Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Problem mit "Coupondropdown und ism.sitescout.com popups"

Problem mit "Coupondropdown und ism.sitescout.com popups"


Log-Analyse und Auswertung: Problem mit "Coupondropdown und ism.sitescout.com popups"

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Seite 1 von 2 1 2
Alt 21.07.2013, 17:29   #1
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Cool

Problem mit "Coupondropdown und ism.sitescout.com popups"


Hallo Leute,

als Neuling in diesem Forum möchte ich Euch grüßen!

Seit einigen Tagen habe ich das Problem, dass wenn ich ganz normal im Internet unterwegs bin, sich plötzlich im Hintergrund ein neues Fenster aufmacht mit: ism.sitescout.com !

Habe bereits alles versucht außer dem Bereinigungsprogramm: "Spyhunter", da mir dieses von anderen Seiten, davon abgeraten wurde. So bin ich auf Eure Seite gestoßen und erhoffe mir von Euch Hilfe, da ich selbst zu den eher bezeichneten Anfängern gehöre. Daher wäre es super, wenn mir derjenige der mir zurückantwortet, nicht mit fachmännischen Vorgehensweisen oder Ausdrücken kommt!

Vielen Dank Euch schon mal im Voraus!!

MfG
Ecksperts

(aber vorsicht, ist`cool man!! )

Alt 21.07.2013, 18:02   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 21.07.2013, 18:16   #3
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


FRST.txt
FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-07-2013
Ran by Ecksperts (administrator) on 21-07-2013 19:07:44
Running from C:\Users\Ecksperts\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5KUP07ZC
Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
(Mozilla Corporation) C:\Program Files (x86)\mozilla firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Farbar) C:\Users\Ecksperts\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5KUP07ZC\FRST64[1].exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [367016 2013-06-26] (IncrediMail, Ltd.)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2012-12-13] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-07-19] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = Google
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Videoraptor_WebRipPlugin Class - {3C0372C2-04C3-4100-BAB1-1D42C552BC48} - C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\IE\VR_WebRipIePlugin.dll (RapidSolution Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default
FF Homepage: hxxp://www.google.de/firefox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @innoplus.de/ino3DViewer - C:\Program Files (x86)\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll (INNOVA-engineering GmbH Dresden)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Ghostery - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\firefox@ghostery.com
FF Extension: Yahoo! Toolbar - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: clearConsole - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\clearConsole@penzil.com.xpi
FF Extension: ftdownloader3 - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\ftdownloader3@ftdownloader.com.xpi
FF Extension: jid0-hjoQNmABq6jg91jHpQyvgJUouUP - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi
FF Extension: nbthemes - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\nbthemes@narutoboards.xpi
FF Extension: torntv2 - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\torntv2@torntv.com.xpi
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [videoraptor-firefox-surf-and-catch-extension@audials.com] C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\
FF Extension: Videoraptor Firefox Surf and Catch Plugin - C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-19] (Avira Operations GmbH & Co. KG)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-12-13] (Kaspersky Lab ZAO)
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-05-24] ()
S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2012-11-28] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2013-04-25] (WiseCleaner.com)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-07-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-07-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-07-19] (Avira Operations GmbH & Co. KG)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2009-01-23] (Brother Industries Ltd.)
R3 FET5A64; C:\Windows\System32\DRIVERS\fet5a64.sys [49024 2006-09-18] (VIA Technologies, Inc.              )
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-23] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1418112 2007-04-03] (Philips Semiconductors GmbH)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
R3 cpuz134; \??\C:\Users\ECKSPE~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 gfiark; system32\drivers\gfiark.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-21 16:37 - 2013-07-21 16:40 - 00000162 _____ C:\Windows\Reimage.ini
2013-07-21 00:36 - 2013-07-21 00:36 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Panasonic
2013-07-21 00:33 - 2013-07-21 00:36 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Lumix Bildbearbeitg
2013-07-21 00:32 - 2013-07-21 00:32 - 00000000 ____D C:\Program Files (x86)\ISL
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\Users\ECKSPE~1\AppData\Local\{B96D1B84-189C-4535-8C31-7517D6A8D074}
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 00:27 - 2005-06-01 04:10 - 00495616 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICSDK2.dll
2013-07-21 00:27 - 2005-06-01 03:10 - 00077824 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICEntry.dll
2013-07-21 00:27 - 2005-06-01 00:30 - 00000097 _____ C:\Windows\SysWOW64\PICSDK.ini
2013-07-21 00:27 - 2005-06-01 00:20 - 00111932 _____ C:\Windows\SysWOW64\EPPICPrinterDB.dat
2013-07-21 00:27 - 2005-06-01 00:10 - 00073728 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICSDK.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00114688 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\EpPicPrt.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00065536 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\EPPicMgr.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00031053 _____ C:\Windows\SysWOW64\EPPICPattern131.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00027417 _____ C:\Windows\SysWOW64\EPPICPattern121.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00026154 _____ C:\Windows\SysWOW64\EPPICPattern1.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00024903 _____ C:\Windows\SysWOW64\EPPICPattern3.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00021390 _____ C:\Windows\SysWOW64\EPPICPattern5.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00020148 _____ C:\Windows\SysWOW64\EPPICPattern2.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00013732 _____ C:\Windows\SysWOW64\EPPICLocal_EN.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00011811 _____ C:\Windows\SysWOW64\EPPICPattern4.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00006442 _____ C:\Windows\SysWOW64\EPPICLocal_IT.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006347 _____ C:\Windows\SysWOW64\EPPICLocal_PT.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006347 _____ C:\Windows\SysWOW64\EPPICLocal_BP.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006335 _____ C:\Windows\SysWOW64\EPPICLocal_GE.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006195 _____ C:\Windows\SysWOW64\EPPICLocal_FR.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006195 _____ C:\Windows\SysWOW64\EPPICLocal_CF.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006122 _____ C:\Windows\SysWOW64\EPPICLocal_DU.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006103 _____ C:\Windows\SysWOW64\EPPICLocal_ES.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00005817 _____ C:\Windows\SysWOW64\EPPICLocal_KO.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00005436 _____ C:\Windows\SysWOW64\EPPICLocal_SC.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00004943 _____ C:\Windows\SysWOW64\EPPICPattern6.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00002889 _____ C:\Windows\SysWOW64\EPPICLocal_RU.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00002426 _____ C:\Windows\SysWOW64\EPPICLocal_TC.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00001146 _____ C:\Windows\SysWOW64\EPPICPresetData_DU.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001139 _____ C:\Windows\SysWOW64\EPPICPresetData_PT.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001139 _____ C:\Windows\SysWOW64\EPPICPresetData_BP.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001136 _____ C:\Windows\SysWOW64\EPPICPresetData_ES.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001129 _____ C:\Windows\SysWOW64\EPPICPresetData_FR.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001129 _____ C:\Windows\SysWOW64\EPPICPresetData_CF.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001120 _____ C:\Windows\SysWOW64\EPPICPresetData_IT.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001107 _____ C:\Windows\SysWOW64\EPPICPresetData_GE.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001104 _____ C:\Windows\SysWOW64\EPPICPresetData_EN.dat
2013-07-21 00:26 - 2013-07-21 00:28 - 00000000 ____D C:\Program Files (x86)\Panasonic
2013-07-21 00:26 - 2005-03-07 19:44 - 00045056 _____ (Matsushita Electric Industrial Co., Ltd.) C:\Windows\SysWOW64\PhDi2.sys
2013-07-20 19:45 - 2013-07-20 19:45 - 00000000 ____D C:\Users\Ecksperts\Desktop\Sergej_Hamm
2013-07-20 19:38 - 2013-07-20 19:42 - 00000000 ____D C:\Windows\system32\MRT
2013-07-19 01:16 - 2013-07-19 01:16 - 00004437 _____ C:\AdwCleaner[S17].txt
2013-07-19 01:14 - 2013-07-19 01:15 - 00004224 _____ C:\AdwCleaner[R17].txt
2013-07-19 01:11 - 2013-07-19 01:11 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Avira
2013-07-19 01:07 - 2013-07-19 01:35 - 00001901 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-19 01:06 - 2013-07-19 01:06 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-19 01:06 - 2013-07-19 01:01 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-19 01:06 - 2013-07-19 01:01 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-19 01:06 - 2013-07-19 01:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-18 08:52 - 2013-07-21 16:24 - 00154151 _____ C:\Windows\WindowsUpdate.log
2013-07-18 08:48 - 2013-07-19 01:18 - 00081850 _____ C:\Windows\PFRO.log
2013-07-18 01:23 - 2013-07-19 01:35 - 00000000 ____D C:\ProgramData\Avira
2013-07-17 22:12 - 2013-07-17 22:12 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-07-17 22:11 - 2013-07-18 08:48 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-07-17 22:00 - 2013-07-17 22:00 - 00000000 ____D C:\FRST
2013-07-16 21:05 - 2013-07-16 21:05 - 00003825 _____ C:\AdwCleaner[S16].txt
2013-07-16 21:04 - 2013-07-16 21:05 - 00003618 _____ C:\AdwCleaner[R16].txt
2013-07-16 20:59 - 2013-07-16 21:00 - 00005378 _____ C:\AdwCleaner[S15].txt
2013-07-16 20:59 - 2013-07-16 20:59 - 00005159 _____ C:\AdwCleaner[R15].txt
2013-07-16 20:58 - 2013-07-16 20:58 - 00662345 _____ C:\Users\Ecksperts\Desktop\AdwCleaner.exe
2013-07-13 19:03 - 2013-07-13 19:05 - 37257216 _____ C:\Windows\system32\config\COMPONENTS.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00180224 _____ C:\Windows\system32\config\DEFAULT.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00057344 _____ C:\Windows\system32\config\SAM.rhk
2013-07-13 19:00 - 2013-07-13 19:03 - 65347584 _____ C:\Windows\system32\config\SOFTWARE.rhk
2013-07-13 19:00 - 2013-07-13 19:00 - 00024576 _____ C:\Windows\system32\config\SECURITY.rhk
2013-07-13 08:50 - 2013-07-13 08:50 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 12:46 - 2013-07-12 13:11 - 00000000 ____D C:\Users\Ecksperts\Desktop\Neuer Ordner (4)
2013-07-07 06:31 - 2013-07-07 06:33 - 00000000 __SHD C:\WISE_DISKSCRUBTEMP_NTFS
2013-07-05 20:18 - 2013-07-05 20:18 - 00004033 _____ C:\AdwCleaner[S14].txt
2013-07-05 20:17 - 2013-07-05 20:18 - 00003832 _____ C:\AdwCleaner[R14].txt
2013-07-01 21:59 - 2013-07-01 22:00 - 00003844 _____ C:\AdwCleaner[S13].txt
2013-07-01 21:59 - 2013-07-01 21:59 - 00003643 _____ C:\AdwCleaner[R13].txt
2013-06-30 18:35 - 2013-06-30 18:35 - 00003513 _____ C:\AdwCleaner[S12].txt
2013-06-30 18:34 - 2013-06-30 18:35 - 00003301 _____ C:\AdwCleaner[R12].txt
2013-06-30 12:06 - 2013-06-30 12:21 - 00000000 ____D C:\ProgramData\eSafe
2013-06-30 12:06 - 2013-06-30 12:12 - 00010792 _____ C:\AdwCleaner[S11].txt
2013-06-30 12:05 - 2013-06-30 12:06 - 00000000 ____D C:\Program Files (x86)\Desk 365
2013-06-30 12:04 - 2013-06-30 12:05 - 00010846 _____ C:\AdwCleaner[R11].txt
2013-06-30 12:04 - 2013-06-30 12:04 - 00000000 ____D C:\Program Files (x86)\WebCake
2013-06-26 17:18 - 2013-06-26 17:18 - 00000000 ____D C:\Program Files (x86)\IncrediMail
2013-06-26 10:47 - 2013-06-26 11:10 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-26 10:47 - 2013-06-26 11:10 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-26 08:48 - 2013-07-11 21:00 - 00000394 _____ C:\Windows\Tasks\RegTask.job
2013-06-26 08:48 - 2013-06-26 10:28 - 00000000 ____D C:\Program Files (x86)\RegTask
2013-06-26 08:48 - 2013-06-26 10:27 - 00000000 ____D C:\ProgramData\RegTask
2013-06-26 08:48 - 2013-06-26 10:11 - 00003602 _____ C:\Windows\System32\Tasks\RegTask
2013-06-25 20:06 - 2013-07-16 20:40 - 00000000 ____D C:\Program Files (x86)\mozilla firefox

==================== One Month Modified Files and Folders =======

2013-07-21 19:03 - 2012-02-02 13:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-21 18:14 - 2006-11-02 17:22 - 00003264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-21 18:14 - 2006-11-02 17:22 - 00003264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-21 16:40 - 2013-07-21 16:37 - 00000162 _____ C:\Windows\Reimage.ini
2013-07-21 16:24 - 2013-07-18 08:52 - 00154151 _____ C:\Windows\WindowsUpdate.log
2013-07-21 16:19 - 2012-02-02 11:49 - 00109816 _____ C:\Users\ECKSPE~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-21 16:18 - 2013-05-26 11:59 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Wise Care 365
2013-07-21 16:14 - 2006-11-02 17:21 - 00400320 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-21 00:36 - 2013-07-21 00:36 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Panasonic
2013-07-21 00:36 - 2013-07-21 00:33 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Lumix Bildbearbeitg
2013-07-21 00:36 - 2012-02-04 17:11 - 00000888 _____ C:\Windows\BRWMARK.INI
2013-07-21 00:32 - 2013-07-21 00:32 - 00000000 ____D C:\Program Files (x86)\ISL
2013-07-21 00:32 - 2012-02-03 00:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\Users\ECKSPE~1\AppData\Local\{B96D1B84-189C-4535-8C31-7517D6A8D074}
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 00:28 - 2013-07-21 00:26 - 00000000 ____D C:\Program Files (x86)\Panasonic
2013-07-20 19:45 - 2013-07-20 19:45 - 00000000 ____D C:\Users\Ecksperts\Desktop\Sergej_Hamm
2013-07-20 19:42 - 2013-07-20 19:38 - 00000000 ____D C:\Windows\system32\MRT
2013-07-19 01:35 - 2013-07-19 01:07 - 00001901 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-19 01:35 - 2013-07-18 01:23 - 00000000 ____D C:\ProgramData\Avira
2013-07-19 01:18 - 2013-07-18 08:48 - 00081850 _____ C:\Windows\PFRO.log
2013-07-19 01:16 - 2013-07-19 01:16 - 00004437 _____ C:\AdwCleaner[S17].txt
2013-07-19 01:16 - 2013-02-24 13:01 - 00019433 _____ C:\Windows\DeleteOnReboot.bat
2013-07-19 01:15 - 2013-07-19 01:14 - 00004224 _____ C:\AdwCleaner[R17].txt
2013-07-19 01:11 - 2013-07-19 01:11 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Avira
2013-07-19 01:06 - 2013-07-19 01:06 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-19 01:01 - 2013-07-19 01:06 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-19 01:01 - 2013-07-19 01:06 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-19 01:01 - 2013-07-19 01:06 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-18 08:48 - 2013-07-17 22:11 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-07-18 01:58 - 2006-11-02 17:42 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-18 01:57 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-17 22:12 - 2013-07-17 22:12 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-07-17 22:00 - 2013-07-17 22:00 - 00000000 ____D C:\FRST
2013-07-17 19:18 - 2013-05-26 15:58 - 00000420 _____ C:\Windows\Tasks\Wise Care 365 PC Checkup Task.job
2013-07-17 13:30 - 2012-11-28 02:28 - 00002641 _____ C:\Users\Ecksperts\Desktop\Microsoft Word 2010.lnk
2013-07-16 21:05 - 2013-07-16 21:05 - 00003825 _____ C:\AdwCleaner[S16].txt
2013-07-16 21:05 - 2013-07-16 21:04 - 00003618 _____ C:\AdwCleaner[R16].txt
2013-07-16 21:00 - 2013-07-16 20:59 - 00005378 _____ C:\AdwCleaner[S15].txt
2013-07-16 20:59 - 2013-07-16 20:59 - 00005159 _____ C:\AdwCleaner[R15].txt
2013-07-16 20:58 - 2013-07-16 20:58 - 00662345 _____ C:\Users\Ecksperts\Desktop\AdwCleaner.exe
2013-07-16 20:57 - 2013-04-22 13:19 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Cleaner
2013-07-16 20:54 - 2013-05-26 12:09 - 00000000 ____D C:\Program Files\CCleaner
2013-07-16 20:40 - 2013-06-25 20:06 - 00000000 ____D C:\Program Files (x86)\mozilla firefox
2013-07-15 12:14 - 2013-03-22 22:17 - 00000474 _____ C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-14 12:00 - 2013-05-26 12:06 - 00000410 _____ C:\Windows\Tasks\Wise Turbo Checker.job
2013-07-13 19:05 - 2013-07-13 19:03 - 37257216 _____ C:\Windows\system32\config\COMPONENTS.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00180224 _____ C:\Windows\system32\config\DEFAULT.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00057344 _____ C:\Windows\system32\config\SAM.rhk
2013-07-13 19:03 - 2013-07-13 19:00 - 65347584 _____ C:\Windows\system32\config\SOFTWARE.rhk
2013-07-13 19:00 - 2013-07-13 19:00 - 00024576 _____ C:\Windows\system32\config\SECURITY.rhk
2013-07-13 18:00 - 2012-02-02 12:28 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 14:45 - 2012-02-02 17:28 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Uwe & Ildiko
2013-07-13 08:50 - 2013-07-13 08:50 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 08:50 - 2012-02-02 12:28 - 00004114 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 13:11 - 2013-07-12 12:46 - 00000000 ____D C:\Users\Ecksperts\Desktop\Neuer Ordner (4)
2013-07-12 12:57 - 2013-05-01 14:57 - 00000000 ____D C:\Users\Ecksperts\Desktop\Anzeigen
2013-07-12 12:54 - 2013-04-30 18:10 - 00000000 ____D C:\Users\Ecksperts\Desktop\Beckmannplatz
2013-07-12 09:18 - 2013-05-26 12:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 01:00 - 2012-11-27 23:51 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 21:00 - 2013-06-26 08:48 - 00000394 _____ C:\Windows\Tasks\RegTask.job
2013-07-07 06:33 - 2013-07-07 06:31 - 00000000 __SHD C:\WISE_DISKSCRUBTEMP_NTFS
2013-07-06 18:11 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\Help
2013-07-05 20:18 - 2013-07-05 20:18 - 00004033 _____ C:\AdwCleaner[S14].txt
2013-07-05 20:18 - 2013-07-05 20:17 - 00003832 _____ C:\AdwCleaner[R14].txt
2013-07-01 22:00 - 2013-07-01 21:59 - 00003844 _____ C:\AdwCleaner[S13].txt
2013-07-01 21:59 - 2013-07-01 21:59 - 00003643 _____ C:\AdwCleaner[R13].txt
2013-06-30 18:35 - 2013-06-30 18:35 - 00003513 _____ C:\AdwCleaner[S12].txt
2013-06-30 18:35 - 2013-06-30 18:34 - 00003301 _____ C:\AdwCleaner[R12].txt
2013-06-30 18:30 - 2012-02-04 12:20 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\BOM
2013-06-30 12:21 - 2013-06-30 12:06 - 00000000 ____D C:\ProgramData\eSafe
2013-06-30 12:12 - 2013-06-30 12:06 - 00010792 _____ C:\AdwCleaner[S11].txt
2013-06-30 12:12 - 2012-02-02 11:49 - 00000913 _____ C:\Users\Ecksperts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-30 12:12 - 2012-02-02 11:49 - 00000913 _____ C:\Users\Ecksperts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-30 12:06 - 2013-06-30 12:05 - 00000000 ____D C:\Program Files (x86)\Desk 365
2013-06-30 12:05 - 2013-06-30 12:04 - 00010846 _____ C:\AdwCleaner[R11].txt
2013-06-30 12:05 - 2011-06-11 02:58 - 00773712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2013-06-30 12:05 - 2011-06-11 02:58 - 00420944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2013-06-30 12:04 - 2013-06-30 12:04 - 00000000 ____D C:\Program Files (x86)\WebCake
2013-06-26 17:18 - 2013-06-26 17:18 - 00000000 ____D C:\Program Files (x86)\IncrediMail
2013-06-26 11:10 - 2013-06-26 10:47 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-26 11:10 - 2013-06-26 10:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-26 10:28 - 2013-06-26 08:48 - 00000000 ____D C:\Program Files (x86)\RegTask
2013-06-26 10:27 - 2013-06-26 08:48 - 00000000 ____D C:\ProgramData\RegTask
2013-06-26 10:11 - 2013-06-26 08:48 - 00003602 _____ C:\Windows\System32\Tasks\RegTask
2013-06-24 00:57 - 2006-11-02 14:35 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-21 16:25

==================== End Of Log ============================
--- --- ---

--- --- ---


Hallo Schrauber,

da haben wir schon das erste Problem: " Welche Webseite meinst Du und was ist Addition.txt??

Fragen über Fragen!!

MfG
Ecksperts
__________________
Alt 21.07.2013, 21:14   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Einfach die Logs in Codetags posten

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.



Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.07.2013, 00:24   #5
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


[AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v2.300 - Datei am 21/07/2013 um 22:44:05 erstellt
# Aktualisiert am 28/04/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Ecksperts - ECKSPERTS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Ecksperts\Desktop\Desktop\adwcleaner_2.3.0.0(2).exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\foxydeal.sqlite
Gelöscht mit Neustart : C:\Program Files (x86)\AddLyrics
Gelöscht mit Neustart : C:\Program Files (x86)\Ask.com
Gelöscht mit Neustart : C:\Program Files (x86)\Conduit
Gelöscht mit Neustart : C:\Program Files (x86)\Desk 365
Gelöscht mit Neustart : C:\Program Files (x86)\Gophoto.it
Gelöscht mit Neustart : C:\Program Files (x86)\Optimizer Pro
Gelöscht mit Neustart : C:\Program Files (x86)\SweetIM
Gelöscht mit Neustart : C:\Program Files (x86)\sweetpacks bundle uninstaller
Gelöscht mit Neustart : C:\Program Files (x86)\TornTV.com
Gelöscht mit Neustart : C:\ProgramData\Babylon
Gelöscht mit Neustart : C:\ProgramData\BrowserProtect
Gelöscht mit Neustart : C:\ProgramData\eSafe
Gelöscht mit Neustart : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desk 365
Gelöscht mit Neustart : C:\ProgramData\SweetIM
Gelöscht mit Neustart : C:\ProgramData\Tarma Installer
Gelöscht mit Neustart : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\jetpack
Gelöscht mit Neustart : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Gelöscht mit Neustart : C:\Windows\Installer\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Gelöscht mit Neustart : C:\Windows\SysWOW64\WNLT

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}

***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6001.18639

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Ecksperts\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R10].txt - [2674 octets] - [24/05/2013 00:23:08]
AdwCleaner[R11].txt - [10846 octets] - [30/06/2013 12:04:16]
AdwCleaner[R12].txt - [3301 octets] - [30/06/2013 18:34:36]
AdwCleaner[R13].txt - [3643 octets] - [01/07/2013 21:59:13]
AdwCleaner[R14].txt - [3832 octets] - [05/07/2013 20:17:44]
AdwCleaner[R15].txt - [5159 octets] - [16/07/2013 20:59:16]
AdwCleaner[R16].txt - [3618 octets] - [16/07/2013 21:04:43]
AdwCleaner[R17].txt - [4224 octets] - [19/07/2013 01:14:33]
AdwCleaner[R18].txt - [4007 octets] - [21/07/2013 22:43:16]
AdwCleaner[R6].txt - [11175 octets] - [14/05/2013 13:41:53]
AdwCleaner[R7].txt - [2218 octets] - [14/05/2013 13:54:13]
AdwCleaner[R8].txt - [2617 octets] - [14/05/2013 20:18:56]
AdwCleaner[R9].txt - [3054 octets] - [24/05/2013 00:10:46]
AdwCleaner[S10].txt - [2845 octets] - [24/05/2013 00:23:41]
AdwCleaner[S11].txt - [10792 octets] - [30/06/2013 12:06:28]
AdwCleaner[S12].txt - [3513 octets] - [30/06/2013 18:35:09]
AdwCleaner[S13].txt - [3844 octets] - [01/07/2013 21:59:49]
AdwCleaner[S14].txt - [4033 octets] - [05/07/2013 20:18:25]
AdwCleaner[S15].txt - [5378 octets] - [16/07/2013 20:59:50]
AdwCleaner[S16].txt - [3825 octets] - [16/07/2013 21:05:11]
AdwCleaner[S17].txt - [4437 octets] - [19/07/2013 01:16:16]
AdwCleaner[S18].txt - [3812 octets] - [21/07/2013 22:44:05]
AdwCleaner[S6].txt - [10987 octets] - [14/05/2013 13:43:24]
AdwCleaner[S7].txt - [2376 octets] - [14/05/2013 13:54:53]
AdwCleaner[S8].txt - [2781 octets] - [14/05/2013 20:19:43]
AdwCleaner[S9].txt - [3242 octets] - [24/05/2013 00:12:24]

########## EOF - C:\AdwCleaner[S18].txt - [4114 octets] ##########
--- --- ---
][/CODE]

Hallo Schrauber,

kannst Du mir eigentlich einen Tipp geben, wie ich mich zukünftig vor solch einer Bedrohung schützen kann?

Jetzt schon mal danke für Deine Mühen!!

MfG
Ecksperts

Hallo schrauber,

anbei nochmals nach Aktualisierung der Software "awl Cleaner" das neueste Ergebnis nach erfolgtem Löschvorgang mittels "awl Cleaner":

Code:
ATTFilter
# AdwCleaner v2.306 - Datei am 22/07/2013 um 01:10:11 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Ecksperts - ECKSPERTS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Ecksperts\Desktop\Desktop\adwcleaner06.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\foxydeal.sqlite
Gelöscht mit Neustart : C:\Program Files (x86)\AddLyrics
Gelöscht mit Neustart : C:\Program Files (x86)\Ask.com
Gelöscht mit Neustart : C:\Program Files (x86)\Common Files\Wondershare
Gelöscht mit Neustart : C:\Program Files (x86)\Conduit
Gelöscht mit Neustart : C:\Program Files (x86)\Desk 365
Gelöscht mit Neustart : C:\Program Files (x86)\Gophoto.it
Gelöscht mit Neustart : C:\Program Files (x86)\optimizer pro
Gelöscht mit Neustart : C:\Program Files (x86)\RegClean Pro
Gelöscht mit Neustart : C:\Program Files (x86)\SweetIM
Gelöscht mit Neustart : C:\Program Files (x86)\sweetpacks bundle uninstaller
Gelöscht mit Neustart : C:\Program Files (x86)\TornTV.com
Gelöscht mit Neustart : C:\Program Files (x86)\WebCake
Gelöscht mit Neustart : C:\Program Files (x86)\Wondershare
Gelöscht mit Neustart : C:\ProgramData\Babylon
Gelöscht mit Neustart : C:\ProgramData\BrowserProtect
Gelöscht mit Neustart : C:\ProgramData\eSafe
Gelöscht mit Neustart : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desk 365
Gelöscht mit Neustart : C:\ProgramData\SweetIM
Gelöscht mit Neustart : C:\ProgramData\Tarma Installer
Gelöscht mit Neustart : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\jetpack
Gelöscht mit Neustart : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Gelöscht mit Neustart : C:\Windows\Installer\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Gelöscht mit Neustart : C:\Windows\SysWOW64\ARFC
Gelöscht mit Neustart : C:\Windows\SysWOW64\jmdp
Gelöscht mit Neustart : C:\Windows\SysWOW64\WNLT

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6001.18639

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Ecksperts\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R10].txt - [2674 octets] - [24/05/2013 00:23:08]
AdwCleaner[R11].txt - [10846 octets] - [30/06/2013 12:04:16]
AdwCleaner[R12].txt - [3301 octets] - [30/06/2013 18:34:36]
AdwCleaner[R13].txt - [3643 octets] - [01/07/2013 21:59:13]
AdwCleaner[R14].txt - [3832 octets] - [05/07/2013 20:17:44]
AdwCleaner[R15].txt - [5159 octets] - [16/07/2013 20:59:16]
AdwCleaner[R16].txt - [3618 octets] - [16/07/2013 21:04:43]
AdwCleaner[R17].txt - [4224 octets] - [19/07/2013 01:14:33]
AdwCleaner[R18].txt - [4007 octets] - [21/07/2013 22:43:16]
AdwCleaner[R19].txt - [4288 octets] - [22/07/2013 01:08:56]
AdwCleaner[R6].txt - [11175 octets] - [14/05/2013 13:41:53]
AdwCleaner[R7].txt - [2218 octets] - [14/05/2013 13:54:13]
AdwCleaner[R8].txt - [2617 octets] - [14/05/2013 20:18:56]
AdwCleaner[R9].txt - [3054 octets] - [24/05/2013 00:10:46]
AdwCleaner[S10].txt - [2845 octets] - [24/05/2013 00:23:41]
AdwCleaner[S11].txt - [10792 octets] - [30/06/2013 12:06:28]
AdwCleaner[S12].txt - [3513 octets] - [30/06/2013 18:35:09]
AdwCleaner[S13].txt - [3844 octets] - [01/07/2013 21:59:49]
AdwCleaner[S14].txt - [4033 octets] - [05/07/2013 20:18:25]
AdwCleaner[S15].txt - [5378 octets] - [16/07/2013 20:59:50]
AdwCleaner[S16].txt - [3825 octets] - [16/07/2013 21:05:11]
AdwCleaner[S17].txt - [4437 octets] - [19/07/2013 01:16:16]
AdwCleaner[S18].txt - [4184 octets] - [21/07/2013 22:44:05]
AdwCleaner[S19].txt - [4129 octets] - [22/07/2013 01:10:11]
AdwCleaner[S6].txt - [10987 octets] - [14/05/2013 13:43:24]
AdwCleaner[S7].txt - [2376 octets] - [14/05/2013 13:54:53]
AdwCleaner[S8].txt - [2781 octets] - [14/05/2013 20:19:43]
AdwCleaner[S9].txt - [3242 octets] - [24/05/2013 00:12:24]

########## EOF - C:\AdwCleaner[S19].txt - [4431 octets] ##########
Hoffe es kann Dir helfen!!

MfG
Ecksperts


Alt 22.07.2013, 09:15   #6
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


JRT und FRST fehlt noch
__________________
--> Problem mit "Coupondropdown und ism.sitescout.com popups"

Alt 22.07.2013, 12:51   #7
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Hallo Schrauber,

wenn die FRST das Ergebnis des Laufs über das Softwareprogramm: Farbar's Recovery Scan Tool ist, dann habe ich Dir diese doch bereits gestern 19:16 Uhr zukommen lassen, als FRST.txt
FRST Logfile:

Meinst Du diese? Und was bedeutet "JRT" und wie erhalte ich diese?!

MfG
Ecksperts

Alt 22.07.2013, 13:58   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


und ich hab gestern 22 Uhr neue Instruktionen gepostet:

AdwCleaner
Junkware removal Tool (JRT)
Frisches FRST logfile
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.07.2013, 15:17   #9
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Hallo Schrauber,

hier erst einmal das Ergebnis aus dem Lauf von "Junkware removal Tool (JRT)"

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.0 (07.21.2013:1)
OS: Windows (TM) Vista Home Premium x64
Ran by Ecksperts on 22.07.2013 at 15:48:57,62
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{a0b10ebe-4e51-4cae-949b-e6b9e7d68cea}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{bb975e58-e769-4e5a-ba12-b765bc559ff3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{fb684d26-01f4-4d9d-87cb-f486beba56dc}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{0afd55c8-adf8-4a33-a6e1-dedb7a36aeb4}



~~~ Files

Successfully deleted: [File] C:\eula.1028.txt
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\eula.1033.txt
Successfully deleted: [File] C:\eula.1036.txt
Successfully deleted: [File] C:\eula.1040.txt
Successfully deleted: [File] C:\eula.1041.txt
Successfully deleted: [File] C:\eula.1042.txt
Successfully deleted: [File] C:\eula.1049.txt
Successfully deleted: [File] C:\eula.2052.txt
Successfully deleted: [File] C:\install.res.1028.dll
Successfully deleted: [File] C:\install.res.1031.dll
Successfully deleted: [File] C:\install.res.1033.dll
Successfully deleted: [File] C:\install.res.1036.dll
Successfully deleted: [File] C:\install.res.1040.dll
Successfully deleted: [File] C:\install.res.1041.dll
Successfully deleted: [File] C:\install.res.1042.dll
Successfully deleted: [File] C:\install.res.1049.dll
Successfully deleted: [File] C:\install.res.2052.dll
Successfully deleted: [File] C:\install.res.3082.dll



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\ProgramData\browserprotect"
Successfully deleted: [Folder] "C:\ProgramData\esafe"
Successfully deleted: [Folder] "C:\ProgramData\sweetim"
Successfully deleted: [Folder] "C:\ProgramData\tarma installer"
Successfully deleted: [Folder] "C:\Users\Ecksperts\AppData\Roaming\systweak"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\desk 365"
Successfully deleted: [Folder] "C:\Program Files (x86)\optimizer pro"
Successfully deleted: [Folder] "C:\Program Files (x86)\pc speed maximizer"
Successfully deleted: [Folder] "C:\Program Files (x86)\pc speed up"
Successfully deleted: [Folder] "C:\Program Files (x86)\regclean pro"
Successfully deleted: [Folder] "C:\Program Files (x86)\sweetim"
Successfully deleted: [Folder] "C:\Program Files (x86)\sweetpacks bundle uninstaller"
Successfully deleted: [Folder] "C:\Program Files (x86)\webcake"
Successfully deleted: [Folder] "C:\Program Files (x86)\wondershare"
Successfully deleted: [Folder] "C:\Program Files (x86)\Common Files\wondershare"
Successfully deleted: [Folder] "C:\Windows\syswow64\arfc"
Successfully deleted: [Folder] "C:\Windows\syswow64\jmdp"



~~~ FireFox

Successfully deleted: [File] "C:\Users\Ecksperts\AppData\Roaming\mozilla\firefox\profiles\aj0e891s.default\extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi" 
Successfully deleted: [File] "C:\Users\Ecksperts\AppData\Roaming\mozilla\firefox\profiles\aj0e891s.default\extensions\ftdownloader3@ftdownloader.com.xpi" 
Successfully deleted: [Folder] C:\Users\Ecksperts\AppData\Roaming\mozilla\firefox\profiles\aj0e891s.default\jetpack
Emptied folder: C:\Users\Ecksperts\AppData\Roaming\mozilla\firefox\profiles\aj0e891s.default\minidumps [15 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.07.2013 at 15:58:48,14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hallo Schrauber,

hier nun das Ergebnis nach erfolgtem Durchlauf und anschließendem Löschvorgang von "adw Cleaner". Hoffe es passt?!

Code:
ATTFilter
# AdwCleaner v2.306 - Datei am 22/07/2013 um 16:04:54 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Ecksperts - ECKSPERTS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Ecksperts\Desktop\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\foxydeal.sqlite
Gelöscht mit Neustart : C:\Program Files (x86)\AddLyrics
Gelöscht mit Neustart : C:\Program Files (x86)\Ask.com
Gelöscht mit Neustart : C:\Program Files (x86)\Gophoto.it
Gelöscht mit Neustart : C:\Program Files (x86)\TornTV.com
Gelöscht mit Neustart : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desk 365
Gelöscht mit Neustart : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\jetpack
Gelöscht mit Neustart : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Gelöscht mit Neustart : C:\Windows\Installer\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Gelöscht mit Neustart : C:\Windows\SysWOW64\WNLT

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6001.18639

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Ecksperts\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R10].txt - [2674 octets] - [24/05/2013 00:23:08]
AdwCleaner[R11].txt - [10846 octets] - [30/06/2013 12:04:16]
AdwCleaner[R12].txt - [3301 octets] - [30/06/2013 18:34:36]
AdwCleaner[R13].txt - [3643 octets] - [01/07/2013 21:59:13]
AdwCleaner[R14].txt - [3832 octets] - [05/07/2013 20:17:44]
AdwCleaner[R15].txt - [5159 octets] - [16/07/2013 20:59:16]
AdwCleaner[R16].txt - [3618 octets] - [16/07/2013 21:04:43]
AdwCleaner[R17].txt - [4224 octets] - [19/07/2013 01:14:33]
AdwCleaner[R18].txt - [4007 octets] - [21/07/2013 22:43:16]
AdwCleaner[R19].txt - [4288 octets] - [22/07/2013 01:08:56]
AdwCleaner[R20].txt - [3474 octets] - [22/07/2013 16:04:20]
AdwCleaner[R6].txt - [11175 octets] - [14/05/2013 13:41:53]
AdwCleaner[R7].txt - [2218 octets] - [14/05/2013 13:54:13]
AdwCleaner[R8].txt - [2617 octets] - [14/05/2013 20:18:56]
AdwCleaner[R9].txt - [3054 octets] - [24/05/2013 00:10:46]
AdwCleaner[S10].txt - [2845 octets] - [24/05/2013 00:23:41]
AdwCleaner[S11].txt - [10792 octets] - [30/06/2013 12:06:28]
AdwCleaner[S12].txt - [3513 octets] - [30/06/2013 18:35:09]
AdwCleaner[S13].txt - [3844 octets] - [01/07/2013 21:59:49]
AdwCleaner[S14].txt - [4033 octets] - [05/07/2013 20:18:25]
AdwCleaner[S15].txt - [5378 octets] - [16/07/2013 20:59:50]
AdwCleaner[S16].txt - [3825 octets] - [16/07/2013 21:05:11]
AdwCleaner[S17].txt - [4437 octets] - [19/07/2013 01:16:16]
AdwCleaner[S18].txt - [4184 octets] - [21/07/2013 22:44:05]
AdwCleaner[S19].txt - [4501 octets] - [22/07/2013 01:10:11]
AdwCleaner[S20].txt - [3219 octets] - [22/07/2013 16:04:54]
AdwCleaner[S6].txt - [10987 octets] - [14/05/2013 13:43:24]
AdwCleaner[S7].txt - [2376 octets] - [14/05/2013 13:54:53]
AdwCleaner[S8].txt - [2781 octets] - [14/05/2013 20:19:43]
AdwCleaner[S9].txt - [3242 octets] - [24/05/2013 00:12:24]

########## EOF - C:\AdwCleaner[S20].txt - [3521 octets] ##########

Alt 22.07.2013, 17:35   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Supi, jetzt ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.07.2013, 18:12   #11
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Hallo Schrauber,

bitte schön, aber was ist ein "frisches FRST log", und wie erstelle ich das?

Denke bitte daran, dass Du es mit einem Laien zu tun hast!!

MfG
Ecksperts

Alt 22.07.2013, 20:18   #12
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Ganz am Anfang hast Du mit dem Tool FRST einen Scan gemacht. Jetzt nochmal nen neuen Scan machen und das Log posten
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.07.2013, 21:03   #13
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Hallo Schrauber,

hier das Ergebnis. Hoffe es ist das korrekte?!

MfG
Ecksperts


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-07-2013 01
Ran by Ecksperts (administrator) on 22-07-2013 21:56:30
Running from C:\Users\Ecksperts\Desktop\Desktop
Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\mozilla firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Farbar) C:\Users\Ecksperts\Desktop\Desktop\FRST64(3).exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [367016 2013-06-26] (IncrediMail, Ltd.)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2012-12-13] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-07-19] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Videoraptor_WebRipPlugin Class - {3C0372C2-04C3-4100-BAB1-1D42C552BC48} - C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\IE\VR_WebRipIePlugin.dll (RapidSolution Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default
FF Homepage: hxxp://www.google.de/firefox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @innoplus.de/ino3DViewer - C:\Program Files (x86)\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll (INNOVA-engineering GmbH Dresden)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Ghostery - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\firefox@ghostery.com
FF Extension: Yahoo! Toolbar - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: clearConsole - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\clearConsole@penzil.com.xpi
FF Extension: nbthemes - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\nbthemes@narutoboards.xpi
FF Extension: torntv2 - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\torntv2@torntv.com.xpi
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [videoraptor-firefox-surf-and-catch-extension@audials.com] C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\
FF Extension: Videoraptor Firefox Surf and Catch Plugin - C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-19] (Avira Operations GmbH & Co. KG)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-12-13] (Kaspersky Lab ZAO)
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-05-24] ()
S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2012-11-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2013-04-25] (WiseCleaner.com)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-07-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-07-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-07-19] (Avira Operations GmbH & Co. KG)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2009-01-23] (Brother Industries Ltd.)
R3 FET5A64; C:\Windows\System32\DRIVERS\fet5a64.sys [49024 2006-09-18] (VIA Technologies, Inc.              )
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-23] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1418112 2007-04-03] (Philips Semiconductors GmbH)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 cpuz134; \??\C:\Users\ECKSPE~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 gfiark; system32\drivers\gfiark.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-22 16:04 - 2013-07-22 16:05 - 00003591 _____ C:\AdwCleaner[S20].txt
2013-07-22 16:04 - 2013-07-22 16:04 - 00003474 _____ C:\AdwCleaner[R20].txt
2013-07-22 15:58 - 2013-07-22 15:58 - 00004602 _____ C:\Users\Ecksperts\Desktop\JRT.txt
2013-07-22 15:48 - 2013-07-22 15:48 - 00000000 ____D C:\Windows\ERUNT
2013-07-22 01:10 - 2013-07-22 01:10 - 00004501 _____ C:\AdwCleaner[S19].txt
2013-07-22 01:08 - 2013-07-22 01:09 - 00004288 _____ C:\AdwCleaner[R19].txt
2013-07-22 01:08 - 2013-07-22 01:08 - 00666633 _____ C:\Users\Ecksperts\Desktop\adwcleaner06.exe
2013-07-21 22:44 - 2013-07-21 22:44 - 00004184 _____ C:\AdwCleaner[S18].txt
2013-07-21 22:43 - 2013-07-21 22:43 - 00004007 _____ C:\AdwCleaner[R18].txt
2013-07-21 16:37 - 2013-07-21 16:40 - 00000162 _____ C:\Windows\Reimage.ini
2013-07-21 00:36 - 2013-07-21 00:36 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Panasonic
2013-07-21 00:33 - 2013-07-21 00:36 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Lumix Bildbearbeitg
2013-07-21 00:32 - 2013-07-21 00:32 - 00000000 ____D C:\Program Files (x86)\ISL
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\Users\ECKSPE~1\AppData\Local\{B96D1B84-189C-4535-8C31-7517D6A8D074}
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 00:27 - 2005-06-01 04:10 - 00495616 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICSDK2.dll
2013-07-21 00:27 - 2005-06-01 03:10 - 00077824 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICEntry.dll
2013-07-21 00:27 - 2005-06-01 00:30 - 00000097 _____ C:\Windows\SysWOW64\PICSDK.ini
2013-07-21 00:27 - 2005-06-01 00:20 - 00111932 _____ C:\Windows\SysWOW64\EPPICPrinterDB.dat
2013-07-21 00:27 - 2005-06-01 00:10 - 00073728 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICSDK.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00114688 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\EpPicPrt.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00065536 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\EPPicMgr.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00031053 _____ C:\Windows\SysWOW64\EPPICPattern131.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00027417 _____ C:\Windows\SysWOW64\EPPICPattern121.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00026154 _____ C:\Windows\SysWOW64\EPPICPattern1.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00024903 _____ C:\Windows\SysWOW64\EPPICPattern3.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00021390 _____ C:\Windows\SysWOW64\EPPICPattern5.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00020148 _____ C:\Windows\SysWOW64\EPPICPattern2.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00013732 _____ C:\Windows\SysWOW64\EPPICLocal_EN.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00011811 _____ C:\Windows\SysWOW64\EPPICPattern4.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00006442 _____ C:\Windows\SysWOW64\EPPICLocal_IT.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006347 _____ C:\Windows\SysWOW64\EPPICLocal_PT.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006347 _____ C:\Windows\SysWOW64\EPPICLocal_BP.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006335 _____ C:\Windows\SysWOW64\EPPICLocal_GE.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006195 _____ C:\Windows\SysWOW64\EPPICLocal_FR.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006195 _____ C:\Windows\SysWOW64\EPPICLocal_CF.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006122 _____ C:\Windows\SysWOW64\EPPICLocal_DU.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006103 _____ C:\Windows\SysWOW64\EPPICLocal_ES.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00005817 _____ C:\Windows\SysWOW64\EPPICLocal_KO.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00005436 _____ C:\Windows\SysWOW64\EPPICLocal_SC.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00004943 _____ C:\Windows\SysWOW64\EPPICPattern6.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00002889 _____ C:\Windows\SysWOW64\EPPICLocal_RU.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00002426 _____ C:\Windows\SysWOW64\EPPICLocal_TC.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00001146 _____ C:\Windows\SysWOW64\EPPICPresetData_DU.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001139 _____ C:\Windows\SysWOW64\EPPICPresetData_PT.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001139 _____ C:\Windows\SysWOW64\EPPICPresetData_BP.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001136 _____ C:\Windows\SysWOW64\EPPICPresetData_ES.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001129 _____ C:\Windows\SysWOW64\EPPICPresetData_FR.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001129 _____ C:\Windows\SysWOW64\EPPICPresetData_CF.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001120 _____ C:\Windows\SysWOW64\EPPICPresetData_IT.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001107 _____ C:\Windows\SysWOW64\EPPICPresetData_GE.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001104 _____ C:\Windows\SysWOW64\EPPICPresetData_EN.dat
2013-07-21 00:26 - 2013-07-21 00:28 - 00000000 ____D C:\Program Files (x86)\Panasonic
2013-07-21 00:26 - 2005-03-07 19:44 - 00045056 _____ (Matsushita Electric Industrial Co., Ltd.) C:\Windows\SysWOW64\PhDi2.sys
2013-07-20 19:45 - 2013-07-20 19:45 - 00000000 ____D C:\Users\Ecksperts\Desktop\Sergej_Hamm
2013-07-20 19:38 - 2013-07-20 19:42 - 00000000 ____D C:\Windows\system32\MRT
2013-07-19 01:16 - 2013-07-19 01:16 - 00004437 _____ C:\AdwCleaner[S17].txt
2013-07-19 01:14 - 2013-07-19 01:15 - 00004224 _____ C:\AdwCleaner[R17].txt
2013-07-19 01:11 - 2013-07-19 01:11 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Avira
2013-07-19 01:07 - 2013-07-19 01:35 - 00001901 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-19 01:06 - 2013-07-19 01:06 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-19 01:06 - 2013-07-19 01:01 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-19 01:06 - 2013-07-19 01:01 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-19 01:06 - 2013-07-19 01:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-18 08:52 - 2013-07-22 16:14 - 00183362 _____ C:\Windows\WindowsUpdate.log
2013-07-18 08:48 - 2013-07-19 01:18 - 00081850 _____ C:\Windows\PFRO.log
2013-07-18 01:23 - 2013-07-19 01:35 - 00000000 ____D C:\ProgramData\Avira
2013-07-17 22:12 - 2013-07-17 22:12 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-07-17 22:11 - 2013-07-18 08:48 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-07-17 22:00 - 2013-07-17 22:00 - 00000000 ____D C:\FRST
2013-07-16 21:05 - 2013-07-16 21:05 - 00003825 _____ C:\AdwCleaner[S16].txt
2013-07-16 21:04 - 2013-07-16 21:05 - 00003618 _____ C:\AdwCleaner[R16].txt
2013-07-16 20:59 - 2013-07-16 21:00 - 00005378 _____ C:\AdwCleaner[S15].txt
2013-07-16 20:59 - 2013-07-16 20:59 - 00005159 _____ C:\AdwCleaner[R15].txt
2013-07-13 19:03 - 2013-07-13 19:05 - 37257216 _____ C:\Windows\system32\config\COMPONENTS.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00180224 _____ C:\Windows\system32\config\DEFAULT.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00057344 _____ C:\Windows\system32\config\SAM.rhk
2013-07-13 19:00 - 2013-07-13 19:03 - 65347584 _____ C:\Windows\system32\config\SOFTWARE.rhk
2013-07-13 19:00 - 2013-07-13 19:00 - 00024576 _____ C:\Windows\system32\config\SECURITY.rhk
2013-07-13 08:50 - 2013-07-13 08:50 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 12:46 - 2013-07-12 13:11 - 00000000 ____D C:\Users\Ecksperts\Desktop\Neuer Ordner (4)
2013-07-07 06:31 - 2013-07-07 06:33 - 00000000 __SHD C:\WISE_DISKSCRUBTEMP_NTFS
2013-07-05 20:18 - 2013-07-05 20:18 - 00004033 _____ C:\AdwCleaner[S14].txt
2013-07-05 20:17 - 2013-07-05 20:18 - 00003832 _____ C:\AdwCleaner[R14].txt
2013-07-01 21:59 - 2013-07-01 22:00 - 00003844 _____ C:\AdwCleaner[S13].txt
2013-07-01 21:59 - 2013-07-01 21:59 - 00003643 _____ C:\AdwCleaner[R13].txt
2013-06-30 18:35 - 2013-06-30 18:35 - 00003513 _____ C:\AdwCleaner[S12].txt
2013-06-30 18:34 - 2013-06-30 18:35 - 00003301 _____ C:\AdwCleaner[R12].txt
2013-06-30 12:06 - 2013-06-30 12:12 - 00010792 _____ C:\AdwCleaner[S11].txt
2013-06-30 12:04 - 2013-06-30 12:05 - 00010846 _____ C:\AdwCleaner[R11].txt
2013-06-26 17:18 - 2013-06-26 17:18 - 00000000 ____D C:\Program Files (x86)\IncrediMail
2013-06-26 10:47 - 2013-06-26 11:10 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-26 10:47 - 2013-06-26 11:10 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-26 08:48 - 2013-07-11 21:00 - 00000394 _____ C:\Windows\Tasks\RegTask.job
2013-06-26 08:48 - 2013-06-26 10:28 - 00000000 ____D C:\Program Files (x86)\RegTask
2013-06-26 08:48 - 2013-06-26 10:27 - 00000000 ____D C:\ProgramData\RegTask
2013-06-26 08:48 - 2013-06-26 10:11 - 00003602 _____ C:\Windows\System32\Tasks\RegTask
2013-06-25 20:06 - 2013-07-16 20:40 - 00000000 ____D C:\Program Files (x86)\mozilla firefox

==================== One Month Modified Files and Folders =======

2013-07-22 21:17 - 2012-02-02 13:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-22 20:06 - 2006-11-02 17:22 - 00003264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-22 20:06 - 2006-11-02 17:22 - 00003264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-22 16:21 - 2013-07-18 08:52 - 00183362 _____ C:\Windows\WindowsUpdate.log
2013-07-22 16:09 - 2013-05-26 11:59 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Wise Care 365
2013-07-22 16:05 - 2013-07-22 16:04 - 00003591 _____ C:\AdwCleaner[S20].txt
2013-07-22 16:05 - 2013-02-24 13:01 - 00022480 _____ C:\Windows\DeleteOnReboot.bat
2013-07-22 16:04 - 2013-07-22 16:04 - 00003474 _____ C:\AdwCleaner[R20].txt
2013-07-22 15:58 - 2013-07-22 15:58 - 00004602 _____ C:\Users\Ecksperts\Desktop\JRT.txt
2013-07-22 15:48 - 2013-07-22 15:48 - 00000000 ____D C:\Windows\ERUNT
2013-07-22 01:10 - 2013-07-22 01:10 - 00004501 _____ C:\AdwCleaner[S19].txt
2013-07-22 01:09 - 2013-07-22 01:08 - 00004288 _____ C:\AdwCleaner[R19].txt
2013-07-22 01:08 - 2013-07-22 01:08 - 00666633 _____ C:\Users\Ecksperts\Desktop\adwcleaner06.exe
2013-07-21 22:44 - 2013-07-21 22:44 - 00004184 _____ C:\AdwCleaner[S18].txt
2013-07-21 22:43 - 2013-07-21 22:43 - 00004007 _____ C:\AdwCleaner[R18].txt
2013-07-21 16:40 - 2013-07-21 16:37 - 00000162 _____ C:\Windows\Reimage.ini
2013-07-21 16:19 - 2012-02-02 11:49 - 00109816 _____ C:\Users\ECKSPE~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-21 16:14 - 2006-11-02 17:21 - 00400320 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-21 00:36 - 2013-07-21 00:36 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Panasonic
2013-07-21 00:36 - 2013-07-21 00:33 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Lumix Bildbearbeitg
2013-07-21 00:36 - 2012-02-04 17:11 - 00000888 _____ C:\Windows\BRWMARK.INI
2013-07-21 00:32 - 2013-07-21 00:32 - 00000000 ____D C:\Program Files (x86)\ISL
2013-07-21 00:32 - 2012-02-03 00:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\Users\ECKSPE~1\AppData\Local\{B96D1B84-189C-4535-8C31-7517D6A8D074}
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 00:28 - 2013-07-21 00:26 - 00000000 ____D C:\Program Files (x86)\Panasonic
2013-07-20 19:45 - 2013-07-20 19:45 - 00000000 ____D C:\Users\Ecksperts\Desktop\Sergej_Hamm
2013-07-20 19:42 - 2013-07-20 19:38 - 00000000 ____D C:\Windows\system32\MRT
2013-07-19 01:35 - 2013-07-19 01:07 - 00001901 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-19 01:35 - 2013-07-18 01:23 - 00000000 ____D C:\ProgramData\Avira
2013-07-19 01:18 - 2013-07-18 08:48 - 00081850 _____ C:\Windows\PFRO.log
2013-07-19 01:16 - 2013-07-19 01:16 - 00004437 _____ C:\AdwCleaner[S17].txt
2013-07-19 01:15 - 2013-07-19 01:14 - 00004224 _____ C:\AdwCleaner[R17].txt
2013-07-19 01:11 - 2013-07-19 01:11 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Avira
2013-07-19 01:06 - 2013-07-19 01:06 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-19 01:01 - 2013-07-19 01:06 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-19 01:01 - 2013-07-19 01:06 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-19 01:01 - 2013-07-19 01:06 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-18 08:48 - 2013-07-17 22:11 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-07-18 01:58 - 2006-11-02 17:42 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-18 01:57 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-17 22:12 - 2013-07-17 22:12 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-07-17 22:00 - 2013-07-17 22:00 - 00000000 ____D C:\FRST
2013-07-17 19:18 - 2013-05-26 15:58 - 00000420 _____ C:\Windows\Tasks\Wise Care 365 PC Checkup Task.job
2013-07-17 13:30 - 2012-11-28 02:28 - 00002641 _____ C:\Users\Ecksperts\Desktop\Microsoft Word 2010.lnk
2013-07-16 21:05 - 2013-07-16 21:05 - 00003825 _____ C:\AdwCleaner[S16].txt
2013-07-16 21:05 - 2013-07-16 21:04 - 00003618 _____ C:\AdwCleaner[R16].txt
2013-07-16 21:00 - 2013-07-16 20:59 - 00005378 _____ C:\AdwCleaner[S15].txt
2013-07-16 20:59 - 2013-07-16 20:59 - 00005159 _____ C:\AdwCleaner[R15].txt
2013-07-16 20:57 - 2013-04-22 13:19 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Cleaner
2013-07-16 20:54 - 2013-05-26 12:09 - 00000000 ____D C:\Program Files\CCleaner
2013-07-16 20:40 - 2013-06-25 20:06 - 00000000 ____D C:\Program Files (x86)\mozilla firefox
2013-07-15 12:14 - 2013-03-22 22:17 - 00000474 _____ C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-14 12:00 - 2013-05-26 12:06 - 00000410 _____ C:\Windows\Tasks\Wise Turbo Checker.job
2013-07-13 19:05 - 2013-07-13 19:03 - 37257216 _____ C:\Windows\system32\config\COMPONENTS.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00180224 _____ C:\Windows\system32\config\DEFAULT.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00057344 _____ C:\Windows\system32\config\SAM.rhk
2013-07-13 19:03 - 2013-07-13 19:00 - 65347584 _____ C:\Windows\system32\config\SOFTWARE.rhk
2013-07-13 19:00 - 2013-07-13 19:00 - 00024576 _____ C:\Windows\system32\config\SECURITY.rhk
2013-07-13 18:00 - 2012-02-02 12:28 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 14:45 - 2012-02-02 17:28 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Uwe & Ildiko
2013-07-13 08:50 - 2013-07-13 08:50 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 08:50 - 2012-02-02 12:28 - 00004114 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 13:11 - 2013-07-12 12:46 - 00000000 ____D C:\Users\Ecksperts\Desktop\Neuer Ordner (4)
2013-07-12 12:57 - 2013-05-01 14:57 - 00000000 ____D C:\Users\Ecksperts\Desktop\Anzeigen
2013-07-12 12:54 - 2013-04-30 18:10 - 00000000 ____D C:\Users\Ecksperts\Desktop\Beckmannplatz
2013-07-12 09:18 - 2013-05-26 12:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 01:00 - 2012-11-27 23:51 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 21:00 - 2013-06-26 08:48 - 00000394 _____ C:\Windows\Tasks\RegTask.job
2013-07-07 06:33 - 2013-07-07 06:31 - 00000000 __SHD C:\WISE_DISKSCRUBTEMP_NTFS
2013-07-06 18:11 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\Help
2013-07-05 20:18 - 2013-07-05 20:18 - 00004033 _____ C:\AdwCleaner[S14].txt
2013-07-05 20:18 - 2013-07-05 20:17 - 00003832 _____ C:\AdwCleaner[R14].txt
2013-07-01 22:00 - 2013-07-01 21:59 - 00003844 _____ C:\AdwCleaner[S13].txt
2013-07-01 21:59 - 2013-07-01 21:59 - 00003643 _____ C:\AdwCleaner[R13].txt
2013-06-30 18:35 - 2013-06-30 18:35 - 00003513 _____ C:\AdwCleaner[S12].txt
2013-06-30 18:35 - 2013-06-30 18:34 - 00003301 _____ C:\AdwCleaner[R12].txt
2013-06-30 18:30 - 2012-02-04 12:20 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\BOM
2013-06-30 12:12 - 2013-06-30 12:06 - 00010792 _____ C:\AdwCleaner[S11].txt
2013-06-30 12:12 - 2012-02-02 11:49 - 00000913 _____ C:\Users\Ecksperts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-30 12:12 - 2012-02-02 11:49 - 00000913 _____ C:\Users\Ecksperts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-30 12:05 - 2013-06-30 12:04 - 00010846 _____ C:\AdwCleaner[R11].txt
2013-06-30 12:05 - 2011-06-11 02:58 - 00773712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2013-06-30 12:05 - 2011-06-11 02:58 - 00420944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2013-06-26 17:18 - 2013-06-26 17:18 - 00000000 ____D C:\Program Files (x86)\IncrediMail
2013-06-26 11:10 - 2013-06-26 10:47 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-26 11:10 - 2013-06-26 10:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-26 10:28 - 2013-06-26 08:48 - 00000000 ____D C:\Program Files (x86)\RegTask
2013-06-26 10:27 - 2013-06-26 08:48 - 00000000 ____D C:\ProgramData\RegTask
2013-06-26 10:11 - 2013-06-26 08:48 - 00003602 _____ C:\Windows\System32\Tasks\RegTask
2013-06-24 00:57 - 2006-11-02 14:35 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-22 16:13

==================== End Of Log ============================
--- --- ---
Alt 23.07.2013, 08:55   #14
schrauber
/// the machine
/// TB-Ausbilder
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Perfekt


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und nochmal ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 23.07.2013, 15:35   #15
Ecksperts
 
Problem mit "Coupondropdown und ism.sitescout.com popups" - Standard

Problem mit "Coupondropdown und ism.sitescout.com popups"


Halo Schrauber,

bin leider jetzt erst wieder dazu gekommen, meine neuesten Mails abzufragen. Hier anbei nochmals die oder das neueste "FRST log"! Aber nach wie vor stellt sich mir die Frage, wie ich mich zukünftig vor solchen Angriffen schützen kann????????????????


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-07-2013 01
Ran by Ecksperts (administrator) on 23-07-2013 16:26:34
Running from C:\Users\Ecksperts\Desktop\Desktop
Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
(Mozilla Corporation) C:\Program Files (x86)\mozilla firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Farbar) C:\Users\Ecksperts\Desktop\Desktop\FRST64(4).exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [367016 2013-06-26] (IncrediMail, Ltd.)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2012-12-13] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-07-19] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2008-01-19] (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Videoraptor_WebRipPlugin Class - {3C0372C2-04C3-4100-BAB1-1D42C552BC48} - C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\IE\VR_WebRipIePlugin.dll (RapidSolution Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default
FF Homepage: hxxp://www.google.de/firefox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @innoplus.de/ino3DViewer - C:\Program Files (x86)\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll (INNOVA-engineering GmbH Dresden)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Ghostery - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\firefox@ghostery.com
FF Extension: Yahoo! Toolbar - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: clearConsole - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\clearConsole@penzil.com.xpi
FF Extension: nbthemes - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\nbthemes@narutoboards.xpi
FF Extension: torntv2 - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\torntv2@torntv.com.xpi
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
FF Extension: No Name - C:\Users\Ecksperts\AppData\Roaming\Mozilla\Firefox\Profiles\aj0e891s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [videoraptor-firefox-surf-and-catch-extension@audials.com] C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\
FF Extension: Videoraptor Firefox Surf and Catch Plugin - C:\Program Files (x86)\RapidSolution\RS Audials One\VideoRaptor\plugins\GeckoBased\videoraptor-firefox-surf-and-catch-extension@audials.com\
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-19] (Avira Operations GmbH & Co. KG)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-12-13] (Kaspersky Lab ZAO)
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-05-24] ()
S2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2012-11-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2013-04-25] (WiseCleaner.com)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-07-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-07-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-07-19] (Avira Operations GmbH & Co. KG)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2009-01-23] (Brother Industries Ltd.)
R3 FET5A64; C:\Windows\System32\DRIVERS\fet5a64.sys [49024 2006-09-18] (VIA Technologies, Inc.              )
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-23] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1418112 2007-04-03] (Philips Semiconductors GmbH)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 cpuz134; \??\C:\Users\ECKSPE~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 gfiark; system32\drivers\gfiark.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-22 16:04 - 2013-07-22 16:05 - 00003591 _____ C:\AdwCleaner[S20].txt
2013-07-22 16:04 - 2013-07-22 16:04 - 00003474 _____ C:\AdwCleaner[R20].txt
2013-07-22 16:03 - 2013-07-22 16:03 - 00666633 _____ C:\Users\Ecksperts\Desktop\adwcleaner.exe
2013-07-22 15:58 - 2013-07-22 15:58 - 00004602 _____ C:\Users\Ecksperts\Desktop\JRT.txt
2013-07-22 15:48 - 2013-07-22 15:48 - 00000000 ____D C:\Windows\ERUNT
2013-07-22 01:10 - 2013-07-22 01:10 - 00004501 _____ C:\AdwCleaner[S19].txt
2013-07-22 01:08 - 2013-07-22 01:09 - 00004288 _____ C:\AdwCleaner[R19].txt
2013-07-21 22:44 - 2013-07-21 22:44 - 00004184 _____ C:\AdwCleaner[S18].txt
2013-07-21 22:43 - 2013-07-21 22:43 - 00004007 _____ C:\AdwCleaner[R18].txt
2013-07-21 16:37 - 2013-07-21 16:40 - 00000162 _____ C:\Windows\Reimage.ini
2013-07-21 00:36 - 2013-07-21 00:36 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Panasonic
2013-07-21 00:33 - 2013-07-21 00:36 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Lumix Bildbearbeitg
2013-07-21 00:32 - 2013-07-21 00:32 - 00000000 ____D C:\Program Files (x86)\ISL
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\Users\ECKSPE~1\AppData\Local\{B96D1B84-189C-4535-8C31-7517D6A8D074}
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 00:27 - 2005-06-01 04:10 - 00495616 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICSDK2.dll
2013-07-21 00:27 - 2005-06-01 03:10 - 00077824 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICEntry.dll
2013-07-21 00:27 - 2005-06-01 00:30 - 00000097 _____ C:\Windows\SysWOW64\PICSDK.ini
2013-07-21 00:27 - 2005-06-01 00:20 - 00111932 _____ C:\Windows\SysWOW64\EPPICPrinterDB.dat
2013-07-21 00:27 - 2005-06-01 00:10 - 00073728 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\PICSDK.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00114688 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\EpPicPrt.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00065536 _____ (SEIKO EPSON CORPORATION) C:\Windows\SysWOW64\EPPicMgr.dll
2013-07-21 00:27 - 2004-03-03 06:10 - 00031053 _____ C:\Windows\SysWOW64\EPPICPattern131.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00027417 _____ C:\Windows\SysWOW64\EPPICPattern121.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00026154 _____ C:\Windows\SysWOW64\EPPICPattern1.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00024903 _____ C:\Windows\SysWOW64\EPPICPattern3.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00021390 _____ C:\Windows\SysWOW64\EPPICPattern5.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00020148 _____ C:\Windows\SysWOW64\EPPICPattern2.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00013732 _____ C:\Windows\SysWOW64\EPPICLocal_EN.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00011811 _____ C:\Windows\SysWOW64\EPPICPattern4.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00006442 _____ C:\Windows\SysWOW64\EPPICLocal_IT.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006347 _____ C:\Windows\SysWOW64\EPPICLocal_PT.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006347 _____ C:\Windows\SysWOW64\EPPICLocal_BP.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006335 _____ C:\Windows\SysWOW64\EPPICLocal_GE.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006195 _____ C:\Windows\SysWOW64\EPPICLocal_FR.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006195 _____ C:\Windows\SysWOW64\EPPICLocal_CF.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006122 _____ C:\Windows\SysWOW64\EPPICLocal_DU.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00006103 _____ C:\Windows\SysWOW64\EPPICLocal_ES.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00005817 _____ C:\Windows\SysWOW64\EPPICLocal_KO.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00005436 _____ C:\Windows\SysWOW64\EPPICLocal_SC.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00004943 _____ C:\Windows\SysWOW64\EPPICPattern6.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00002889 _____ C:\Windows\SysWOW64\EPPICLocal_RU.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00002426 _____ C:\Windows\SysWOW64\EPPICLocal_TC.cfg
2013-07-21 00:27 - 2004-03-03 06:10 - 00001146 _____ C:\Windows\SysWOW64\EPPICPresetData_DU.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001139 _____ C:\Windows\SysWOW64\EPPICPresetData_PT.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001139 _____ C:\Windows\SysWOW64\EPPICPresetData_BP.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001136 _____ C:\Windows\SysWOW64\EPPICPresetData_ES.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001129 _____ C:\Windows\SysWOW64\EPPICPresetData_FR.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001129 _____ C:\Windows\SysWOW64\EPPICPresetData_CF.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001120 _____ C:\Windows\SysWOW64\EPPICPresetData_IT.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001107 _____ C:\Windows\SysWOW64\EPPICPresetData_GE.dat
2013-07-21 00:27 - 2004-03-03 06:10 - 00001104 _____ C:\Windows\SysWOW64\EPPICPresetData_EN.dat
2013-07-21 00:26 - 2013-07-21 00:28 - 00000000 ____D C:\Program Files (x86)\Panasonic
2013-07-21 00:26 - 2005-03-07 19:44 - 00045056 _____ (Matsushita Electric Industrial Co., Ltd.) C:\Windows\SysWOW64\PhDi2.sys
2013-07-20 19:45 - 2013-07-20 19:45 - 00000000 ____D C:\Users\Ecksperts\Desktop\Sergej_Hamm
2013-07-20 19:38 - 2013-07-20 19:42 - 00000000 ____D C:\Windows\system32\MRT
2013-07-19 01:16 - 2013-07-19 01:16 - 00004437 _____ C:\AdwCleaner[S17].txt
2013-07-19 01:14 - 2013-07-19 01:15 - 00004224 _____ C:\AdwCleaner[R17].txt
2013-07-19 01:11 - 2013-07-19 01:11 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Avira
2013-07-19 01:07 - 2013-07-19 01:35 - 00001901 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-19 01:06 - 2013-07-19 01:06 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-19 01:06 - 2013-07-19 01:01 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-19 01:06 - 2013-07-19 01:01 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-19 01:06 - 2013-07-19 01:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-18 08:52 - 2013-07-23 10:38 - 00197506 _____ C:\Windows\WindowsUpdate.log
2013-07-18 08:48 - 2013-07-19 01:18 - 00081850 _____ C:\Windows\PFRO.log
2013-07-18 01:23 - 2013-07-19 01:35 - 00000000 ____D C:\ProgramData\Avira
2013-07-17 22:12 - 2013-07-17 22:12 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-07-17 22:11 - 2013-07-18 08:48 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-07-17 22:00 - 2013-07-17 22:00 - 00000000 ____D C:\FRST
2013-07-16 21:05 - 2013-07-16 21:05 - 00003825 _____ C:\AdwCleaner[S16].txt
2013-07-16 21:04 - 2013-07-16 21:05 - 00003618 _____ C:\AdwCleaner[R16].txt
2013-07-16 20:59 - 2013-07-16 21:00 - 00005378 _____ C:\AdwCleaner[S15].txt
2013-07-16 20:59 - 2013-07-16 20:59 - 00005159 _____ C:\AdwCleaner[R15].txt
2013-07-13 19:03 - 2013-07-13 19:05 - 37257216 _____ C:\Windows\system32\config\COMPONENTS.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00180224 _____ C:\Windows\system32\config\DEFAULT.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00057344 _____ C:\Windows\system32\config\SAM.rhk
2013-07-13 19:00 - 2013-07-13 19:03 - 65347584 _____ C:\Windows\system32\config\SOFTWARE.rhk
2013-07-13 19:00 - 2013-07-13 19:00 - 00024576 _____ C:\Windows\system32\config\SECURITY.rhk
2013-07-13 08:50 - 2013-07-13 08:50 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 12:46 - 2013-07-12 13:11 - 00000000 ____D C:\Users\Ecksperts\Desktop\Neuer Ordner (4)
2013-07-07 06:31 - 2013-07-07 06:33 - 00000000 __SHD C:\WISE_DISKSCRUBTEMP_NTFS
2013-07-05 20:18 - 2013-07-05 20:18 - 00004033 _____ C:\AdwCleaner[S14].txt
2013-07-05 20:17 - 2013-07-05 20:18 - 00003832 _____ C:\AdwCleaner[R14].txt
2013-07-01 21:59 - 2013-07-01 22:00 - 00003844 _____ C:\AdwCleaner[S13].txt
2013-07-01 21:59 - 2013-07-01 21:59 - 00003643 _____ C:\AdwCleaner[R13].txt
2013-06-30 18:35 - 2013-06-30 18:35 - 00003513 _____ C:\AdwCleaner[S12].txt
2013-06-30 18:34 - 2013-06-30 18:35 - 00003301 _____ C:\AdwCleaner[R12].txt
2013-06-30 12:06 - 2013-06-30 12:12 - 00010792 _____ C:\AdwCleaner[S11].txt
2013-06-30 12:04 - 2013-06-30 12:05 - 00010846 _____ C:\AdwCleaner[R11].txt
2013-06-26 17:18 - 2013-06-26 17:18 - 00000000 ____D C:\Program Files (x86)\IncrediMail
2013-06-26 10:47 - 2013-06-26 11:10 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-26 10:47 - 2013-06-26 11:10 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-26 08:48 - 2013-07-11 21:00 - 00000394 _____ C:\Windows\Tasks\RegTask.job
2013-06-26 08:48 - 2013-06-26 10:28 - 00000000 ____D C:\Program Files (x86)\RegTask
2013-06-26 08:48 - 2013-06-26 10:27 - 00000000 ____D C:\ProgramData\RegTask
2013-06-26 08:48 - 2013-06-26 10:11 - 00003602 _____ C:\Windows\System32\Tasks\RegTask
2013-06-25 20:06 - 2013-07-16 20:40 - 00000000 ____D C:\Program Files (x86)\mozilla firefox

==================== One Month Modified Files and Folders =======

2013-07-23 16:23 - 2013-07-18 08:52 - 00197506 _____ C:\Windows\WindowsUpdate.log
2013-07-23 16:19 - 2012-02-02 13:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-23 16:17 - 2013-05-26 11:59 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Wise Care 365
2013-07-23 16:15 - 2006-11-02 17:22 - 00003264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 16:15 - 2006-11-02 17:22 - 00003264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-22 16:05 - 2013-07-22 16:04 - 00003591 _____ C:\AdwCleaner[S20].txt
2013-07-22 16:05 - 2013-02-24 13:01 - 00022480 _____ C:\Windows\DeleteOnReboot.bat
2013-07-22 16:04 - 2013-07-22 16:04 - 00003474 _____ C:\AdwCleaner[R20].txt
2013-07-22 16:03 - 2013-07-22 16:03 - 00666633 _____ C:\Users\Ecksperts\Desktop\adwcleaner.exe
2013-07-22 15:58 - 2013-07-22 15:58 - 00004602 _____ C:\Users\Ecksperts\Desktop\JRT.txt
2013-07-22 15:48 - 2013-07-22 15:48 - 00000000 ____D C:\Windows\ERUNT
2013-07-22 01:10 - 2013-07-22 01:10 - 00004501 _____ C:\AdwCleaner[S19].txt
2013-07-22 01:09 - 2013-07-22 01:08 - 00004288 _____ C:\AdwCleaner[R19].txt
2013-07-21 22:44 - 2013-07-21 22:44 - 00004184 _____ C:\AdwCleaner[S18].txt
2013-07-21 22:43 - 2013-07-21 22:43 - 00004007 _____ C:\AdwCleaner[R18].txt
2013-07-21 16:40 - 2013-07-21 16:37 - 00000162 _____ C:\Windows\Reimage.ini
2013-07-21 16:19 - 2012-02-02 11:49 - 00109816 _____ C:\Users\ECKSPE~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-21 16:14 - 2006-11-02 17:21 - 00400320 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-21 00:36 - 2013-07-21 00:36 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Panasonic
2013-07-21 00:36 - 2013-07-21 00:33 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Lumix Bildbearbeitg
2013-07-21 00:36 - 2012-02-04 17:11 - 00000888 _____ C:\Windows\BRWMARK.INI
2013-07-21 00:32 - 2013-07-21 00:32 - 00000000 ____D C:\Program Files (x86)\ISL
2013-07-21 00:32 - 2012-02-03 00:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\Users\ECKSPE~1\AppData\Local\{B96D1B84-189C-4535-8C31-7517D6A8D074}
2013-07-21 00:31 - 2013-07-21 00:31 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 00:28 - 2013-07-21 00:26 - 00000000 ____D C:\Program Files (x86)\Panasonic
2013-07-20 19:45 - 2013-07-20 19:45 - 00000000 ____D C:\Users\Ecksperts\Desktop\Sergej_Hamm
2013-07-20 19:42 - 2013-07-20 19:38 - 00000000 ____D C:\Windows\system32\MRT
2013-07-19 01:35 - 2013-07-19 01:07 - 00001901 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-19 01:35 - 2013-07-18 01:23 - 00000000 ____D C:\ProgramData\Avira
2013-07-19 01:18 - 2013-07-18 08:48 - 00081850 _____ C:\Windows\PFRO.log
2013-07-19 01:16 - 2013-07-19 01:16 - 00004437 _____ C:\AdwCleaner[S17].txt
2013-07-19 01:15 - 2013-07-19 01:14 - 00004224 _____ C:\AdwCleaner[R17].txt
2013-07-19 01:11 - 2013-07-19 01:11 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\Avira
2013-07-19 01:06 - 2013-07-19 01:06 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-19 01:01 - 2013-07-19 01:06 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-19 01:01 - 2013-07-19 01:06 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-19 01:01 - 2013-07-19 01:06 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-18 08:48 - 2013-07-17 22:11 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-07-18 01:58 - 2006-11-02 17:42 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-18 01:57 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-17 22:12 - 2013-07-17 22:12 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-07-17 22:00 - 2013-07-17 22:00 - 00000000 ____D C:\FRST
2013-07-17 19:18 - 2013-05-26 15:58 - 00000420 _____ C:\Windows\Tasks\Wise Care 365 PC Checkup Task.job
2013-07-17 13:30 - 2012-11-28 02:28 - 00002641 _____ C:\Users\Ecksperts\Desktop\Microsoft Word 2010.lnk
2013-07-16 21:05 - 2013-07-16 21:05 - 00003825 _____ C:\AdwCleaner[S16].txt
2013-07-16 21:05 - 2013-07-16 21:04 - 00003618 _____ C:\AdwCleaner[R16].txt
2013-07-16 21:00 - 2013-07-16 20:59 - 00005378 _____ C:\AdwCleaner[S15].txt
2013-07-16 20:59 - 2013-07-16 20:59 - 00005159 _____ C:\AdwCleaner[R15].txt
2013-07-16 20:57 - 2013-04-22 13:19 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Cleaner
2013-07-16 20:54 - 2013-05-26 12:09 - 00000000 ____D C:\Program Files\CCleaner
2013-07-16 20:40 - 2013-06-25 20:06 - 00000000 ____D C:\Program Files (x86)\mozilla firefox
2013-07-15 12:14 - 2013-03-22 22:17 - 00000474 _____ C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-14 12:00 - 2013-05-26 12:06 - 00000410 _____ C:\Windows\Tasks\Wise Turbo Checker.job
2013-07-13 19:05 - 2013-07-13 19:03 - 37257216 _____ C:\Windows\system32\config\COMPONENTS.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00180224 _____ C:\Windows\system32\config\DEFAULT.rhk
2013-07-13 19:03 - 2013-07-13 19:03 - 00057344 _____ C:\Windows\system32\config\SAM.rhk
2013-07-13 19:03 - 2013-07-13 19:00 - 65347584 _____ C:\Windows\system32\config\SOFTWARE.rhk
2013-07-13 19:00 - 2013-07-13 19:00 - 00024576 _____ C:\Windows\system32\config\SECURITY.rhk
2013-07-13 18:00 - 2012-02-02 12:28 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 14:45 - 2012-02-02 17:28 - 00000000 ___RD C:\Users\Ecksperts\Desktop\Uwe & Ildiko
2013-07-13 08:50 - 2013-07-13 08:50 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 08:50 - 2012-02-02 12:28 - 00004114 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 13:11 - 2013-07-12 12:46 - 00000000 ____D C:\Users\Ecksperts\Desktop\Neuer Ordner (4)
2013-07-12 12:57 - 2013-05-01 14:57 - 00000000 ____D C:\Users\Ecksperts\Desktop\Anzeigen
2013-07-12 12:54 - 2013-04-30 18:10 - 00000000 ____D C:\Users\Ecksperts\Desktop\Beckmannplatz
2013-07-12 09:18 - 2013-05-26 12:09 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 01:00 - 2012-11-27 23:51 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 21:00 - 2013-06-26 08:48 - 00000394 _____ C:\Windows\Tasks\RegTask.job
2013-07-07 06:33 - 2013-07-07 06:31 - 00000000 __SHD C:\WISE_DISKSCRUBTEMP_NTFS
2013-07-06 18:11 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\Help
2013-07-05 20:18 - 2013-07-05 20:18 - 00004033 _____ C:\AdwCleaner[S14].txt
2013-07-05 20:18 - 2013-07-05 20:17 - 00003832 _____ C:\AdwCleaner[R14].txt
2013-07-01 22:00 - 2013-07-01 21:59 - 00003844 _____ C:\AdwCleaner[S13].txt
2013-07-01 21:59 - 2013-07-01 21:59 - 00003643 _____ C:\AdwCleaner[R13].txt
2013-06-30 18:35 - 2013-06-30 18:35 - 00003513 _____ C:\AdwCleaner[S12].txt
2013-06-30 18:35 - 2013-06-30 18:34 - 00003301 _____ C:\AdwCleaner[R12].txt
2013-06-30 18:30 - 2012-02-04 12:20 - 00000000 ____D C:\Users\Ecksperts\AppData\Roaming\BOM
2013-06-30 12:12 - 2013-06-30 12:06 - 00010792 _____ C:\AdwCleaner[S11].txt
2013-06-30 12:12 - 2012-02-02 11:49 - 00000913 _____ C:\Users\Ecksperts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-30 12:12 - 2012-02-02 11:49 - 00000913 _____ C:\Users\Ecksperts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-30 12:05 - 2013-06-30 12:04 - 00010846 _____ C:\AdwCleaner[R11].txt
2013-06-30 12:05 - 2011-06-11 02:58 - 00773712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2013-06-30 12:05 - 2011-06-11 02:58 - 00420944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2013-06-26 17:18 - 2013-06-26 17:18 - 00000000 ____D C:\Program Files (x86)\IncrediMail
2013-06-26 11:10 - 2013-06-26 10:47 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-26 11:10 - 2013-06-26 10:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-26 10:28 - 2013-06-26 08:48 - 00000000 ____D C:\Program Files (x86)\RegTask
2013-06-26 10:27 - 2013-06-26 08:48 - 00000000 ____D C:\ProgramData\RegTask
2013-06-26 10:11 - 2013-06-26 08:48 - 00003602 _____ C:\Windows\System32\Tasks\RegTask
2013-06-24 00:57 - 2006-11-02 14:35 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 16:27

==================== End Of Log ============================
--- --- ---
Antwort
Seite 1 von 2 1 2

Themen zu Problem mit "Coupondropdown und ism.sitescout.com popups"
.com, andere, anderen, anfänger, bereits, fenster, forum, hintergrund, interne, internet, leute, neues, neuling, nischen, plötzlich, popups, problem, seite, seiten, super, tagen, unterwegs, versucht, vorgehensweise, vorsicht, worte


« internet zugang manchmal blckiert | Mozilla macht sich selbständig »


Ähnliche Themen: Problem mit "Coupondropdown und ism.sitescout.com popups"


  1. Problem beim Öffnen aller Programme ("Ungültiges Bild -..*.dll."st entweder..")
    Log-Analyse und Auswertung - 09.02.2015 (11)
  2. Diverse Malware ("CoolSaleCoupon", "ddownlloaditkeep", "omiga-plus", "SaveSense", "SaleItCoupon"); lahmer PC & viel Werbung!
    Plagegeister aller Art und deren Bekämpfung - 11.01.2015 (16)
  3. Herzlichen Dank "Schrauber" - "Problem mit der Gruppenrichtlinie" blockiert" gelöst
    Lob, Kritik und Wünsche - 11.12.2014 (0)
  4. Drathlosnetzwerkadapter seit letzter Zeit "im Arsch". Problembehandlung "behebt" Problem dann immer?
    Netzwerk und Hardware - 18.09.2014 (4)
  5. "monstermarketplace.com" Infektion und ihre Folgen; "Anti-Virus-Blocker"," unsichtbare Toolbars" + "Browser-Hijacker" von selbst installiert
    Log-Analyse und Auswertung - 16.11.2013 (21)
  6. "Antiviren Werbung" "Langsamer PC" "PC stürzt ab" Banner und Popups beim surfen
    Plagegeister aller Art und deren Bekämpfung - 05.11.2013 (28)
  7. Änliches Problem wie im Thread "Antiviren Werbung, Banner und Popups" vom 24.09.2013
    Plagegeister aller Art und deren Bekämpfung - 29.09.2013 (3)
  8. Probleme mit: Coupondropdown und ism.sitescout.com popups / browser Fenster Öffnung
    Plagegeister aller Art und deren Bekämpfung - 19.07.2013 (23)
  9. Malware: "Click to Continue > by CouponDropDown" entfernen
    Plagegeister aller Art und deren Bekämpfung - 20.03.2013 (7)
  10. Malware Problem "Savenow", "Superfish" etc.
    Plagegeister aller Art und deren Bekämpfung - 30.11.2012 (30)
  11. "rundll-Problem" und "USB-Gerät wird nicht erkannt....." - bin am verzweifeln!
    Plagegeister aller Art und deren Bekämpfung - 04.10.2012 (48)
  12. Bildschirm dunkel und Fehlermeldung "Kritischer Fehler der Festplatte" , " Problem mit Sata Festplat
    Log-Analyse und Auswertung - 23.08.2011 (4)
  13. Win XP Start " Net Reactor 10 Fenster"danach "Firefox Problem 2 Fenster" danach "Blue Screen"
    Log-Analyse und Auswertung - 09.07.2011 (3)
  14. Rogue-Malware "EASY SCAN" alias "HDD Low" Problem beseitigt?
    Plagegeister aller Art und deren Bekämpfung - 30.12.2010 (9)
  15. Problem mit "TR/TDss.AE.22" und "TR/Crypt.XPACK.Gen"
    Mülltonne - 16.12.2008 (0)
  16. "Adware.Virtumonde"/"Downloader.MisleadApp"/"TR/VB.agt.4"/"NewDotNet.A.1350"/"Fakerec
    Plagegeister aller Art und deren Bekämpfung - 22.08.2008 (6)
  17. ">"">><meta http-equiv="Refresh" content="0;url=http://askimizsonsuza.com/code/">"">
    Plagegeister aller Art und deren Bekämpfung - 04.09.2006 (4)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Problem mit "Coupondropdown und ism.sitescout.com popups" - Hallo Leute, als Neuling in diesem Forum möchte ich Euch grüßen! Seit einigen Tagen habe ich das Problem, dass wenn ich ganz normal im Internet unterwegs bin, sich plötzlich im - Problem mit "Coupondropdown und ism.sitescout.com popups"...
Archiv
Du betrachtest: Problem mit "Coupondropdown und ism.sitescout.com popups" auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130