - MediaTek Inc. (usbser) Ports  (01/05/2012 2.0000.0.1) (HKLM\...\49D9ABA9270C5BDFD7AE1BEB607D36B26BB90235) (Version: 01/05/2012 2.0000.0.1 - MediaTek Inc.)
Windows-Treiberpaket - MediaTek Inc. (usbser) Ports  (12/24/2011 2.0000.0.0) (HKLM\...\D0E6296D177F42BB31C0200E49412003DB6C4633) (Version: 12/24/2011 2.0000.0.0 - MediaTek Inc.)
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
Xfire (HKLM-x32\...\Xfire) (Version:  - )
Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)
YGOPro DevPro Version 1.9.9 r0 (HKLM-x32\...\{3CF2634F-3F38-4DD3-9201-CB2FE6B5FF23}_is1) (Version: 1.9.9 r0 - YGOPro DevPro Online)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-10-2014 13:41:50 Gerätetreiber-Paketinstallation: Oracle Corporation USB-Controller
21-10-2014 13:43:44 Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkadapter
21-10-2014 13:44:58 Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkdienst
21-10-2014 17:58:07 Removed Aeria Ignite
21-10-2014 18:46:11 Removed Free FLAC Player.
21-10-2014 18:48:25 Removed LogMeIn Hamachi
22-10-2014 17:30:53 Removed Bonjour
27-10-2014 19:44:57 Installed iTunes

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {40A76D0B-8FA1-40DD-8241-CD5276792F09} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-27] (Google Inc.)
Task: {6C80201D-A447-43D1-86DD-62579B9829E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-27] (Google Inc.)
Task: {6D5D649A-AF0A-4E1D-8DA1-006B62D33FF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {BEC8C8B2-EAB9-4008-83AD-F3298113F94A} - System32\Tasks\{A8ECB17A-F26C-412E-8D26-6B1381B57DC2} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/fr/go/help.faq.installer?source=lightinstaller&LastError=1603
Task: {C52857C8-83EB-4858-84B4-10C6701188E4} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000UA => C:\Users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-12-12] (Facebook Inc.)
Task: {D3C6DE0F-84CC-4101-BE72-DB7428A802C1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000Core => C:\Users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-12-12] (Facebook Inc.)
Task: {E22EA6EF-F301-44E2-B38D-94AC087CB4E8} - System32\Tasks\{D0AAB920-5F48-43CF-A919-41B707A9B08B} => Firefox.exe hxxp://ui.skype.com/ui/0/6.11.0.102/de/abandoninstall?source=lightinstaller&page=tsPlugin
Task: {FF6025CE-8587-49DA-938F-E88EB952A72B} - System32\Tasks\{9F80810C-94A7-4C3C-8348-405638933109} => Firefox.exe hxxp://ui.skype.com/ui/0/6.18.0.106/de/abandoninstall?page=tsProgressBar
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000Core.job => C:\Users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000UA.job => C:\Users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-08-18 17:23 - 2014-04-20 21:29 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2007-09-02 11:28 - 2007-09-02 11:28 - 00495616 _____ () C:\Program Files (x86)\iOS6 Skin Pack\RocketDock\RocketDock.exe
2007-08-17 16:40 - 2007-08-17 16:40 - 00159744 _____ () C:\Program Files (x86)\iOS6 Skin Pack\UberIcon\UberIcon.exe
2014-10-08 10:15 - 2014-02-11 20:05 - 02006784 _____ () C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe
2014-09-01 17:54 - 2014-09-01 17:54 - 00819200 _____ () C:\Program Files (x86)\BlueStacks\HD-Adb.exe
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2007-03-10 04:09 - 2007-03-10 04:09 - 00090112 _____ () C:\Program Files (x86)\iOS6 Skin Pack\UberIcon\UberIcon.dll
2007-09-02 11:27 - 2007-09-02 11:27 - 00069632 _____ () C:\Program Files (x86)\iOS6 Skin Pack\RocketDock\RocketDock.dll
2012-06-14 21:11 - 2012-06-14 21:11 - 00325968 _____ () C:\ProgramData\Microsoft\Windows\Deep Layers\lua5.1.dll
2007-03-04 08:18 - 2007-03-04 08:18 - 00106496 _____ () C:\Program Files (x86)\iOS6 Skin Pack\RocketDock\Docklets\RocketClock\RocketClock.dll
2013-12-27 21:05 - 2013-12-04 03:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll
2013-12-27 21:05 - 2013-12-04 03:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll
2006-07-17 20:45 - 2006-07-17 20:45 - 00057344 _____ () C:\Program Files (x86)\iOS6 Skin Pack\UberIcon\Plugins\iZoom\fx.dll
2009-03-21 13:49 - 2009-03-21 13:49 - 00040960 _____ () C:\Program Files (x86)\iOS6 Skin Pack\YzShadow\Languages\English.lang
2013-12-27 21:05 - 2013-12-04 03:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll
2013-12-27 21:05 - 2013-12-04 03:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll
2013-12-27 21:05 - 2013-12-04 03:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll
2014-09-25 17:09 - 2014-09-25 17:10 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-09-10 14:17 - 2014-09-10 14:17 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UnsignedThemes => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UnsignedThemes => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-486250725-3488129294-1979160191-500 - Administrator - Disabled)
Gast (S-1-5-21-486250725-3488129294-1979160191-501 - Limited - Disabled) => C:\Users\Gast
gogo72 (S-1-5-21-486250725-3488129294-1979160191-1000 - Administrator - Enabled) => C:\Users\gogo72
HomeGroupUser$ (S-1-5-21-486250725-3488129294-1979160191-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/29/2014 02:54:10 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
  bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
  bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (10/29/2014 00:49:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9735

Error: (10/29/2014 00:49:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9735

Error: (10/29/2014 00:49:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/28/2014 08:51:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 28221

Error: (10/28/2014 08:51:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 28221

Error: (10/28/2014 08:51:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/28/2014 08:51:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 18970

Error: (10/28/2014 08:51:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 18970

Error: (10/28/2014 08:51:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (10/29/2014 09:01:49 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (10/29/2014 08:49:41 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (10/29/2014 05:03:22 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (10/29/2014 04:51:15 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (10/29/2014 02:56:45 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:

Error: (10/29/2014 02:54:10 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064

Error: (10/29/2014 02:52:43 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde nicht richtig gestartet.

Error: (10/29/2014 02:50:29 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (10/29/2014 02:50:29 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (10/29/2014 02:49:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: AMD V140 Processor
Percentage of memory in use: 84%
Total physical RAM: 1786.9 MB
Available physical RAM: 279.18 MB
Total Pagefile: 3622.55 MB
Available Pagefile: 1088.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:128.83 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 00026EBD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
FRST:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-10-2014 01
Ran by gogo72 (administrator) on GOGO72-PC on 29-10-2014 21:13:51
Running from C:\Users\gogo72\Downloads
Loaded Profile: gogo72 (Available profiles: gogo72 & Gast)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(The Within Network, LLC) C:\Windows\UnsignedThemesSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Pear Media, LLC) C:\Program Files (x86)\Chatango\Chatango.exe
(BitTorrent Inc.) C:\Users\gogo72\AppData\Roaming\BitTorrent\BitTorrent.exe
(Akamai Technologies, Inc.) C:\Users\gogo72\AppData\Local\Akamai\netsession_win.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Akamai Technologies, Inc.) C:\Users\gogo72\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows\Deep Layers\winver.exe
() C:\Program Files (x86)\iOS6 Skin Pack\RocketDock\RocketDock.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\iOS6 Skin Pack\UberIcon\UberIcon.exe
(Y'z) C:\Program Files (x86)\iOS6 Skin Pack\YzShadow\YzShadow.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe
() C:\Program Files (x86)\BlueStacks\HD-Adb.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Andy] => C:\Program Files\Andy\HandyAndy.exe
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKLM-x32\...\Run: [fst_de_83] => [X]
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [843480 2014-10-07] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [Chatango] => C:\Program Files (x86)\Chatango\Chatango.exe [356352 2008-02-05] (Pear Media, LLC)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [Facebook Update] => C:\Users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-12-12] (Facebook Inc.)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [BitTorrent] => C:\Users\gogo72\AppData\Roaming\BitTorrent\BitTorrent.exe [1387864 2014-10-08] (BitTorrent Inc.)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [Akamai NetSession Interface] => C:\Users\gogo72\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [EADM] => "C:\Users\Public\Desktop\Origin\Origin.exe" -AutoStart
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [Newgen] => C:\Program Files (x86)\UX Pack\Newgen\Newgen.exe
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [GoogleChromeAutoLaunch_7D189502060BFECD43FD4E4E986BA000] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863184 2013-12-04] (Google Inc.)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\Run: [winver.exe] => C:\ProgramData\Microsoft\Windows\Deep Layers\winver.exe [6786560 2014-09-15] (Microsoft Corporation)
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\MountPoints2: {21a455a7-47f3-11e4-8292-60eb69716ea7} - F:\LGAutoRun.exe
HKU\S-1-5-21-486250725-3488129294-1979160191-1000\...\MountPoints2: {7951f11a-a20b-11e3-aa1e-60eb69716ea7} - G:\FarCryAutoCD.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-10] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RocketDock.lnk
ShortcutTarget: RocketDock.lnk -> C:\Program Files (x86)\iOS6 Skin Pack\RocketDock\RocketDock.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SkinPackMenu.lnk
ShortcutTarget: SkinPackMenu.lnk -> C:\Program Files (x86)\iOS6 Skin Pack\SP.exe (skin pack)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UberIcon.lnk
ShortcutTarget: UberIcon.lnk -> C:\Program Files (x86)\iOS6 Skin Pack\UberIcon\UberIcon.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\YzShadow.lnk
ShortcutTarget: YzShadow.lnk -> C:\Program Files (x86)\iOS6 Skin Pack\YzShadow\YzShadow.exe (Y'z)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.windowsxlive.net
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE29DA9AA8B05CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - 14928C41D04A4046A4582C26016870C5 URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: No Name -> {0025320D-4D37-4C73-9A5C-0C28F04068A3} -> C:\Users\gogo72\AppData\LocalLow\IE-BHO\bho.dll No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {99CAAA27-FA0C-4FA4-B88A-4AB1CC7A17FE} hxxp://www.netgame.com/mplugin/mglaunch_USAv1005.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1selg9di.default-1413998799348
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nielsen/FirefoxTracker -> C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter1\FirefoxAddOns\npfirefoxtracker.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\gogo72\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\gogo72\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPMFireLauncher.dll (MGame)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1selg9di.default-1413998799348\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-10-23]
FF Extension: AdBan - C:\Users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1selg9di.default-1413998799348\Extensions\adban@ad-ban.appspot.com.xpi [2014-10-23]
FF Extension: Video Downloader professional - C:\Users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1selg9di.default-1413998799348\Extensions\ffext_basicvideoext@startpage24.xpi [2014-10-23]
FF Extension: Adblock Plus - C:\Users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1selg9di.default-1413998799348\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-23]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25]
FF HKLM-x32\...\Firefox\Extensions: [aa9.kkc@u-ouaio.com] - C:\Users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1ycwmfb4.default\extensions\aa9.kkc@u-ouaio.com
FF HKLM-x32\...\Firefox\Extensions: [netsight@nielsen.com] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter1\FirefoxAddOns\netsight@nielsen.xpi

Chrome:
=======
CHR Profile: C:\Users\gogo72\AppData\Local\Google\Chrome\User Data\default
CHR Extension: (Google Docs) - C:\Users\gogo72\AppData\Local\Google\Chrome\User Data\default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-27]
CHR Extension: (Google Wallet) - C:\Users\gogo72\AppData\Local\Google\Chrome\User Data\default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-11]
CHR Extension: (Gmail) - C:\Users\gogo72\AppData\Local\Google\Chrome\User Data\default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-27]
CHR Extension: (InstaSign) - C:\Users\gogo72\AppData\Local\Google\Chrome\User Data\default\Extensions\ppnoehogcmhfddmhadjngmcmemkjiegp [2014-08-27]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [409304 2014-10-07] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [388824 2014-10-07] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [782040 2014-10-07] (BlueStack Systems, Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4722728 2013-03-14] (INCA Internet Co., Ltd.) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-04-20] ()
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2014-10-17] (Microsoft Corporation) [File not signed]
R2 UnsignedThemes; C:\Windows\UnsignedThemesSvc.exe [24168 2009-07-13] (The Within Network, LLC)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-10-07] (BlueStack Systems)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-03-03] (Disc Soft Ltd)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52832 2013-10-31] (hxxp://libusb-win32.sourceforge.net)
R1 ndiskhaz; C:\Windows\System32\DRIVERS\ndiskhaz.sys [30536 2012-12-07] (Khalil Azzouzi)
S3 PVUSB; C:\Windows\System32\DRIVERS\CESG64.sys [63808 2007-02-19] (CASIO COMPUTER CO.,LTD.)
S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [145144 2013-11-07] (Ray Hinchliffe)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381440 2014-03-03] (Duplex Secure Ltd.)
R2 uxpatch; C:\Windows\system32\drivers\uxpatch.sys [30568 2009-07-13] ()
U3 au0z5g1o; C:\Windows\System32\Drivers\au0z5g1o.sys [0 ] (Advanced Micro Devices)
S3 AndNetDiag; system32\DRIVERS\lgandnetdiag64.sys [X]
S3 ANDNetModem; system32\DRIVERS\lgandnetmodem64.sys [X]
S3 AppObserver; \??\C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter1\appobserver64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 vdrive; system32\DRIVERS\vdrive.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 wolfkr; \??\C:\AeriaGames\WolfTeam-DE\avital\wolfk64.sys [X]
S3 XFDriver64; \??\C:\Program Files (x86)\Xfire2\XFDriver64.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-29 21:13 - 2014-10-29 21:15 - 00019526 _____ () C:\Users\gogo72\Downloads\FRST.txt
2014-10-29 21:13 - 2014-10-29 21:14 - 00000000 ____D () C:\FRST
2014-10-29 21:12 - 2014-10-29 21:12 - 02113536 _____ (Farbar) C:\Users\gogo72\Downloads\FRST64.exe
2014-10-29 14:43 - 2014-10-29 14:47 - 00000000 ____D () C:\AdwCleaner
2014-10-29 13:17 - 2014-10-29 13:34 - 00000000 ____D () C:\Users\gogo72\Desktop\FB Page Items
2014-10-28 18:35 - 2014-10-28 18:47 - 831821513 _____ () C:\Users\gogo72\Desktop\Die Superhomies in den USA - Lets Eat Fudge House FETT und Schokolade (mit Gronkh und Sarazar) - YouTube.mp4
2014-10-27 21:42 - 2014-10-27 21:42 - 00000000 ____D () C:\Users\gogo72\AppData\Local\Adobe
2014-10-27 20:53 - 2014-10-27 20:53 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-10-27 20:53 - 2014-10-27 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-10-27 20:51 - 2014-10-27 20:51 - 00000000 ____D () C:\Program Files\iPod
2014-10-27 20:50 - 2014-10-27 20:52 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-10-27 20:50 - 2014-10-27 20:52 - 00000000 ____D () C:\Program Files\iTunes
2014-10-27 20:42 - 2014-10-27 20:43 - 00000000 ____D () C:\Program Files\Bonjour
2014-10-27 20:42 - 2014-10-27 20:43 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-10-27 20:19 - 2014-10-27 20:22 - 122418480 _____ (Apple Inc.) C:\Users\gogo72\Downloads\iTunes64Setup.exe
2014-10-23 18:06 - 2014-10-23 18:06 - 00003382 _____ () C:\Users\gogo72\AppData\Local\recently-used.xbel
2014-10-23 18:06 - 2014-10-23 18:06 - 00000000 ____D () C:\Users\gogo72\AppData\Local\gtk-2.0
2014-10-23 18:06 - 2014-10-23 18:06 - 00000000 ____D () C:\Users\gogo72\.thumbnails
2014-10-23 17:41 - 2014-10-23 18:06 - 00000000 ____D () C:\Users\gogo72\.gimp-2.8
2014-10-23 17:41 - 2014-10-23 17:41 - 00000000 ____D () C:\Users\gogo72\AppData\Local\gegl-0.2
2014-10-23 17:30 - 2014-10-23 17:30 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-10-23 17:27 - 2014-10-23 17:29 - 00000000 ____D () C:\Program Files\GIMP 2
2014-10-23 17:23 - 2014-10-23 17:24 - 91670064 _____ (The GIMP Team ) C:\Users\gogo72\Downloads\gimp-2.8.14-setup.exe
2014-10-21 22:09 - 2014-10-22 18:50 - 00002124 _____ () C:\Users\gogo72\Desktop\Clash of Clans.lnk
2014-10-21 21:48 - 2014-10-21 21:48 - 00001807 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk
2014-10-21 21:47 - 2014-10-21 21:47 - 00001779 _____ () C:\Users\Public\Desktop\Apps.lnk
2014-10-21 21:46 - 2014-10-21 21:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks
2014-10-21 21:46 - 2014-10-21 21:46 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-10-21 21:46 - 2014-10-21 21:46 - 00000000 ____D () C:\Program Files (x86)\BlueStacks
2014-10-21 21:45 - 2014-10-21 21:45 - 00000000 ____D () C:\Users\gogo72\AppData\Local\Bluestacks
2014-10-21 21:43 - 2014-10-21 21:43 - 13444288 _____ (BlueStack Systems Inc.) C:\Users\gogo72\Downloads\BlueStacks-94SplitInstaller_native.exe
2014-10-21 18:27 - 2014-10-21 18:27 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Andy
2014-10-21 16:03 - 2014-10-21 21:06 - 00000000 ____D () C:\Users\gogo72\.VirtualBox
2014-10-21 16:03 - 2014-10-21 21:03 - 00000000 ____D () C:\Users\gogo72\VirtualBox VMs
2014-10-21 14:43 - 2014-10-21 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2014-10-21 14:43 - 2014-05-16 13:04 - 00254240 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-10-21 14:41 - 2014-10-21 14:41 - 00000000 ____D () C:\Program Files\Oracle
2014-10-21 14:41 - 2014-05-16 13:03 - 00128288 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-10-21 14:32 - 2014-10-21 18:15 - 01177208 _____ () C:\Users\gogo72\AppData\Roaming\AndyCleanupTool.exe
2014-10-21 14:32 - 2014-10-21 18:15 - 01176696 _____ () C:\Users\gogo72\AppData\Roaming\AndyCleanVM.exe
2014-10-17 21:55 - 2014-10-21 17:26 - 00000000 ____D () C:\Users\gogo72\Desktop\Bewerbungsunterlagen
2014-10-17 20:54 - 2014-10-17 20:54 - 00002697 _____ () C:\Users\gogo72\Desktop\Microsoft Office Word 2007.lnk
2014-10-17 20:54 - 2014-10-17 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-10-17 20:51 - 2014-10-17 20:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-10-17 20:50 - 2014-10-17 20:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-10-17 20:46 - 2014-10-17 20:46 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-10-17 20:46 - 2014-10-17 20:46 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-10-17 20:45 - 2014-10-17 20:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-10-17 20:41 - 2014-10-17 20:41 - 00000000 __RHD () C:\MSOCache
2014-10-17 16:43 - 2014-10-17 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iOS6 Skin Pack
2014-10-17 16:43 - 2014-10-17 16:45 - 00000000 ____D () C:\Program Files (x86)\Skin Pack
2014-10-17 16:42 - 2013-02-27 05:49 - 01795584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-17 16:42 - 2011-02-25 07:19 - 03094528 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-10-17 16:42 - 2010-11-20 13:21 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2014-10-17 16:42 - 2010-11-20 13:21 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVolSSO.dll
2014-10-17 16:42 - 2010-11-20 13:19 - 01492992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2014-10-17 16:42 - 2010-11-20 13:16 - 01046016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe
2014-10-17 16:42 - 2010-11-20 13:08 - 12503040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.dll
2014-10-17 16:42 - 2009-07-14 02:14 - 06620160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspaint.exe
2014-10-17 16:42 - 2009-07-14 02:14 - 00430592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2014-10-17 16:42 - 2009-07-14 02:06 - 25397760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imageres.dll
2014-10-17 16:42 - 2009-07-14 02:06 - 01474560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagesp1.dll
2014-10-17 16:41 - 2014-10-17 16:45 - 00000000 ____D () C:\Program Files (x86)\iOS6 Skin Pack
2014-10-17 16:41 - 2010-11-20 14:27 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll.backup
2014-10-17 16:41 - 2010-11-20 13:20 - 01011200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pnidui.dll
2014-10-17 16:41 - 2010-11-20 13:18 - 00740864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\batmeter.dll
2014-10-17 16:41 - 2010-11-20 13:18 - 00672768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll
2014-10-17 16:41 - 2009-07-14 02:41 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll.backup
2014-10-17 16:41 - 2009-07-14 02:41 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\themeservice.dll.backup
2014-10-17 16:29 - 2014-10-17 16:30 - 51596022 _____ () C:\Users\gogo72\Downloads\ios6_skin_pack_6_0_win7x86_by_spdownload-d5nily3.exe
2014-10-17 16:11 - 2014-10-17 16:33 - 00000000 ____D () C:\ProgramData\ReviverSoft
2014-10-17 16:11 - 2013-02-27 06:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-17 16:11 - 2010-11-20 14:27 - 01808384 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2014-10-17 16:11 - 2010-11-20 14:27 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-10-17 16:11 - 2010-11-20 14:27 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll
2014-10-17 16:11 - 2010-11-20 14:26 - 01866240 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2014-10-17 16:11 - 2010-11-20 14:25 - 00749568 _____ (Microsoft Corporation) C:\Windows\system32\batmeter.dll
2014-10-17 16:11 - 2010-11-20 14:25 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\taskmgr.exe
2014-10-17 16:11 - 2010-11-20 14:25 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-10-17 16:11 - 2009-07-14 02:38 - 01162240 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
2014-10-17 16:11 - 2009-07-14 02:28 - 20268032 _____ (Microsoft Corporation) C:\Windows\system32\imageres.dll
2014-10-17 15:52 - 2014-10-17 15:52 - 00003144 _____ () C:\Windows\System32\Tasks\{5E7A9D2B-CA0B-4500-9465-39FB7C69AD03}
2014-10-16 19:58 - 2014-10-27 20:50 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-10-16 06:23 - 2014-10-16 06:23 - 13357454 _____ () C:\Users\gogo72\Downloads\doulCi™ iCloud Activator Official For Windows  v1.0.14.rar
2014-10-15 22:57 - 2014-10-15 22:57 - 00712782 _____ () C:\Users\gogo72\Downloads\iCloudActivation.zip
2014-10-14 20:29 - 2014-10-14 20:29 - 00002503 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk
2014-10-14 20:28 - 2014-10-14 20:29 - 00000000 ____D () C:\Program Files (x86)\Safari
2014-10-13 23:16 - 2014-10-13 23:16 - 00705952 _____ () C:\Windows\Minidump\101414-25084-01.dmp
2014-10-13 19:52 - 2014-10-13 19:52 - 00121344 _____ (@saurabng but original will be by Doulci Team) C:\Users\gogo72\Downloads\Doulci Activat0r.exe
2014-10-13 19:34 - 2014-10-13 19:34 - 00750451 _____ () C:\Users\gogo72\Downloads\iCloud Bypass Activation Lock UPDATED.zip
2014-10-13 19:26 - 2014-10-13 19:26 - 00000000 ____D () C:\Users\gogo72\AppData\Local\Sparta
2014-10-10 23:29 - 2014-10-10 23:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_nnfwdk64_01009.Wdf
2014-10-10 23:22 - 2014-10-10 23:23 - 00000890 _____ () C:\nsinst.log
2014-10-09 23:27 - 2014-10-20 13:33 - 00000000 ___RD () C:\Users\gogo72\Desktop\Shindy - FBGM 2014
2014-10-09 22:33 - 2014-10-29 13:14 - 00000226 _____ () C:\Users\gogo72\BullseyeCoverageError.txt
2014-10-09 14:58 - 2014-10-09 14:58 - 00001001 _____ () C:\Users\gogo72\Desktop\MyPublicWiFi.lnk
2014-10-08 10:15 - 2014-10-08 10:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPublicWiFi
2014-10-08 10:15 - 2014-10-08 10:15 - 00000000 ____D () C:\Program Files (x86)\MyPublicWiFi
2014-10-08 10:15 - 2014-10-08 10:15 - 00000000 ____D () C:\864B69466849
2014-10-08 10:15 - 2012-12-07 09:28 - 00030536 _____ (Khalil Azzouzi) C:\Windows\system32\Drivers\ndiskhaz.sys
2014-10-08 08:45 - 2014-10-29 17:15 - 00000565 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-10-06 21:36 - 2014-10-06 21:36 - 00042152 _____ (Connectify) C:\Windows\system32\Drivers\cnnctfy3.sys
2014-10-06 21:34 - 2014-10-06 21:44 - 00000000 ____D () C:\ProgramData\Connectify
2014-10-06 20:22 - 2010-11-20 14:27 - 02652160 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2014-10-06 20:22 - 2010-11-20 14:27 - 00898560 _____ (Microsoft Corporation) C:\Windows\system32\oobefldr.dll
2014-10-06 20:22 - 2010-11-20 14:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\mydocs.dll
2014-10-06 20:22 - 2010-11-20 14:25 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2014-10-06 20:22 - 2010-11-20 14:24 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\msconfig.exe
2014-10-06 20:22 - 2009-07-14 02:39 - 06676480 _____ (Microsoft Corporation) C:\Windows\system32\mspaint.exe
2014-10-06 20:22 - 2009-07-14 02:39 - 00431104 _____ (Microsoft Corporation) C:\Windows\system32\snippingtool.exe
2014-10-06 20:22 - 2009-07-14 02:39 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2014-10-06 20:22 - 2009-07-14 02:28 - 00705536 _____ (Microsoft Corporation) C:\Windows\system32\imagesp1.dll
2014-10-06 20:21 - 2010-11-20 14:25 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\actioncenter.dll
2014-10-06 20:21 - 2010-11-20 14:24 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\cmd.exe
2014-10-06 20:21 - 2009-07-14 02:39 - 00183296 _____ (Microsoft Corp.) C:\Windows\system32\defrag.exe
2014-10-06 20:21 - 2009-07-14 02:39 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-10-06 20:21 - 2009-07-14 02:39 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\control.exe
2014-10-06 20:21 - 2009-07-14 02:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\dpiscaling.exe
2014-10-06 20:21 - 2009-07-14 02:38 - 00918528 _____ (Microsoft Corporation) C:\Windows\system32\calc.exe
2014-10-06 20:21 - 2009-07-14 02:14 - 00398336 _____ (Microsoft Corporation) C:\Windows\regedit.exe
2014-10-06 20:18 - 2003-08-19 00:44 - 00118845 _____ (Matt Ginzton) C:\Windows\Flurry.scr
2014-10-05 20:24 - 2014-10-05 20:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-10-05 20:24 - 2014-10-05 20:24 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-10-05 20:24 - 2014-10-05 20:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-10-05 15:22 - 2014-10-17 20:54 - 00000000 ____D () C:\Users\gogo72\Desktop\Filme
2014-10-01 17:33 - 2014-10-01 17:33 - 00003088 _____ () C:\Windows\System32\Tasks\{9F80810C-94A7-4C3C-8348-405638933109}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-29 21:15 - 2013-12-27 21:03 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-29 21:15 - 2013-08-19 05:54 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\BitTorrent
2014-10-29 21:14 - 2013-12-27 21:03 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-29 20:50 - 2014-07-19 04:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-29 20:37 - 2013-11-20 21:05 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000UA.job
2014-10-29 20:37 - 2013-11-20 21:05 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000Core.job
2014-10-29 18:19 - 2013-12-17 09:20 - 01172353 _____ () C:\Windows\WindowsUpdate.log
2014-10-29 17:34 - 2013-10-19 14:48 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\Skype
2014-10-29 15:02 - 2009-07-14 05:45 - 00019264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-29 15:02 - 2009-07-14 05:45 - 00019264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-29 14:57 - 2009-07-14 18:58 - 00702654 _____ () C:\Windows\system32\perfh007.dat
2014-10-29 14:57 - 2009-07-14 18:58 - 00150262 _____ () C:\Windows\system32\perfc007.dat
2014-10-29 14:57 - 2009-07-14 06:13 - 01627084 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-29 14:50 - 2013-08-13 08:20 - 00419792 _____ () C:\Windows\PFRO.log
2014-10-29 14:50 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-29 14:50 - 2009-07-14 05:51 - 00062810 _____ () C:\Windows\setupact.log
2014-10-28 18:41 - 2014-02-14 19:04 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\TS3Client
2014-10-27 20:52 - 2014-02-24 21:04 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-10-27 20:51 - 2013-12-18 20:43 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-10-26 22:47 - 2014-07-21 23:00 - 00000000 ____D () C:\Users\gogo72\Desktop\ASMR
2014-10-26 22:39 - 2013-11-24 12:13 - 00000000 ____D () C:\Users\gogo72\dwhelper
2014-10-26 20:01 - 2013-10-20 14:44 - 00000000 ____D () C:\Users\gogo72\AppData\Local\CrashDumps
2014-10-23 18:06 - 2013-12-17 10:35 - 00000000 ____D () C:\Users\gogo72
2014-10-22 18:34 - 2014-03-04 22:16 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\.minecraft
2014-10-21 21:53 - 2013-10-16 20:59 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2014-10-21 21:47 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-21 19:52 - 2014-02-12 19:23 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-10-21 19:52 - 2014-02-12 17:43 - 00000000 ____D () C:\AeriaGames
2014-10-21 19:00 - 2014-02-12 19:14 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-10-18 23:45 - 2013-12-22 20:51 - 00120024 _____ () C:\Users\gogo72\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-18 23:42 - 2009-07-14 05:45 - 00465840 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-18 22:53 - 2013-11-30 13:04 - 01647066 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-10-17 20:54 - 2013-08-10 14:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-17 20:51 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-10-17 20:50 - 2009-07-14 19:18 - 00000000 ____D () C:\Windows\ShellNew
2014-10-17 20:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-17 20:46 - 2009-07-14 03:34 - 00000580 _____ () C:\Windows\win.ini
2014-10-17 20:38 - 2013-12-16 20:33 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-17 20:36 - 2014-03-28 14:30 - 00000000 ____D () C:\ProgramData\Origin
2014-10-17 16:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors
2014-10-17 16:41 - 2013-07-31 19:33 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-10-17 16:41 - 2009-07-14 00:55 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-10-17 16:41 - 2009-07-14 00:54 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\themeservice.dll
2014-10-17 16:36 - 2014-07-05 16:27 - 00000000 ____D () C:\Windows\UXBackup
2014-10-17 16:35 - 2014-07-05 16:26 - 00000000 ____D () C:\Program Files (x86)\UX Pack
2014-10-17 16:33 - 2009-07-14 04:20 - 00000000 __RSD () C:\Windows\Media
2014-10-17 16:04 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-10-16 20:14 - 2014-09-17 04:14 - 00000000 ____D () C:\Users\gogo72\Desktop\Alpa Gun - Geboren um zu Sterben (2014)
2014-10-16 19:43 - 2013-11-24 20:01 - 00000000 ____D () C:\Users\gogo72\AppData\Local\Windows Live
2014-10-14 20:30 - 2013-12-18 20:47 - 00000000 ____D () C:\Users\gogo72\AppData\Roaming\Apple Computer
2014-10-14 20:30 - 2013-12-18 20:47 - 00000000 ____D () C:\Users\gogo72\AppData\Local\Apple Computer
2014-10-13 23:16 - 2013-11-24 22:52 - 00000000 ____D () C:\Windows\Minidump
2014-10-13 23:15 - 2013-11-24 22:52 - 256423323 _____ () C:\Windows\MEMORY.DMP
2014-10-10 19:36 - 2014-04-01 20:30 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-10-07 12:44 - 2013-07-31 22:01 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-07 12:44 - 2013-07-31 21:59 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-07 12:44 - 2013-07-31 21:59 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-06 21:24 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-04 16:15 - 2014-09-26 16:42 - 00000000 ____D () C:\ProgramData\LGMOBILEAX
2014-10-04 16:12 - 2014-09-26 16:42 - 00002411 _____ () C:\Windows\SysWOW64\lgAxconfig.ini
2014-10-04 15:20 - 2014-09-26 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool
2014-09-29 17:10 - 2014-01-04 17:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\gogo72\AppData\Local\Temp\14-4-mobility-win7-win8-win8.1-64-dd-ccc-whql.exe
C:\Users\gogo72\AppData\Local\Temp\2dfca53cc3596ed5281fc7433d1ad7ca.dll
C:\Users\gogo72\AppData\Local\Temp\704313d89020291976406f3232a2b5c3.dll
C:\Users\gogo72\AppData\Local\Temp\7z920.exe
C:\Users\gogo72\AppData\Local\Temp\Andy_v29.exe
C:\Users\gogo72\AppData\Local\Temp\app.exe
C:\Users\gogo72\AppData\Local\Temp\appshat-distribution.exe
C:\Users\gogo72\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\gogo72\AppData\Local\Temp\avgnt.exe
C:\Users\gogo72\AppData\Local\Temp\bi_cleaner.exe
C:\Users\gogo72\AppData\Local\Temp\BullseyeCoverage-2-x86.dll
C:\Users\gogo72\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\gogo72\AppData\Local\Temp\Delta.exe
C:\Users\gogo72\AppData\Local\Temp\DeltaTB.exe
C:\Users\gogo72\AppData\Local\Temp\dlLogic.exe
C:\Users\gogo72\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\gogo72\AppData\Local\Temp\fmp-2.0.7-win32.exe
C:\Users\gogo72\AppData\Local\Temp\FreeMahjong.exe
C:\Users\gogo72\AppData\Local\Temp\FreemakeVideoConverter_4.0.4.4.exe
C:\Users\gogo72\AppData\Local\Temp\fx6-ff-ie-gg-de-2014-10-15.exe
C:\Users\gogo72\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\gogo72\AppData\Local\Temp\IminentSetup_20130624.exe
C:\Users\gogo72\AppData\Local\Temp\installer_x64.exe
C:\Users\gogo72\AppData\Local\Temp\installer_x86.exe
C:\Users\gogo72\AppData\Local\Temp\InstallManager_GEN_GEN.exe
C:\Users\gogo72\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\gogo72\AppData\Local\Temp\mconduitinstaller.exe
C:\Users\gogo72\AppData\Local\Temp\mism.exe
C:\Users\gogo72\AppData\Local\Temp\MoviesToolbarSetup-Somoto.exe
C:\Users\gogo72\AppData\Local\Temp\MybabylonTB.exe
C:\Users\gogo72\AppData\Local\Temp\nsh8689.exe
C:\Users\gogo72\AppData\Local\Temp\nskB65E.exe
C:\Users\gogo72\AppData\Local\Temp\nsx158D.exe
C:\Users\gogo72\AppData\Local\Temp\OnlineWeatherSetup.exe
C:\Users\gogo72\AppData\Local\Temp\Play.exe
C:\Users\gogo72\AppData\Local\Temp\pricepeep_130001_0101.exe
C:\Users\gogo72\AppData\Local\Temp\propsys.dll
C:\Users\gogo72\AppData\Local\Temp\Quarantine.exe
C:\Users\gogo72\AppData\Local\Temp\sdan.exe
C:\Users\gogo72\AppData\Local\Temp\sdanircmdc.exe
C:\Users\gogo72\AppData\Local\Temp\sdapk.exe
C:\Users\gogo72\AppData\Local\Temp\sdapskill.exe
C:\Users\gogo72\AppData\Local\Temp\sdaspwn.exe
C:\Users\gogo72\AppData\Local\Temp\SearchProtectINT.exe
C:\Users\gogo72\AppData\Local\Temp\SIInvoker.exe
C:\Users\gogo72\AppData\Local\Temp\SkypeSetup.exe
C:\Users\gogo72\AppData\Local\Temp\sp-downloader.exe
C:\Users\gogo72\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\gogo72\AppData\Local\Temp\spstub.exe
C:\Users\gogo72\AppData\Local\Temp\sqlite3.dll
C:\Users\gogo72\AppData\Local\Temp\SRLDetectionLibrary3977430130730867468.dll
C:\Users\gogo72\AppData\Local\Temp\uninst1.exe
C:\Users\gogo72\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\gogo72\AppData\Local\Temp\vcredist_x86.exe
C:\Users\gogo72\AppData\Local\Temp\wajam_download.exe
C:\Users\gogo72\AppData\Local\Temp\WebLaunchInstaller.exe
C:\Users\gogo72\AppData\Local\Temp\WSSetup.exe
C:\Users\gogo72\AppData\Local\Temp\YgoUpdater.exe
C:\Users\gogo72\AppData\Local\Temp\yhiagvicbojqgn.exe
C:\Users\gogo72\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe
[2014-10-17 16:42] - [2011-02-25 07:19] - 3094528 ____A (Microsoft Corporation) E64E0A37B7CAEE47FF0AB10F5810C119

C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-19 12:57

==================== End Of Log ============================
--- --- ---

schrauber 30.10.2014 17:06
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Fatan1c 30.10.2014 19:53
Hey sorry das ich mich so spät melde, ich habe jetzt die genannte Datei heruntergeladen und alles so gemacht wie du es gesagt hast. Nur ich verstehe momentan nicht so ganz wie ich das als CODE-TAGS posten soll.

schrauber 31.10.2014 10:08
So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Fatan1c 31.10.2014 16:29
log

Code:
ComboFix 14-10-29.01 - gogo72 30.10.2014  19:03:25.1.1 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.1787.467 [GMT 1:00]
ausgeführt von:: c:\users\gogo72\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\Microsoft\Windows\Deep Layers
c:\programdata\Microsoft\Windows\Deep Layers\Icon.ico
c:\programdata\Microsoft\Windows\Deep Layers\lua5.1.dll
c:\programdata\Microsoft\Windows\Deep Layers\lua51.dll
c:\programdata\Microsoft\Windows\Deep Layers\Resource\dat01\ap1.dat
c:\programdata\Microsoft\Windows\Deep Layers\Resource\dat01\ap2.dat
c:\programdata\Microsoft\Windows\Deep Layers\Resource\dat01\ap3.dat
c:\programdata\Microsoft\Windows\Deep Layers\Resource\dat01\ap4.dat
c:\programdata\Microsoft\Windows\Deep Layers\Resource\dat01\ap5.dat
c:\programdata\Microsoft\Windows\Deep Layers\Resource\Icons\Icon.ico
c:\programdata\Microsoft\Windows\Deep Layers\winver.cdd
c:\programdata\Microsoft\Windows\Deep Layers\winver.exe
c:\users\Gast\AppData\Roaming\Origin
c:\users\Gast\AppData\Roaming\Origin\Cloud Saves\blacklist
c:\users\Gast\AppData\Roaming\Origin\local.xml
c:\windows\msdownld.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-09-28 bis 2014-10-30  ))))))))))))))))))))))))))))))
.
.
2014-10-30 18:16 . 2014-10-30 18:16        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2014-10-30 18:16 . 2014-10-30 18:16        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-10-29 20:13 . 2014-10-29 20:18        --------        d-----w-        C:\FRST
2014-10-29 13:43 . 2014-10-29 13:47        --------        d-----w-        C:\AdwCleaner
2014-10-27 20:42 . 2014-10-27 20:42        --------        d-----w-        c:\users\gogo72\AppData\Local\Adobe
2014-10-27 19:51 . 2014-10-27 19:51        --------        d-----w-        c:\program files\iPod
2014-10-27 19:50 . 2014-10-27 19:52        --------        d-----w-        c:\programdata\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-10-27 19:50 . 2014-10-27 19:52        --------        d-----w-        c:\program files\iTunes
2014-10-27 19:42 . 2014-10-27 19:43        --------        d-----w-        c:\program files (x86)\Bonjour
2014-10-27 19:42 . 2014-10-27 19:43        --------        d-----w-        c:\program files\Bonjour
2014-10-23 17:06 . 2014-10-23 17:06        --------        d-----w-        c:\users\gogo72\AppData\Local\gtk-2.0
2014-10-23 17:06 . 2014-10-23 17:06        --------        d-----w-        c:\users\gogo72\.thumbnails
2014-10-23 16:41 . 2014-10-23 16:41        --------        d-----w-        c:\users\gogo72\AppData\Local\fontconfig
2014-10-23 16:41 . 2014-10-23 17:06        --------        d-----w-        c:\users\gogo72\.gimp-2.8
2014-10-23 16:41 . 2014-10-23 16:41        --------        d-----w-        c:\users\gogo72\AppData\Local\gegl-0.2
2014-10-23 16:27 . 2014-10-23 16:29        --------        d-----w-        c:\program files\GIMP 2
2014-10-21 20:46 . 2014-10-21 20:46        --------        d-----w-        c:\programdata\BlueStacks
2014-10-21 20:46 . 2014-10-21 20:46        --------        d-----w-        c:\program files (x86)\BlueStacks
2014-10-21 20:45 . 2014-10-21 20:45        --------        d-----w-        c:\users\gogo72\AppData\Local\Bluestacks
2014-10-21 15:03 . 2014-10-21 20:03        --------        d-----w-        c:\users\gogo72\VirtualBox VMs
2014-10-21 15:03 . 2014-10-21 20:06        --------        d-----w-        c:\users\gogo72\.VirtualBox
2014-10-21 13:43 . 2014-05-16 12:04        254240        ----a-w-        c:\windows\system32\drivers\VBoxDrv.sys
2014-10-21 13:41 . 2014-05-16 12:03        128288        ----a-w-        c:\windows\system32\drivers\VBoxUSBMon.sys
2014-10-21 13:41 . 2014-10-21 13:41        --------        d-----w-        c:\program files\Oracle
2014-10-21 13:32 . 2014-10-21 17:15        1176696        ----a-w-        c:\users\gogo72\AppData\Roaming\AndyCleanVM.exe
2014-10-21 13:32 . 2014-10-21 17:15        1177208        ----a-w-        c:\users\gogo72\AppData\Roaming\AndyCleanupTool.exe
2014-10-17 19:51 . 2014-10-17 19:51        --------        d-----w-        c:\program files (x86)\Microsoft Works
2014-10-17 19:46 . 2014-10-17 19:46        --------        d-----w-        c:\program files\Microsoft Office
2014-10-17 19:46 . 2014-10-17 19:46        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 8
2014-10-17 19:41 . 2014-10-17 19:41        --------        d-----r-        C:\MSOCache
2014-10-17 15:43 . 2014-10-17 15:45        --------        d-----w-        c:\program files (x86)\Skin Pack
2014-10-17 15:41 . 2010-11-20 12:20        1011200        ----a-w-        c:\windows\SysWow64\pnidui.dll
2014-10-17 15:41 . 2010-11-20 12:18        740864        ----a-w-        c:\windows\SysWow64\batmeter.dll
2014-10-17 15:41 . 2010-11-20 12:18        672768        ----a-w-        c:\windows\SysWow64\ActionCenter.dll
2014-10-17 15:41 . 2009-07-14 01:41        44544        ----a-w-        c:\windows\system32\themeservice.dll.backup
2014-10-17 15:41 . 2010-11-20 13:27        2851840        ----a-w-        c:\windows\system32\themeui.dll.backup
2014-10-17 15:41 . 2009-07-14 01:41        332288        ----a-w-        c:\windows\system32\uxtheme.dll.backup
2014-10-17 15:41 . 2014-10-17 15:45        --------        d-----w-        c:\program files (x86)\iOS6 Skin Pack
2014-10-17 15:11 . 2009-07-14 01:38        1162240        ----a-w-        c:\windows\system32\wscui.cpl
2014-10-17 15:11 . 2010-11-20 13:27        257024        ----a-w-        c:\windows\system32\stobject.dll
2014-10-17 15:11 . 2010-11-20 13:25        257024        ----a-w-        c:\windows\system32\taskmgr.exe
2014-10-17 15:11 . 2010-11-20 13:27        225280        ----a-w-        c:\windows\system32\SndVolSSO.dll
2014-10-17 15:11 . 2010-11-20 13:27        1808384        ----a-w-        c:\windows\system32\pnidui.dll
2014-10-17 15:11 . 2009-07-14 01:28        20268032        ----a-w-        c:\windows\system32\imageres.dll
2014-10-17 15:11 . 2010-11-20 13:26        1866240        ----a-w-        c:\windows\system32\ExplorerFrame.dll
2014-10-17 15:11 . 2010-11-20 13:25        14336        ----a-w-        c:\windows\system32\browseui.dll
2014-10-17 15:11 . 2013-02-27 05:48        1930752        ----a-w-        c:\windows\system32\authui.dll
2014-10-17 15:11 . 2010-11-20 13:25        749568        ----a-w-        c:\windows\system32\batmeter.dll
2014-10-17 15:11 . 2014-10-17 15:33        --------        d-----w-        c:\programdata\ReviverSoft
2014-10-16 18:58 . 2014-10-27 19:50        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-10-14 19:28 . 2014-10-14 19:29        --------        d-----w-        c:\program files (x86)\Safari
2014-10-13 18:26 . 2014-10-13 18:26        --------        d-----w-        c:\users\gogo72\AppData\Local\Sparta
2014-10-08 09:15 . 2014-10-08 09:15        --------        d-----w-        C:\864B69466849
2014-10-08 09:15 . 2012-12-07 08:28        30536        ----a-w-        c:\windows\system32\drivers\ndiskhaz.sys
2014-10-08 09:15 . 2014-10-08 09:15        --------        d-----w-        c:\program files (x86)\MyPublicWiFi
2014-10-06 20:36 . 2014-10-06 20:36        42152        ----a-w-        c:\windows\system32\drivers\cnnctfy3.sys
2014-10-06 20:34 . 2014-10-06 20:44        --------        d-----w-        c:\programdata\Connectify
2014-10-06 19:22 . 2010-11-20 13:25        296960        ----a-w-        c:\windows\system32\rstrui.exe
2014-10-06 19:22 . 2009-07-14 01:39        431104        ----a-w-        c:\windows\system32\snippingtool.exe
2014-10-06 19:22 . 2010-11-20 13:27        898560        ----a-w-        c:\windows\system32\oobefldr.dll
2014-10-06 19:22 . 2009-07-14 01:39        193536        ----a-w-        c:\windows\system32\notepad.exe
2014-10-06 19:22 . 2010-11-20 13:27        2652160        ----a-w-        c:\windows\system32\netshell.dll
2014-10-06 19:22 . 2010-11-20 13:27        143360        ----a-w-        c:\windows\system32\mydocs.dll
2014-10-06 19:22 . 2009-07-14 01:39        6676480        ----a-w-        c:\windows\system32\mspaint.exe
2014-10-06 19:22 . 2010-11-20 13:24        300032        ----a-w-        c:\windows\system32\msconfig.exe
2014-10-06 19:22 . 2009-07-14 01:28        705536        ----a-w-        c:\windows\system32\imagesp1.dll
2014-10-06 19:21 . 2009-07-14 01:39        77312        ----a-w-        c:\windows\system32\dpiscaling.exe
2014-10-06 19:21 . 2009-07-14 01:39        183296        ----a-w-        c:\windows\system32\defrag.exe
2014-10-06 19:21 . 2009-07-14 01:39        114688        ----a-w-        c:\windows\system32\control.exe
2014-10-06 19:21 . 2010-11-20 13:24        345088        ----a-w-        c:\windows\system32\cmd.exe
2014-10-06 19:21 . 2009-07-14 01:39        165888        ----a-w-        c:\windows\system32\charmap.exe
2014-10-06 19:21 . 2009-07-14 01:38        918528        ----a-w-        c:\windows\system32\calc.exe
2014-10-06 19:21 . 2010-11-20 13:25        780800        ----a-w-        c:\windows\system32\actioncenter.dll
2014-10-06 19:21 . 2009-07-14 01:14        398336        ------w-        c:\windows\regedit.exe
2014-10-06 19:21 . 2010-11-20 13:25        1475584        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe
2014-10-06 19:21 . 2010-11-20 13:25        167424        ----a-w-        c:\program files\Windows Media Player\wmplayer.exe
2014-10-06 19:18 . 2003-08-18 23:44        118845        ----a-w-        c:\windows\Flurry.scr
2014-10-05 19:24 . 2014-10-05 19:24        --------        d-----w-        c:\program files\Microsoft Silverlight
2014-10-05 19:24 . 2014-10-05 19:24        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-17 15:41 . 2009-07-13 23:54        44544        ----a-w-        c:\windows\system32\themeservice.dll
2014-10-17 15:41 . 2013-07-31 18:33        2851840        ----a-w-        c:\windows\system32\themeui.dll
2014-10-17 15:41 . 2009-07-13 23:55        332288        ----a-w-        c:\windows\system32\uxtheme.dll
2014-10-07 11:44 . 2013-07-31 21:01        43064        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2014-10-07 11:44 . 2013-07-31 20:59        131608        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2014-10-07 11:44 . 2013-07-31 20:59        119272        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2014-09-10 13:17 . 2014-07-19 03:47        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-10 13:17 . 2014-07-19 03:47        701104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-01 09:39 . 2012-07-17 13:37        23256        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . E38899074D4951D31B4040E994DD7C8D . 2870784 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[-] 2011-02-25 . E64E0A37B7CAEE47FF0AB10F5810C119 . 3094528 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[7] 2009-10-31 . B8EC4BD49CE8F6FC457721BFC210B67F . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[7] 2009-10-31 . 9AAAEC8DAC27AA17B053E6352AD233AE . 2870272 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[7] 2009-08-03 . 700073016DAC1C3D2E7E2CE4223334B6 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[7] 2009-08-03 . F170B4A061C9E026437B193B4D571799 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[7] 2009-07-14 . C235A51CB740E45FFA0EBFB9BAFCDA64 . 2868224 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
.
[7] 2013-08-12 . 30E7CA4620500FE012EB464F0E1DE91E . 770648 . . [10.00.9200.16635] .. c:\windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16635_none_20da757e52a1c35e\iexplore.exe
[7] 2013-07-31 . EE12BA876C4190532A4085994BA9B616 . 757400 . . [9.00.8112.16496] .. c:\windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16496_none_176296ebb4fe8ec4\iexplore.exe
[7] 2013-03-04 . 050A612C1CE0C7095CAD64EA32C570DB . 672928 . . [8.00.7600.21484] .. c:\windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21484_none_1a42c5438bf82907\iexplore.exe
[7] 2013-03-02 . 58D926F3B2113BF849162C9C26FE21DC . 672912 . . [8.00.7600.17267] .. c:\windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.17267_none_19d1c74872c7a039\iexplore.exe
[7] 2010-11-20 . C613E69C3B191BB02C7A191741A1D024 . 673040 . . [8.00.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[7] 2009-07-14 . 2C32E3E596CFE660353753EABEFB0540 . 673048 . . [8.00.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Chatango"="c:\program files (x86)\Chatango\Chatango.exe" [2008-02-05 356352]
"BitTorrent"="c:\users\gogo72\AppData\Roaming\BitTorrent\BitTorrent.exe" [2014-10-08 1387864]
"Akamai NetSession Interface"="c:\users\gogo72\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-10-28 3675352]
"GoogleChromeAutoLaunch_7D189502060BFECD43FD4E4E986BA000"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2013-12-04 863184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-10-07 703736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-05-07 256896]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"BlueStacks Agent"="c:\program files (x86)\BlueStacks\HD-Agent.exe" [2014-10-07 843480]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock.lnk - c:\program files (x86)\iOS6 Skin Pack\RocketDock\RocketDock.exe [2007-9-2 495616]
SkinPackMenu.lnk - c:\program files (x86)\iOS6 Skin Pack\SP.exe [2012-2-22 1696493]
UberIcon.lnk - c:\program files (x86)\iOS6 Skin Pack\UberIcon\UberIcon.exe [2007-8-17 159744]
YzShadow.lnk - c:\program files (x86)\iOS6 Skin Pack\YzShadow\YzShadow.exe [2009-3-21 184320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UnsignedThemes]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 AppObserver;Application creation observer;c:\program files (x86)\NetRatingsNetSight\NetSight\meter1\appobserver64.sys;c:\program files (x86)\NetRatingsNetSight\NetSight\meter1\appobserver64.sys [x]
R3 libusb0;libusb-win32 - Kernel Driver 10/31/2013 0.0.0.0;c:\windows\system32\DRIVERS\libusb0.sys;c:\windows\SYSNATIVE\DRIVERS\libusb0.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys;c:\windows\SYSNATIVE\DRIVERS\pneteth.sys [x]
R3 PVUSB;CESG502 64bit USB Driver;c:\windows\system32\DRIVERS\CESG64.sys;c:\windows\SYSNATIVE\DRIVERS\CESG64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SIVDriver;SIV Kernel Driver;c:\windows\system32\Drivers\SIVX64.sys;c:\windows\SYSNATIVE\Drivers\SIVX64.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 vdrive;vdrive;c:\windows\system32\DRIVERS\vdrive.sys;c:\windows\SYSNATIVE\DRIVERS\vdrive.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 wolfkr;wolfkr;c:\aeriagames\WolfTeam-DE\avital\wolfk64.sys;c:\aeriagames\WolfTeam-DE\avital\wolfk64.sys [x]
R3 XFDriver64;XFDriver64;c:\program files (x86)\Xfire2\XFDriver64.sys;c:\program files (x86)\Xfire2\XFDriver64.sys [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 ndiskhaz;Azzouzi HotSpot LightWeight Filter;c:\windows\system32\DRIVERS\ndiskhaz.sys;c:\windows\SYSNATIVE\DRIVERS\ndiskhaz.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
S2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 UnsignedThemes;Unsigned Themes;c:\windows\UnsignedThemesSvc.exe;c:\windows\UnsignedThemesSvc.exe [x]
S2 uxpatch;uxpatch;c:\windows\system32\drivers\uxpatch.sys;c:\windows\SYSNATIVE\drivers\uxpatch.sys [x]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-27 20:04        1210320        ----a-w-        c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-19 13:17]
.
2014-10-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000Core.job
- c:\users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-11-20 19:31]
.
2014-10-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-486250725-3488129294-1979160191-1000UA.job
- c:\users\gogo72\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-11-20 19:31]
.
2014-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-27 20:03]
.
2014-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-27 20:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.windowsxlive.net
uDefault_Search_URL = hxxp://www.google.com
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Bar = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: aeriagames.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\gogo72\AppData\Roaming\Mozilla\Firefox\Profiles\1selg9di.default-1413998799348\
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{0025320D-4D37-4C73-9A5C-0C28F04068A3} - c:\users\gogo72\AppData\LocalLow\IE-BHO\bho.dll
Wow6432Node-HKCU-Run-EADM - c:\users\Public\Desktop\Origin\Origin.exe
Wow6432Node-HKCU-Run-Newgen - c:\program files (x86)\UX Pack\Newgen\Newgen.exe
Wow6432Node-HKCU-Run-winver.exe - c:\programdata\Microsoft\Windows\Deep Layers\winver.exe
Wow6432Node-HKLM-Run-DivXMediaServer - c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
Wow6432Node-HKLM-Run-fst_de_83 - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-Andy - c:\program files\Andy\HandyAndy.exe
AddRemove-PunkBusterSvc - c:\program files (x86)\EA Games\Battlefield Play4Free\pbsvc_p4f.exe
AddRemove-Windows Utils - c:\users\gogo72\AppData\Roaming\Windows Net Data\uninstaller.exe
AddRemove-UnityWebPlayer - c:\users\gogo72\AppData\Local\Unity\WebPlayer\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-10-30  19:20:28
ComboFix-quarantined-files.txt  2014-10-30 18:20
.
Vor Suchlauf: 17 Verzeichnis(se), 137.898.156.032 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 143.924.953.088 Bytes frei
.
- - End Of File - - 67733B6BAC725E80BC7735243BC45155
A36C5E4F47E84449FF07ED3517B43A31

schrauber 01.11.2014 12:20
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:17 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131