Click-Compare Trojaner in Mozilla Firefox auf Windows 7

Lautrer285 · 13.11.2013, 19:32

Hallo,

ich habe mir seit kurzem wohl den Click Compare Trojaner eingefangen - immer wird mir Werbung angezeigt bzw. werden einzelne Wörter mit Werbung verlinkt, was extrem nervt

Es wäre super, wenn mir einer der Experten hier helfen könnte, so wie schon denjenigen, die das gleiche Problem hatten.

In den Anhang hab ich Logs mit Funden gepackt (aus Avira Free Antivirus) - hoffe das ist erstmal richtig so.

Danke schon mal im Vorraus für eure Hilfe!

LG

cosinus · 13.11.2013, 22:51

Hallo und

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Lautrer285 · 14.11.2013, 21:11

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013
Ran by Fabian (administrator) on FABIAN-PC on 14-11-2013 21:01:27
Running from C:\Users\Fabian\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11465832 2011-03-25] (Realtek Semiconductor)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [2991856 2013-02-21] (Logitech, Inc.)
HKLM-x32\...\Winlogon: [Userinit] userinit.exeC:\Users\Fabian\AppData\Roaming\appconf32.exe, [x]
Winlogon\Notify\LBTWlgn: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
Winlogon\Notify\ScCertProp: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
HKCU\...\Run: [AdobeBridge] - [x]
MountPoints2: {3d455bef-5715-11e0-ac10-bcaec5908bfb} - G:\Setupx.exe
MountPoints2: {db387408-ed93-11e0-a06a-bcaec5908bfb} - F:\MI.exe
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-10] (Avira Operations GmbH & Co. KG)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=43169&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=43169&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=43169&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=43169&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.search-guide.info/?pid=1273&r=2013/11/03&hid=4801500536052806085&lg=EN&cc=DE&unqvl=40
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=43169&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=43169&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&st=chrome&q=
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://search.certified-toolbar.com?si=43169&st=bs&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://search.certified-toolbar.com?si=43169&st=bs&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&q={searchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.search-guide.info/?l=1&q={searchTerms}&pid=1273&r=2013/11/03&hid=4801500536052806085&lg=EN&cc=DE&unqvl=40
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://search.certified-toolbar.com?si=43169&st=bs&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://search.certified-toolbar.com?si=43169&st=bs&tid=3580&ts=1380801136088&tguid=43169-3580-1380801099485-549619&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=100512_4_&babsrc=SP_ss&mntrId=6e996bff000000000000bcaec5908bfb
SearchScopes: HKCU - {296A8EC1-6935-498C-A22F-CFCBA893FCE6} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=C6C153A1-D7E3-47AB-87AF-671F87B7AEAC&apn_sauid=24B632B8-7FA7-4F75-A027-DD677F9E1A38
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.search-guide.info/?l=1&q={searchTerms}&pid=1273&r=2013/11/03&hid=4801500536052806085&lg=EN&cc=DE&unqvl=40
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb201/?search={searchTerms}&loc=IB_DS&a=6PQSSDjEJS&i=26
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: YoutubeAdblocker - {973313F0-95A8-4376-A4AE-170C2B9E7124} - C:\Program Files (x86)\YoutubeAdblocker\VKbuklKmD.x64.dll ()
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Downuload kEePeri - {EDABF6B4-242F-2D75-A493-9B87FB3341C9} - C:\Program Files (x86)\Downuload kEePeri\dYcKMpdlZ.x64.dll ()
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Plus-HD-3.8 - {11111111-1111-1111-1111-110311901130} - C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-bho.dll (Plus HD)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Iminent.WebBooster.InternetExplorer.dll (Iminent)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=1.1.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @protectdisc.com/NPPDLicenseHelper - C:\Users\Fabian\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\searchplugins\ChatZumSearch.xml
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\searchplugins\WebSearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Plus-HD-3.8 - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\c17236e8-fd66-44bc-aeef-1e00981cbb64@0a4ee0fe-5356-4fd3-b37c-5cd5671a315c.com
FF Extension: vis - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM
FF Extension: Pocket - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\isreaditlater@ideashower.com
FF Extension: Downuload kEePeri - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\rwtolshnjp@yay-.org
FF Extension: YoutubeAdblocker - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\ykfv@jqieuia.edu
FF Extension: Forecastfox - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF Extension: FireShot - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
FF Extension: DownloadHelper - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: addon - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\addon@music-clips.net.xpi
FF Extension: webbooster - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\webbooster@iminent.com.xpi
FF Extension: No Name - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\WTB_GLOBAL.sqlite
FF Extension: Adblock Plus - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\i29fpa19.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files (x86)\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF HKLM-x32\...\Firefox\Extensions: [{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}] - C:\Users\Fabian\AppData\Roaming\14001.008
FF Extension: Java Link Helper - C:\Users\Fabian\AppData\Roaming\14001.008
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF HKCU\...\Firefox\Extensions: [{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}] - C:\Users\Fabian\AppData\Roaming\14001.008
FF Extension: Java Link Helper - C:\Users\Fabian\AppData\Roaming\14001.008

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (SearchNewTab) - C:\Users\Fabian\AppData\Local\Google\Chrome\User Data\Default\Extensions\akddhpmdpeokcjhlmnmnkeinaegjgclm\1.0
CHR Extension: (Downuload kEePeri) - C:\Users\Fabian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dimfabmnpanhkfdohnaoijdblajiajje\1.6
CHR Extension: () - C:\Users\Fabian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab\background.html
CHR Extension: (YoutubeAdblocker) - C:\Users\Fabian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkcfpechfooddnepkjndghdjdiagabbg\1.0
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Users\Fabian\AppData\Roaming\BabylonToolbar\CR\BabylonChrome1.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx
CHR HKLM-x32\...\Chrome\Extension: [icmlaeflemplmjndnaapfdbbnpncnbda] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Fabian\AppData\Local\Wajam\Chrome\wajam.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe [527728 2012-11-15] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78072 2012-11-15] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [389488 2012-11-15] ()
S4 IBUpdaterService; C:\Windows\system32\dmwu.exe [1762608 2013-09-15] ()
S4 SProtection; C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe [2868544 2013-08-07] (Iminent)
S2 TuneUp.UtilitiesSvc; "C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [83160 2013-10-10] (Avira Operations GmbH & Co. KG)
S3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [177920 2011-09-06] (HID Global Corporation)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [42248 2012-11-15] (AnchorFree Inc.)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [513080 2011-03-25] ()
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [40712 2012-11-15] (Anchorfree Inc.)
U3 aelo92qp; C:\Windows\System32\Drivers\aelo92qp.sys [0 ] (Advanced Micro Devices)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-14 21:01 - 2013-11-14 21:01 - 00022950 _____ C:\Users\Fabian\Desktop\FRST.txt
2013-11-14 21:01 - 2013-11-14 21:01 - 00000000 ____D C:\FRST
2013-11-14 21:00 - 2013-11-14 21:00 - 01957794 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2013-11-12 07:49 - 2013-11-13 19:25 - 00005100 _____ C:\Users\Fabian\Desktop\Avira Free Antivirus_Fund.txt
2013-11-12 07:43 - 2013-11-12 07:43 - 00000000 ____D C:\Users\Fabian\AppData\Roaming\Avira
2013-11-12 07:37 - 2013-11-12 07:37 - 00002070 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-12 07:37 - 2013-11-12 07:37 - 00000000 ____D C:\ProgramData\Avira
2013-11-12 07:37 - 2013-11-12 07:37 - 00000000 ____D C:\Program Files (x86)\Avira
2013-11-12 07:37 - 2013-10-10 19:14 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-12 07:37 - 2013-10-10 19:14 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-12 07:37 - 2013-10-10 19:14 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-12 07:37 - 2013-10-10 19:14 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-12 07:33 - 2013-11-12 07:35 - 123853152 _____ C:\Users\Fabian\Downloads\avira_free_antivirus_de_14b411.exe
2013-11-10 22:11 - 2013-11-10 22:49 - 907791140 _____ C:\Users\Fabian\Desktop\Harvey_Weinstein_talks_with_Steven_G_tjen_at_the_ZFF_Masters_Dreicast_Production.flv
2013-11-10 22:10 - 2013-11-10 23:04 - 666401072 _____ C:\Users\Fabian\Desktop\Tim_Bevan_talks_with_Scott_Roxborough_at_the_ZFF_Masters_Dreicast_Production.flv
2013-11-10 22:00 - 2013-11-10 22:00 - 01073262 _____ C:\Users\Fabian\Desktop\adwcleaner.exe
2013-11-10 21:21 - 2013-11-10 21:21 - 00602112 _____ (OldTimer Tools) C:\Users\Fabian\Desktop\otl.exe
2013-11-10 08:30 - 2013-11-13 21:49 - 00000000 ____D C:\Users\Fabian\Desktop\Bachelorarbeit DRUCK FINAL
2013-11-10 08:30 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\Krisen-PR
2013-11-10 08:30 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\DCIM
2013-11-10 08:30 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\Bachelorarbeit Max Schwarz
2013-11-03 19:30 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-03 19:30 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-03 19:30 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-03 19:30 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-03 19:29 - 2013-11-03 19:30 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-03 18:47 - 2013-11-03 19:22 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-11-03 18:46 - 2013-11-03 18:46 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Fabian\Downloads\SpyHunter-Installer.exe
2013-11-03 18:32 - 2013-11-03 19:06 - 00000000 ____D C:\ProgramData\SearchNewTab
2013-11-03 18:32 - 2013-11-03 19:06 - 00000000 ____D C:\Program Files (x86)\WebSearch
2013-11-03 18:32 - 2013-11-03 19:01 - 00000000 ____D C:\Program Files (x86)\SearchNewTab
2013-11-03 18:31 - 2013-11-14 20:31 - 00000450 ____H C:\Windows\Tasks\ss u helper-S-9665547.job
2013-11-03 18:31 - 2013-11-12 07:45 - 00000000 ____D C:\Program Files (x86)\YoutubeAdblocker
2013-11-03 18:31 - 2013-11-12 07:45 - 00000000 ____D C:\Program Files (x86)\Ss_Helper
2013-11-03 18:31 - 2013-11-12 07:45 - 00000000 ____D C:\Program Files (x86)\Downuload kEePeri
2013-11-03 18:31 - 2013-11-03 19:01 - 00000000 ____D C:\ProgramData\9b28c3eaf6f8df39
2013-11-03 18:31 - 2013-11-03 18:32 - 00000000 ____D C:\ProgramData\WinterSoft
2013-11-03 18:31 - 2013-11-03 18:32 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-03 18:31 - 2013-11-03 18:31 - 00002696 _____ C:\Windows\System32\Tasks\ss u helper-S-9665547
2013-11-03 18:31 - 2013-11-03 18:31 - 00000000 ____D C:\Users\Fabian\AppData\Local\Packages
2013-11-03 18:31 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\YoutubeAdblocker
2013-11-03 18:31 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\Downuload kEePeri
2013-10-26 21:02 - 2013-10-26 21:02 - 02705736 _____ (Pokki) C:\Users\Fabian\Downloads\PokkiInstaller.exe

==================== One Month Modified Files and Folders =======

2013-11-14 21:01 - 2013-11-14 21:01 - 00022950 _____ C:\Users\Fabian\Desktop\FRST.txt
2013-11-14 21:01 - 2013-11-14 21:01 - 00000000 ____D C:\FRST
2013-11-14 21:00 - 2013-11-14 21:00 - 01957794 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2013-11-14 20:54 - 2011-03-25 18:47 - 01504149 _____ C:\Windows\WindowsUpdate.log
2013-11-14 20:36 - 2012-04-02 08:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-14 20:31 - 2013-11-03 18:31 - 00000450 ____H C:\Windows\Tasks\ss u helper-S-9665547.job
2013-11-14 19:52 - 2009-07-14 05:45 - 00017888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-14 19:52 - 2009-07-14 05:45 - 00017888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-14 19:50 - 2009-07-14 11:49 - 00657698 _____ C:\Windows\system32\perfh007.dat
2013-11-14 19:50 - 2009-07-14 11:49 - 00131070 _____ C:\Windows\system32\perfc007.dat
2013-11-14 19:50 - 2009-07-14 06:13 - 01507566 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-14 19:48 - 2013-10-03 12:48 - 00001830 _____ C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job
2013-11-14 19:48 - 2013-10-03 12:48 - 00001292 _____ C:\Windows\Tasks\Plus-HD-3.8-updater.job
2013-11-14 19:48 - 2013-10-03 12:48 - 00001198 _____ C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job
2013-11-14 19:48 - 2013-10-03 12:48 - 00001096 _____ C:\Windows\Tasks\Plus-HD-3.8-enabler.job
2013-11-14 19:44 - 2012-04-28 05:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-14 19:44 - 2011-03-25 20:20 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-14 19:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-14 19:44 - 2009-07-14 05:51 - 00117669 _____ C:\Windows\setupact.log
2013-11-14 07:43 - 2011-03-25 19:11 - 00000000 ____D C:\Users\Fabian\AppData\Local\Mozilla
2013-11-14 07:43 - 2011-03-25 19:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 07:38 - 2011-03-25 21:05 - 00000000 ____D C:\Users\Fabian\AppData\Local\Adobe
2013-11-13 21:49 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\Bachelorarbeit DRUCK FINAL
2013-11-13 19:25 - 2013-11-12 07:49 - 00005100 _____ C:\Users\Fabian\Desktop\Avira Free Antivirus_Fund.txt
2013-11-12 21:14 - 2013-05-03 12:26 - 00000000 ____D C:\Users\Fabian\Desktop\Masterstudium Materialien
2013-11-12 21:13 - 2013-02-21 10:57 - 00000000 ____D C:\Users\Fabian\Desktop\Bewerbungsdokumente
2013-11-12 21:13 - 2011-06-08 20:39 - 00000132 _____ C:\Users\Fabian\AppData\Roaming\Adobe PNG Format CS5 Prefs
2013-11-12 18:34 - 2010-09-14 20:40 - 00139914 _____ C:\Windows\PFRO.log
2013-11-12 07:48 - 2013-10-03 12:48 - 00000000 ____D C:\Program Files (x86)\Plus-HD-3.8
2013-11-12 07:45 - 2013-11-03 18:31 - 00000000 ____D C:\Program Files (x86)\YoutubeAdblocker
2013-11-12 07:45 - 2013-11-03 18:31 - 00000000 ____D C:\Program Files (x86)\Ss_Helper
2013-11-12 07:45 - 2013-11-03 18:31 - 00000000 ____D C:\Program Files (x86)\Downuload kEePeri
2013-11-12 07:43 - 2013-11-12 07:43 - 00000000 ____D C:\Users\Fabian\AppData\Roaming\Avira
2013-11-12 07:37 - 2013-11-12 07:37 - 00002070 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-12 07:37 - 2013-11-12 07:37 - 00000000 ____D C:\ProgramData\Avira
2013-11-12 07:37 - 2013-11-12 07:37 - 00000000 ____D C:\Program Files (x86)\Avira
2013-11-12 07:37 - 2013-04-03 08:30 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-12 07:35 - 2013-11-12 07:33 - 123853152 _____ C:\Users\Fabian\Downloads\avira_free_antivirus_de_14b411.exe
2013-11-10 23:05 - 2012-09-16 13:45 - 00000000 ____D C:\Users\Fabian\dwhelper
2013-11-10 23:04 - 2013-11-10 22:10 - 666401072 _____ C:\Users\Fabian\Desktop\Tim_Bevan_talks_with_Scott_Roxborough_at_the_ZFF_Masters_Dreicast_Production.flv
2013-11-10 22:49 - 2013-11-10 22:11 - 907791140 _____ C:\Users\Fabian\Desktop\Harvey_Weinstein_talks_with_Steven_G_tjen_at_the_ZFF_Masters_Dreicast_Production.flv
2013-11-10 22:00 - 2013-11-10 22:00 - 01073262 _____ C:\Users\Fabian\Desktop\adwcleaner.exe
2013-11-10 21:21 - 2013-11-10 21:21 - 00602112 _____ (OldTimer Tools) C:\Users\Fabian\Desktop\otl.exe
2013-11-10 08:32 - 2012-04-21 09:39 - 00000000 ____D C:\Users\Fabian\AppData\Roaming\Dropbox
2013-11-10 08:31 - 2012-04-21 09:40 - 00000000 ___RD C:\Users\Fabian\Dropbox
2013-11-10 08:30 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\Krisen-PR
2013-11-10 08:30 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\DCIM
2013-11-10 08:30 - 2013-11-10 08:30 - 00000000 ____D C:\Users\Fabian\Desktop\Bachelorarbeit Max Schwarz
2013-11-10 08:30 - 2013-04-22 18:33 - 00000000 ____D C:\Users\Fabian\Desktop\BACHELORARBEIT
2013-11-08 20:33 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-04 21:14 - 2012-04-14 10:23 - 00000000 ____D C:\Users\Fabian\Desktop\Dokumente
2013-11-03 19:49 - 2012-03-31 17:50 - 00000000 ____D C:\Users\Fabian\Desktop\FOTOS
2013-11-03 19:30 - 2013-11-03 19:29 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-03 19:30 - 2013-09-16 07:21 - 00000000 ____D C:\ProgramData\Oracle
2013-11-03 19:30 - 2011-04-01 22:49 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-03 19:22 - 2013-11-03 18:47 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-11-03 19:06 - 2013-11-03 18:32 - 00000000 ____D C:\ProgramData\SearchNewTab
2013-11-03 19:06 - 2013-11-03 18:32 - 00000000 ____D C:\Program Files (x86)\WebSearch
2013-11-03 19:01 - 2013-11-03 18:32 - 00000000 ____D C:\Program Files (x86)\SearchNewTab
2013-11-03 19:01 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\9b28c3eaf6f8df39
2013-11-03 18:46 - 2013-11-03 18:46 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Fabian\Downloads\SpyHunter-Installer.exe
2013-11-03 18:32 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\WinterSoft
2013-11-03 18:32 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-03 18:31 - 2013-11-03 18:31 - 00002696 _____ C:\Windows\System32\Tasks\ss u helper-S-9665547
2013-11-03 18:31 - 2013-11-03 18:31 - 00000000 ____D C:\Users\Fabian\AppData\Local\Packages
2013-11-03 18:31 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\YoutubeAdblocker
2013-11-03 18:31 - 2013-11-03 18:31 - 00000000 ____D C:\ProgramData\Downuload kEePeri
2013-11-01 18:43 - 2012-04-25 10:49 - 00000000 ____D C:\Users\Fabian\Documents\Musiclips.net
2013-10-26 21:02 - 2013-10-26 21:02 - 02705736 _____ (Pokki) C:\Users\Fabian\Downloads\PokkiInstaller.exe
2013-10-26 20:07 - 2012-04-06 22:54 - 00000000 ____D C:\Users\Fabian\Documents\iRinger Tones
2013-10-26 20:06 - 2012-04-06 22:40 - 00000000 ____D C:\ProgramData\iRinger
2013-10-20 17:37 - 2011-05-23 19:25 - 00000000 ____D C:\Users\Fabian\Desktop\INTERESTING STUFF
2013-10-16 18:12 - 2013-10-03 12:48 - 00004322 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-updater
2013-10-15 18:05 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

Some content of TEMP:
====================
C:\Users\Fabian\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe
C:\Users\Fabian\AppData\Local\Temp\AskSLib.dll
C:\Users\Fabian\AppData\Local\Temp\audiotranscoderc.exe
C:\Users\Fabian\AppData\Local\Temp\avgnt.exe
C:\Users\Fabian\AppData\Local\Temp\BabylonTB.exe
C:\Users\Fabian\AppData\Local\Temp\chatzum_softonic_yahoo_62_v5.exe
C:\Users\Fabian\AppData\Local\Temp\converter-setup.exe
C:\Users\Fabian\AppData\Local\Temp\DivXSetup.exe
C:\Users\Fabian\AppData\Local\Temp\FreemakeVideoDownloader_3.4.1.1.exe
C:\Users\Fabian\AppData\Local\Temp\IminentSetup.exe
C:\Users\Fabian\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Fabian\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Fabian\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Fabian\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Fabian\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe
C:\Users\Fabian\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Fabian\AppData\Local\Temp\LMkRstPt.exe
C:\Users\Fabian\AppData\Local\Temp\octF326.tmp.exe
C:\Users\Fabian\AppData\Local\Temp\OptimizerPro.exe
C:\Users\Fabian\AppData\Local\Temp\Quarantine.exe
C:\Users\Fabian\AppData\Local\Temp\SHSetup.exe
C:\Users\Fabian\AppData\Local\Temp\tbuAA39.exe
C:\Users\Fabian\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Fabian\AppData\Local\Temp\wajam_install.exe
C:\Users\Fabian\AppData\Local\Temp\ydetect.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-10 22:51

==================== End Of Log ============================

--- --- ---

[/CODE]

und

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-11-2013
Ran by Fabian at 2013-11-14 21:02:10
Running from C:\Users\Fabian\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

"Nero SoundTrax Help (x32 Version: 4.4.32.0)
Adobe AIR (x32 Version: 3.6.0.6090)
Adobe Community Help (x32 Version: 3.0.0)
Adobe Community Help (x32 Version: 3.0.0.400)
Adobe Creative Suite 5 Master Collection (x32 Version: 5.0)
Adobe Download Assistant (x32 Version: 1.2.5)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Advertising Center (x32 Version: 0.0.0.2)
Amazon Kindle (x32)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Audio Transcoder (Version: 2.8)
Avira Free Antivirus (x32 Version: 14.0.0.411)
Bonjour (Version: 3.0.0.10)
Browser Updater 1.1 (x32)
calibre (x32 Version: 0.9.22)
DAEMON Tools Lite (x32 Version: 4.40.2.0131)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
DivX-Setup (x32 Version: 2.6.1.24)
DolbyFiles (x32 Version: 2.0)
Downuload kEePeri (x32 Version: 3.0.0.1547)
Dropbox (HKCU Version: 2.0.22)
DVD Decrypter (Remove Only) (x32)
ElsterFormular (x32 Version: 13.4.1.10296)
eReg (x32 Version: 1.20.138.34)
Free Audio CD Burner version 1.4.7 (x32)
Free Audio Dub version 1.7.9.908 (x32 Version: 1.7.9.908)
Free M4a to MP3 Converter 7.1 (x32)
Free PDF to Word Doc Converter v1.1 (x32 Version: 1.1)
Free WAV to MP3 Converter (x32)
Freemake Video Converter Version 3.1.1 (x32 Version: 3.1.1)
Hotspot Shield 2.78 (x32 Version: 2.78)
IB Updater Service (x32 Version: 4.0.7.3)
Image Resizer for Windows (64 bit) (Version: 3.0.4802.35565)
Image Resizer for Windows (x32 Version: 3.0.4802.35565)
ImagXpress (x32 Version: 7.0.74.0)
Iminent (x32 Version: 6.37.21.0)
IrfanView (remove only) (x32 Version: 4.35)
iTunes (Version: 11.0.5.5)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 35 (x32 Version: 6.0.350)
Kalender-Excel-8.9 (x32 Version: 8.9)
LLB iBanking (Version: 1.10.3)
Logitech SetPoint 6.52 (Version: 6.52.74)
Menu Templates - Pack 1 (x32 Version: 9.4.6.0)
Menu Templates - Pack 2 (x32 Version: 9.4.6.0)
Menu Templates - Pack 3 (x32 Version: 9.4.6.0)
Menu Templates - Starter Kit (x32 Version: 9.4.6.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Movie Templates - Pack 1 (x32 Version: 9.4.6.0)
Movie Templates - Starter Kit (x32 Version: 9.4.6.0)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 25.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nero 9 (x32)
Nero Burning ROM Help (x32 Version: 9.4.17.100)
Nero BurnRights (x32 Version: 3.4.11.100)
Nero BurnRights Help (x32 Version: 3.4.4.100)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero CoverDesigner (x32 Version: 4.4.9.100)
Nero CoverDesigner Help (x32 Version: 4.4.9.100)
Nero Disc Copy Gadget (x32 Version: 2.4.22.0)
Nero Disc Copy Gadget Help (x32 Version: 2.4.22.0)
Nero DiscSpeed (x32 Version: 5.4.12.100)
Nero DiscSpeed Help (x32 Version: 5.4.4.100)
Nero DriveSpeed (x32 Version: 4.4.11.100)
Nero DriveSpeed Help (x32 Version: 4.4.4.100)
Nero Express Help (x32 Version: 9.4.17.100)
Nero InfoTool (x32 Version: 6.4.11.100)
Nero InfoTool Help (x32 Version: 6.4.4.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero PhotoSnap (x32 Version: 1.53.2.0)
Nero PhotoSnap Help (x32 Version: 1.53.2.0)
Nero Recode (x32 Version: 4.4.31.0)
Nero Recode Help (x32 Version: 4.4.31.0)
Nero Rescue Agent (x32 Version: 2.4.12.100)
Nero RescueAgent Help (x32 Version: 2.4.4.100)
Nero StartSmart (x32 Version: 9.4.12.100)
Nero StartSmart Help (x32 Version: 9.4.12.100)
Nero Vision (x32 Version: 6.4.10.205)
Nero Vision Help (x32 Version: 6.4.8.100)
Nero WaveEditor (x32 Version: 5.4.32.0)
NeroBurningROM (x32 Version: 9.4.17.100)
NeroExpress (x32 Version: 9.4.17.100)
NeroLiveGadget (x32 Version: 1.2.16.100)
NeroLiveGadget Help (x32 Version: 1.2.16.100)
neroxml (x32 Version: 1.0.0)
Nur Deinstallierung der CopyTrans Suite möglich. (HKCU Version: 2.27)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA HD-Audiotreiber 1.1.13.1 (Version: 1.1.13.1)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (x32 Version: 9.10.0514)
NVIDIA PhysX-Systemsoftware 9.10.0514 (Version: 9.10.0514)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Pazera Free MP4 to AVI Converter 1.6 (x32 Version: 1.6)
PDF Settings CS5 (x32 Version: 10.0)
PDF24 Creator 5.2.0 (x32)
Plus-HD-3.8 (x32 Version: 1.27.153.11)
Protect Disc License Helper 1.0.125 (IE) (HKCU Version: 1.0.125)
ProtectDisc Driver, Version 11 (x32 Version: 11.0.0.14)
Protected Search 1.1 (x32)
PxMergeModule (x32 Version: 1.00.0000)
QuickTime (x32 Version: 7.74.80.86)
Realtek Ethernet Controller Driver (x32 Version: 7.31.1025.2010)
Realtek Ethernet Diagnostic Utility (x32 Version: 1.00.0000)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6196)
Revo Uninstaller 1.94 (x32 Version: 1.94)
SoundTrax (x32 Version: 4.4.32.0)
ss u helper (x32 Version: 2.0.0.1697)
Ss_Helper 1.74 (x32)
TIPP10 Version 2.1.0 (x32)
TP-LINK Wireless Client Utility (x32 Version: 7.0)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.2013.181)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 64-Bit Edition
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
Veoh Web Player (x32 Version: 1.1.2.0000)
VIS (x32)
VLC media player 1.1.8 (x32 Version: 1.1.8)
VoiceOver Kit (x32 Version: 1.40.128.0)
WinPcap 4.1.2 (x32 Version: 4.1.0.2001)
WinRAR 4.01 (32-Bit) (x32 Version: 4.01.0)
WinRAR 4.01 (64-Bit) (Version: 4.01.0)
Yahoo! Detect (x32)
Youtube Downloader HD v. 2.9.5 (x32)
YoutubeAdblocker (x32 Version: 3.0.0.1547)

==================== Restore Points  =========================

08-11-2013 09:35:16 Windows Update
12-11-2013 06:09:01 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2011-03-25 20:50 - 00000854 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com

==================== Scheduled Tasks (whitelisted) =============

Task: {095E4AC9-893D-4AC1-9489-876501478C04} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
Task: {0ED71760-04D3-4FDC-9202-216FD5C44C71} - System32\Tasks\Plus-HD-3.8-codedownloader => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-codedownloader.exe [2013-10-03] (Plus HD)
Task: {2FD9016F-B62B-4726-B491-4D1E65FFFE22} - System32\Tasks\ss u helper-S-9665547 => c:\programdata\wintersoft\ss u helper\ss u helper.exe
Task: {47349CC4-D7DB-4B0D-BDB2-7AF821BDBA41} - System32\Tasks\Plus-HD-3.8-enabler => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-enabler.exe
Task: {6F839B6A-DAB4-4F29-B32F-671C3A14931C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {7B45FE6D-F55A-4340-B5E9-C40B94CA9257} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {7CCF24C5-1CB6-431A-A8F0-202F5925207F} - System32\Tasks\Plus-HD-3.8-updater => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-updater.exe [2013-10-03] (Plus HD)
Task: {9AD50BBE-4B7B-439B-84BA-EFED45F27917} - System32\Tasks\AdobeAAMUpdater-1.0-Fabian-PC-Fabian => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {B7CD0811-3566-46B5-A6AE-F83364543DB3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C1FE5559-451F-4483-8055-230B5539158F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {C89C3EBE-6EDF-4027-84A8-368DFFEF4D00} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2013-02-13] ()
Task: {F60577B1-ECBB-4C19-A594-53EC3A233DA3} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {F6773296-6A6F-4D06-AD50-A7A9B38E7EE9} - System32\Tasks\Plus-HD-3.8-firefoxinstaller => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-firefoxinstaller.exe [2013-10-03] (Plus HD)
Task: {FE0433CC-9C91-4BD3-8C26-6BDA0184F9DD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-codedownloader.exe
Task: C:\Windows\Tasks\Plus-HD-3.8-enabler.job => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-enabler.exe
Task: C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-firefoxinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-3.8-updater.job => C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-updater.exe
Task: C:\Windows\Tasks\ss u helper-S-9665547.job => c:\programdata\wintersoft\ss u helper\ss u helper.exe

==================== Loaded Modules (whitelisted) =============

2011-03-16 23:07 - 2011-03-16 23:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2011-10-10 20:37 - 2011-05-28 21:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2013-11-12 07:37 - 2013-10-10 19:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-09-27 06:23 - 2011-09-27 06:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 06:22 - 2011-09-27 06:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-11-15 04:03 - 2012-11-15 04:03 - 00715632 _____ () C:\Program Files (x86)\Hotspot Shield\bin\af_proxy.dll
2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2011-03-25 19:11 - 2013-11-14 07:43 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-03-16 23:11 - 2011-03-16 23:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-10-10 21:36 - 2013-10-10 21:36 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/13/2013 09:19:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (11/13/2013 09:19:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (11/13/2013 09:19:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (11/03/2013 06:33:14 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (10/25/2013 07:16:27 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pdf24-Editor.exe, Version: 5.2.0.0, Zeitstempel: 0x50c84e02
Name des fehlerhaften Moduls: pdf24-Editor.exe, Version: 5.2.0.0, Zeitstempel: 0x50c84e02
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00030535
ID des fehlerhaften Prozesses: 0x111c
Startzeit der fehlerhaften Anwendung: 0xpdf24-Editor.exe0
Pfad der fehlerhaften Anwendung: pdf24-Editor.exe1
Pfad des fehlerhaften Moduls: pdf24-Editor.exe2
Berichtskennung: pdf24-Editor.exe3

Error: (10/03/2013 10:11:19 PM) (Source: Microsoft Security Client Setup) (User: Fabian-PC)
Description: HRESULT:0x8004FF0A
Description:Upgrade installation canceled. To upgrade later, run the Security Essentials Upgrade Wizard again. Error code:0x8004FF0A.

Error: (10/03/2013 08:07:58 PM) (Source: Microsoft Security Client Setup) (User: Fabian-PC)
Description: HRESULT:0x8004FF0A
Description:Upgrade installation canceled. To upgrade later, run the Security Essentials Upgrade Wizard again. Error code:0x8004FF0A.

Error: (10/03/2013 06:40:31 PM) (Source: ESENT) (User: )
Description: taskhost (1708) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\Fabian\AppData\Local\Microsoft\Windows\WebCache\V01.log.

Error: (10/03/2013 06:40:31 PM) (Source: ESENT) (User: )
Description: taskhost (1708) WebCacheLocal: Versuch, Datei "C:\Users\Fabian\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (10/03/2013 06:40:21 PM) (Source: ESENT) (User: )
Description: taskhost (1708) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\Fabian\AppData\Local\Microsoft\Windows\WebCache\V01.log.


System errors:
=============
Error: (11/14/2013 07:47:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (11/14/2013 07:47:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (11/14/2013 07:44:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TuneUp Utilities Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/14/2013 07:44:34 PM) (Source: SCardSvr) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (11/14/2013 07:44:34 PM) (Source: SCardSvr) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (11/14/2013 07:30:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (11/14/2013 07:30:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (11/14/2013 07:28:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TuneUp Utilities Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/14/2013 07:28:16 AM) (Source: SCardSvr) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (11/14/2013 07:28:16 AM) (Source: SCardSvr) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.


Microsoft Office Sessions:
=========================
Error: (11/13/2013 09:19:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest

Error: (11/13/2013 09:19:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest

Error: (11/13/2013 09:19:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest

Error: (11/03/2013 06:33:14 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Users\Fabian\Desktop\Downloads\SoftonicDownloader_fuer_pdf24-creator.exe

Error: (10/25/2013 07:16:27 AM) (Source: Application Error)(User: )
Description: pdf24-Editor.exe5.2.0.050c84e02pdf24-Editor.exe5.2.0.050c84e02c000000500030535111c01ced1499a5b2d12C:\Program Files (x86)\PDF24\pdf24-Editor.exeC:\Program Files (x86)\PDF24\pdf24-Editor.exefaa64940-3d3c-11e3-8523-bcaec5908bfb

Error: (10/03/2013 10:11:19 PM) (Source: Microsoft Security Client Setup)(User: Fabian-PC)
Description: HRESULT:0x8004FF0A
Description:Upgrade installation canceled. To upgrade later, run the Security Essentials Upgrade Wizard again. Error code:0x8004FF0A.

Error: (10/03/2013 08:07:58 PM) (Source: Microsoft Security Client Setup)(User: Fabian-PC)
Description: HRESULT:0x8004FF0A
Description:Upgrade installation canceled. To upgrade later, run the Security Essentials Upgrade Wizard again. Error code:0x8004FF0A.

Error: (10/03/2013 06:40:31 PM) (Source: ESENT)(User: )
Description: taskhost1708WebCacheLocal: C:\Users\Fabian\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)

Error: (10/03/2013 06:40:31 PM) (Source: ESENT)(User: )
Description: taskhost1708WebCacheLocal: C:\Users\Fabian\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (10/03/2013 06:40:21 PM) (Source: ESENT)(User: )
Description: taskhost1708WebCacheLocal: C:\Users\Fabian\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 4077.44 MB
Available physical RAM: 2009.08 MB
Total Pagefile: 8153.06 MB
Available Pagefile: 5789.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:156.93 GB) (Free:16.07 GB) NTFS
Drive d: () (Fixed) (Total:1240.23 GB) (Free:1231.65 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: 35325329)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=157 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=-867332784128) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 15.11.2013, 00:52

Zitat:

Windows 7 Enterprise Service Pack 1
127.0.0.1 activate.adobe.com

1. Enterprise Windows 7. Das steht nur Firmenkunden zur Verfügung, gewerbliche Rechner werden hier aber normalerweise nicht bereinigt. Das macht die IT-Abteilung.

2. Adobe-Aktivierungsserver auf den localhost geerdet schreit nach gecrackter Installation

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

Click-Compare Trojaner in Mozilla Firefox auf Windows 7

Log-Analyse und Auswertung: Click-Compare Trojaner in Mozilla Firefox auf Windows 7