Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
websearch.toolksearch.info Virus vollständig vom Rechner entfernen

websearch.toolksearch.info Virus vollständig vom Rechner entfernen


Log-Analyse und Auswertung: websearch.toolksearch.info Virus vollständig vom Rechner entfernen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 23.01.2014, 11:59   #1
susalisk
 
websearch.toolksearch.info Virus vollständig vom Rechner entfernen - Standard

websearch.toolksearch.info Virus vollständig vom Rechner entfernen


Hallo.

Ich habe mir dummerweise den websearch.toolksearch.info Virus beim Download einer freeware zugezogen. Daraufhin öffnete sich als neuer Tab im Firefox diese vermeintliche Suchmaschine. Mein Adblock, Ghostery und die Linkleiste sind komplett außer Kraft gesetzt. Werbung und krude Suchergebnisse sind die Folge.
Ich benutze windows 8 und als Antiviren-Software avast premier. Nach der vollständigen Überprüfung und automatischer Reparatur blieben immernoch 21 befallende Dateien übrig. Beim Startzeit-Scan mußte ich 3 Dateien ignorieren, die nicht in das Archiv passten. Alles andere ist jetzt im Container. Würde ja gern die avast logfiles schicken. Kann Sie aber nicht finden. Nach dem Browser Cleanup funktionieren alle Browser wieder ganz normal. Vorher konnte ich Chrome nicht mal mehr starten. Trotzdem denke ich, dass der Spuk noch nicht vorbei ist. Was kann ich noch machen? defogger, frst und gmer - Ergebnisse unten.

Nach defogger Scan gab es keine Ergebnisse. In den Logfiles von FRST ist in den Browsern immer noch websearch.toolksearch.info aufgelistet. Da diese aber über 500Zeilen lang sind, hier nur die betroffenen Zeilen, der Rest als .zip im Anhang.

Code:
ATTFilter
FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default
FF user.js: detected! => C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\user.js
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "WebSearch");: user_pref("browser.search.order.1,S", "WebSearch");
FF Homepage: https://startpage.com/
FF Keyword.URL: hxxp://websearch.toolksearchbook.info/?pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46&l=1&q=
FF NetworkProxy: "type", 0
Code:
ATTFilter
Chrome: 
=======
CHR RestoreOnStartup: "www.google.com"
CHR DefaultSearchKeyword: websearch
CHR DefaultSearchProvider: WebSearch
CHR DefaultSearchURL: hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
CHR DefaultNewTabURL:
Und der gmer-scan funktionierte nur teilweise. Folgende Fehlermeldung popte zum Anfang und zum Ende auf:
C:\Windows\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

hier der zweite Teil des Scans - die ganze txt im Anhang:
Code:
ATTFilter
---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [708:732]                                                                                                                                                                                                                                                    fffff960009635e8
Thread    [4916:4956]                                                                                                                                                                                                                                                                               00000000770f50a7
---- Processes - GMER 2.1 ----

Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2080]                                                                                                                                                                     000007f9f19f0000
Process  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Commu(2013-01-31 22:26:40)  000007f76f210000
Library  C:\Program Files\WindowsApps\Microsoft.VCLibs.110.00_11.0.51106.1_x64__8wekyb3d8bbwe\MSVCR110.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Microsoft® C Runtim(2013-01-31 19:26:47)  000007f9f0f60000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\wllog.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Windows (2013-01-31 22:26:44)  000007f9f0e10000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Microsoft.WindowsLive.Platform.Service.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8b(2013-01-31 22:26:40)  000007f9f0a90000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\shared\bici.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Wi(2013-01-31 22:26:44)  000007f9f06b0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Microsoft.WindowsLive.Platform.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Live(2013-01-31 22:26:40)  000007f9f03b0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb(2013-01-31 22:26:43)  000007f9ef3b0000
Process  C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4792]                                                                                                                                            0000000000400000
Process  C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4804]                                                                                                                                            0000000000400000
Process  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052]                                                                                                                                            0000000000400000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052](2014-01-03 00:45:04)                                                                                                                  0000000003ec0000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052](2013-10-18 23:55:02)                                                                                                                        000000006c8d0000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052]                                                                                                                                              000000006b940000
Process  C:\Users\Susanne\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe [3364](2014-01-21 20:56:24)                                                                                             0000000000400000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
Das ist jetzt doch ein Roman. Vielen Dank für die Hilfe
Alt 23.01.2014, 12:06   #2
schrauber
/// the machine
/// TB-Ausbilder
 
websearch.toolksearch.info Virus vollständig vom Rechner entfernen - Standard

websearch.toolksearch.info Virus vollständig vom Rechner entfernen


Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 23.01.2014, 12:44   #3
susalisk
 
websearch.toolksearch.info Virus vollständig vom Rechner entfernen - Standard

websearch.toolksearch.info Virus vollständig vom Rechner entfernen


Hallo.
Alles klar. Die Logfiles von frst:


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014
Ran by Susanne (administrator) on SUSES-PC on 23-01-2014 10:27:03
Running from C:\Users\Susanne\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Akamai Technologies, Inc.) C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Dropbox, Inc.) C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2873744 2013-02-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] - "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-13] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BakupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [533056 2012-07-31] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - [x]
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-24] (RealNetworks, Inc.)
HKLM-x32\...\Run: [Adobe Creative Cloud] - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2237328 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-27] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-01-28] ( (Atheros Communications))
HKCU\...\Run: [Google Update] - C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-24] (Google Inc.)
HKCU\...\Run: [Sony Ericsson PC Companion] - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe [772096 2009-06-18] (Sony Ericsson Mobile Communications AB)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
MountPoints2: {dedf1ce5-6eee-11e2-be7d-74e5436d1452} - "E:\Startme.exe" 
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-07-20] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-07-20] (Acer Incorporated)
HKU\Gast\...\Run: [Google Update] - C:\Users\Gast\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-24] (Google Inc.)
AppInit_DLLs-x32: c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll => File Not Found
AppInit_DLLs-x32:  => File Not Found
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.toolksearchbook.info/?pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.toolksearchbook.info/?pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
SearchScopes: HKLM - DefaultScope {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - DefaultScope {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
SearchScopes: HKLM-x32 - {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=119816&babsrc=SP_ss&mntrId=fe7c89e200000000000016e5436cc9f2
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
SearchScopes: HKCU - {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default
FF user.js: detected! => C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\user.js
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "WebSearch");: user_pref("browser.search.order.1,S", "WebSearch");
FF Homepage: https://startpage.com/
FF Keyword.URL: hxxp://websearch.toolksearchbook.info/?pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46&l=1&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Susanne\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Susanne\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Susanne\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Susanne\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Susanne\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Susanne\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Susanne\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Susanne\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ColorZilla - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2013-04-13]
FF Extension: Diigo Toolbar - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3} [2013-10-31]
FF Extension: Firebug - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\firebug@software.joehewitt.com.xpi [2013-04-13]
FF Extension: Ghostery - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\firefox@ghostery.com.xpi [2013-08-03]
FF Extension: Pin It button - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\pinterest@robertnyman.com.xpi [2013-10-16]
FF Extension: RSS Icon In Awesombar - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\rssicon@jasnapaka.com.xpi [2013-03-23]
FF Extension: Google Analytics Opt-out Browser Add-on - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}.xpi [2013-10-14]
FF Extension: Adblock Plus - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-11]
FF Extension: Pixlr Grabber - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{d47a9f51-8281-43fa-f450-f28ef8735e9a}.xpi [2013-06-21]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-24]
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKCU\...\Firefox\Extensions: [superlrcs@svenyor.net] - C:\Program Files (x86)\SuperLyrics\FF\
FF Extension: SuperLyrics - C:\Program Files (x86)\SuperLyrics\FF\ []

Chrome: 
=======
CHR RestoreOnStartup: "www.google.com"
CHR DefaultSearchKeyword: websearch
CHR DefaultSearchProvider: WebSearch
CHR DefaultSearchURL: hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-24]
CHR Extension: (Google Drive) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-24]
CHR Extension: (No Name) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnjcnjlaajofpendibcoodneacalfho [2013-06-17]
CHR Extension: (Movie2kDownloader) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf [2013-03-24]
CHR Extension: (YouTube) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-24]
CHR Extension: (Google Search) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-24]
CHR Extension: (avast! Online Security) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-09-09]
CHR Extension: (SNT) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbcnfkmcjcddglfhakjmmifhbacjcpfg [2014-01-20]
CHR Extension: (YTBoookeMairk) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdipfnbeehjpldlkadeinolgnejdcefb [2014-01-20]
CHR Extension: (RealDownloader) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-05-13]
CHR Extension: (YoutubeAdblocker) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\naoggjappffchnkkbglebmenaamiggbi [2014-01-20]
CHR Extension: (graeatsaver) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmccemiggmlhalfcdpcfgefcjcmlfmfo [2014-01-20]
CHR Extension: (Chrome In-App Payments service) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-09]
CHR Extension: (Gmail) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-24]
CHR Extension: (Streak for Gmail) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik [2014-01-20]
CHR HKLM-x32\...\Chrome\Extension: [bgnjcnjlaajofpendibcoodneacalfho] - C:\Program Files (x86)\SuperLyrics\Chrome.crx [2014-01-20]
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx [2012-12-13]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

U2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227456 2013-01-28] (Qualcomm Atheros Commnucations)
U2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-27] (AVAST Software)
U2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [113704 2013-12-27] (AVAST Software)
U2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2415760 2012-07-27] (Acer Incorporated)
U3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
U2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-05-28] ()
U3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
U2 ETDService; C:\Program Files\Elantech\ETDService.exe [92560 2013-02-13] (ELAN Microelectronics Corp.)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
U3 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-07-31] (NTI Corporation)
U2 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
U2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
U2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-29] (Dritek System INC.)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-21] (AVAST Software)
U2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software)
U1 aswNdisFlt; C:\Windows\system32\DRIVERS\aswNdisFlt.sys [439648 2014-01-09] (AVAST Software)
U1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-21] (AVAST Software)
U0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-21] ()
U1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software)
U1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software)
U3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software)
U0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] ()
U3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-28] (Qualcomm Atheros)
U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
U3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-29] (Dritek System Inc.)
U3 s1018bus; C:\Windows\System32\drivers\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)
U3 s1018mdfl; C:\Windows\system32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)
U3 s1018mdm; C:\Windows\system32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)
U3 s1018mgmt; C:\Windows\system32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)
U3 s1018nd5; C:\Windows\system32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)
U3 s1018obex; C:\Windows\system32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)
U3 s1018unic; C:\Windows\System32\drivers\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-23 10:27 - 2014-01-23 10:27 - 00025544 _____ C:\Users\Susanne\Downloads\FRST.txt
2014-01-23 10:26 - 2014-01-23 10:26 - 00000000 ____D C:\FRST
2014-01-23 10:24 - 2014-01-23 10:25 - 02077184 _____ (Farbar) C:\Users\Susanne\Downloads\FRST64.exe
2014-01-23 10:23 - 2014-01-23 10:23 - 00000248 _____ C:\Users\Susanne\Downloads\defogger_enable.log
2014-01-23 10:21 - 2014-01-23 10:22 - 00000476 _____ C:\Users\Susanne\Downloads\defogger_disable.log
2014-01-23 10:19 - 2014-01-23 10:19 - 00050477 _____ C:\Users\Susanne\Downloads\Defogger.exe
2014-01-23 09:31 - 2014-01-23 09:31 - 00000022 _____ C:\Windows\S.dirmngr
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\EZDownloader
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\ProgramData\SNT
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\ProgramData\House Of Soft
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\Program Files (x86)\SNT
2014-01-20 01:00 - 2014-01-22 21:31 - 00000000 ____D C:\ProgramData\greaatsaver
2014-01-20 01:00 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\f67cf11b6bf62c97
2014-01-20 01:00 - 2014-01-20 11:29 - 00000000 ____D C:\ProgramData\YoutubeAdblocker
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Susanne\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Susanne\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Gast\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Gast\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Program Files (x86)\YoutubeAdblocker
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Program Files (x86)\greaatsaver
2014-01-20 00:59 - 2014-01-20 01:24 - 00000000 ____D C:\ProgramData\InstallMate
2014-01-16 11:32 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-16 11:32 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-16 11:32 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-16 11:32 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-16 11:32 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-01-16 11:32 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2014-01-16 11:32 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2014-01-16 11:32 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2014-01-16 11:32 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-01-16 11:32 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-01-16 11:32 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-01-16 11:32 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-01-16 11:32 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-01-16 11:32 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-01-16 11:32 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-01-08 12:04 - 2014-01-08 12:04 - 00002753 _____ C:\Users\Susanne\AppData\Local\recently-used.xbel
2014-01-08 10:45 - 2014-01-08 10:45 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-30 17:03 - 2013-12-30 17:02 - 00007735 _____ C:\Users\Susanne\Documents\CHK_038.csv
2013-12-27 19:39 - 2013-12-27 19:39 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-27 11:25 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-27 11:25 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-27 11:25 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-27 11:25 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-27 11:25 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-27 11:25 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-27 11:25 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-27 11:25 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-27 11:25 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

==================== One Month Modified Files and Folders =======

2014-01-23 10:27 - 2014-01-23 10:27 - 00025544 _____ C:\Users\Susanne\Downloads\FRST.txt
2014-01-23 10:26 - 2014-01-23 10:26 - 00000000 ____D C:\FRST
2014-01-23 10:25 - 2014-01-23 10:24 - 02077184 _____ (Farbar) C:\Users\Susanne\Downloads\FRST64.exe
2014-01-23 10:24 - 2013-04-17 17:50 - 00001146 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001UA.job
2014-01-23 10:24 - 2013-04-17 17:50 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001Core.job
2014-01-23 10:23 - 2014-01-23 10:23 - 00000248 _____ C:\Users\Susanne\Downloads\defogger_enable.log
2014-01-23 10:23 - 2013-01-29 02:52 - 00000000 ____D C:\Users\Susanne
2014-01-23 10:22 - 2014-01-23 10:21 - 00000476 _____ C:\Users\Susanne\Downloads\defogger_disable.log
2014-01-23 10:19 - 2014-01-23 10:19 - 00050477 _____ C:\Users\Susanne\Downloads\Defogger.exe
2014-01-23 10:02 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-23 09:36 - 2013-01-29 03:01 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1243414234-900039719-3115000681-1001
2014-01-23 09:33 - 2013-03-24 11:57 - 00001130 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-23 09:32 - 2013-06-19 17:14 - 00000000 ___RD C:\Users\Susanne\Desktop\Dropbox
2014-01-23 09:32 - 2013-06-19 16:57 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Dropbox
2014-01-23 09:31 - 2014-01-23 09:31 - 00000022 _____ C:\Windows\S.dirmngr
2014-01-23 09:31 - 2013-03-24 11:57 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-23 09:30 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-23 07:51 - 2013-10-22 10:25 - 00000000 ____D C:\Windows\AutoKMS
2014-01-23 07:29 - 2013-02-28 20:04 - 00000000 ____D C:\Program Files (x86)\SuperLyrics
2014-01-22 21:55 - 2013-06-10 16:46 - 00099840 ___SH C:\Users\Susanne\Downloads\Thumbs.db
2014-01-22 21:31 - 2014-01-20 01:00 - 00000000 ____D C:\ProgramData\greaatsaver
2014-01-22 13:34 - 2014-01-20 01:00 - 00000000 ____D C:\ProgramData\f67cf11b6bf62c97
2014-01-22 09:30 - 2013-11-29 18:43 - 00003236 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-22 09:29 - 2013-08-15 15:04 - 00003366 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-21 17:45 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-20 13:26 - 2013-06-26 13:00 - 00258560 ___SH C:\Users\Susanne\Documents\Thumbs.db
2014-01-20 12:21 - 2013-09-22 22:44 - 00000000 ____D C:\Users\Susanne\Documents\jobcenter
2014-01-20 11:29 - 2014-01-20 01:00 - 00000000 ____D C:\ProgramData\YoutubeAdblocker
2014-01-20 11:29 - 2012-08-02 12:15 - 00216498 _____ C:\Windows\PFRO.log
2014-01-20 01:24 - 2014-01-20 00:59 - 00000000 ____D C:\ProgramData\InstallMate
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\EZDownloader
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\ProgramData\SNT
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\ProgramData\House Of Soft
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\Program Files (x86)\SNT
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Susanne\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Susanne\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Gast\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Gast\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Program Files (x86)\YoutubeAdblocker
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Program Files (x86)\greaatsaver
2014-01-20 01:00 - 2013-02-10 16:41 - 00000000 ____D C:\Users\Susanne\AppData\Local\Google
2014-01-19 18:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2014-01-19 18:25 - 2013-02-02 15:10 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Mozilla
2014-01-19 17:48 - 2013-09-25 16:03 - 00000000 ____D C:\Users\Susanne\AppData\Local\Adobe
2014-01-18 21:39 - 2013-01-29 02:52 - 01633434 _____ C:\Windows\WindowsUpdate.log
2014-01-18 17:44 - 2013-09-04 19:23 - 00000000 ____D C:\Windows\system32\MRT
2014-01-18 17:39 - 2013-01-31 20:12 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-18 17:38 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2014-01-17 21:02 - 2013-03-05 17:47 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\vlc
2014-01-17 20:47 - 2013-08-13 20:05 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\dvdcss
2014-01-17 20:07 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-17 20:00 - 2012-08-30 00:32 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-17 20:00 - 2012-08-30 00:32 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-17 20:00 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-16 21:07 - 2013-03-24 12:01 - 00002139 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 21:05 - 2013-06-19 17:14 - 00001027 _____ C:\Users\Susanne\Desktop\Dropbox.lnk
2014-01-16 21:05 - 2013-06-19 16:58 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-16 21:05 - 2013-01-29 02:53 - 00000000 ___RD C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-16 15:22 - 2013-10-25 12:59 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-16 15:22 - 2013-10-25 12:59 - 00003214 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-12 18:38 - 2013-01-29 22:28 - 00000000 ____D C:\Users\Susanne\AppData\Local\clear.fi
2014-01-09 14:09 - 2013-05-03 09:53 - 00439648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-01-09 09:02 - 2013-11-25 18:28 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-09 09:02 - 2013-11-25 18:28 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-08 12:52 - 2013-03-23 20:11 - 00000000 ____D C:\Users\Susanne\.gimp-2.8
2014-01-08 12:04 - 2014-01-08 12:04 - 00002753 _____ C:\Users\Susanne\AppData\Local\recently-used.xbel
2014-01-08 11:57 - 2012-07-26 08:21 - 00036240 _____ C:\Windows\setupact.log
2014-01-08 11:38 - 2013-04-10 20:35 - 00015360 ___SH C:\Users\Susanne\Thumbs.db
2014-01-08 10:45 - 2014-01-08 10:45 - 00000000 ____D C:\Users\Public\CyberLink
2014-01-08 10:45 - 2013-08-13 19:45 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\CyberLink
2013-12-30 17:02 - 2013-12-30 17:03 - 00007735 _____ C:\Users\Susanne\Documents\CHK_038.csv
2013-12-27 19:39 - 2013-12-27 19:39 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-27 19:39 - 2013-10-21 18:54 - 00002016 _____ C:\Users\Public\Desktop\avast! SafeZone.lnk
2013-12-27 19:39 - 2013-05-03 09:53 - 00001956 _____ C:\Users\Public\Desktop\avast! Premier.lnk
2013-12-27 19:39 - 2013-04-24 19:19 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-27 19:39 - 2013-04-24 19:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-27 19:39 - 2013-03-24 11:57 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

Files to move or delete:
====================
C:\ProgramData\hpeB34A.dll


Some content of TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\7z920.exe
C:\Users\Susanne\AppData\Local\Temp\AAMHelper.exe
C:\Users\Susanne\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\Susanne\AppData\Local\Temp\COMAP.EXE
C:\Users\Susanne\AppData\Local\Temp\DeltaTB.exe
C:\Users\Susanne\AppData\Local\Temp\MyBabylonTB.exe
C:\Users\Susanne\AppData\Local\Temp\pricepeep_130001_1001.exe
C:\Users\Susanne\AppData\Local\Temp\SHSetup.exe
C:\Users\Susanne\AppData\Local\Temp\stubhelper.dll
C:\Users\Susanne\AppData\Local\Temp\uninst1.exe
C:\Users\Susanne\AppData\Local\Temp\{A3FFA942-E0B3-4520-B69B-1CEC5994BC1D}-28.0.1500.72_chrome_installer.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-18 17:38

==================== End Of Log ============================
--- --- ---



Die Addition.txt von frst:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-01-2014
Ran by Susanne at 2014-01-23 10:29:35
Running from C:\Users\Susanne\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

 clear.fi SDK - Video 2 (x32 Version: 2.1.1910 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.1910 - CyberLink Corp.) Hidden
7-Zip 9.20 (x32 Version:  - )
Acer Backup Manager (x32 Version: 4.0.0.0053 - NTI Corporation)
Acer Device Fast-lane (Version: 1.00.3003 - Acer Incorporated)
Acer Instant Update Service (Version: 1.00.3012 - Acer Incorporated)
Acer Power Management (Version: 7.00.3003 - Acer Incorporated)
Acer Recovery Management (Version: 6.00.3006 - Acer Incorporated)
AcerCloud (x32 Version: 2.01.3112 - Acer Incorporated)
AcerCloud Docs (x32 Version: 1.00.3103 - Acer Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Creative Cloud (x32 Version: 2.1.2.232 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe InDesign CC (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe® Content Viewer (x32 Version: 3.3.0 - Adobe Systems Incorporated)
Adobe® Content Viewer (x32 Version: 3.3.0 - Adobe Systems Incorporated) Hidden
Akamai NetSession Interface (HKCU Version:  - Akamai Technologies, Inc)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.4 - Atheros Communications Inc.)
Audacity 2.0.3 (x32 Version: 2.0.3 - Audacity Team)
avast! Premier (x32 Version: 9.0.2011 - Avast Software)
Backup Manager v4 (x32 Version: 4.0.0.0053 - NTI Corporation) Hidden
clear.fi Media (x32 Version: 2.01.3107 - Acer Incorporated)
clear.fi Photo (x32 Version: 2.01.3107 - Acer Incorporated)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version:  - Microsoft)
Dolby Home Theater v4 (x32 Version: 7.2.8000.16 - Dolby Laboratories Inc)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
ETDWare PS/2-X64 11.6.11.002_WHQL (Version: 11.6.11.002 - ELAN Microelectronic Corp.)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0 - )
FFmpeg v0.6.2 for Audacity (x32 Version:  - )
FileZilla Client 3.7.3 (HKCU Version: 3.7.3 - Tim Kosse)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Talk Plugin (x32 Version: 4.5.3.14917 - Google)
Google Talk Plugin (x32 Version: 5.1.2.17113 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Gpg4win (2.1.1) (x32 Version: 2.1.1 - The Gpg4win Project)
HDVidCodec (x32 Version: 2.1 Build 26473 - hdvidcodec.com) <==== ATTENTION
Identity Card (x32 Version: 2.00.3002 - Acer Incorporated)
Inkscape 0.48.4 (x32 Version: 0.48.4 - )
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2867 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
LAME v3.99.3 (for Windows) (x32 Version:  - )
Launch Manager (x32 Version: 7.0.4 - Acer Inc.)
Live Updater (x32 Version: 2.00.3002 - Acer Incorporated)
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Miro (x32 Version: 6.0 - Participatory Culture Foundation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla)
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden
Office Addin (x32 Version: 2.01.3102 - Acer)
Office Addin 2003 (x32 Version: 2.01.3102 - Acer)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 5.7.0 (x32 Version:  - PDF24.org)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.220 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (x32 Version: 11.41 - Qualcomm Atheros)
RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (x32 Version: 16.0.3 - RealNetworks)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (x32 Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Safari (x32 Version: 5.34.57.2 - Apple Inc.)
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
SNT (x32 Version: 2.1.0.1195 - SNT) <==== ATTENTION
Sony Ericsson PC Companion 1.50.52 (x32 Version: 1.50.52 - Sony Ericsson)
Sony Ericsson PC Suite 6.011.00 (x32 Version: 6.011.00 - Sony Ericsson)
SuperLyrics (x32 Version:  - Sven & Yorgen) <==== ATTENTION
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2553065) (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2566458) (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version:  - Microsoft)
Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1 - Microsoft Corporation)
VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN)

==================== Restore Points  =========================

04-01-2014 14:01:56 Geplanter Prüfpunkt
14-01-2014 12:11:05 Geplanter Prüfpunkt
17-01-2014 19:07:11 Windows Update

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0A44C2EE-8E21-46D9-BE0F-006D6B773CEA} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-07-13] ()
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1CFF7D44-F5E7-42E9-891D-F5AD64DE9DFB} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {1E114134-D0BE-4D07-A9E7-BC1D85D02F7C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {21B693FD-CBE2-442E-8AE1-755989C9620E} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {478FA25E-1494-4827-81A2-5C86B79FF891} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {4BB34737-2102-4490-B92E-EC17E4F22976} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001UA => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {5231172E-0320-4F0D-BBC8-5EFC302C4EF7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {73A0AE8D-26E5-4EBC-A1FA-D8091F29BF4D} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {7AA88508-2E1A-46A7-9A5A-3BDF163C8E26} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-07-31] (Acer Incorporated)
Task: {7C435C37-741E-420A-8DE4-FCA9444D905F} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {7CD5FFF9-DD8F-4B60-83DA-DAEDD826AEA1} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {84C33C4A-EB98-4BFE-8245-EA5DF2B195E4} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-27] (AVAST Software)
Task: {8FE54917-6179-432A-BBBF-2AC11E819AD5} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {9415CACF-C18F-4318-A01A-DCFAD51CFDBE} - System32\Tasks\AdobeAAMUpdater-1.0-Suses-PC-Susanne => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-13] (Adobe Systems Incorporated)
Task: {9F8A4BBA-C7D9-4B7A-886D-7271DD5B8641} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-07-13] ()
Task: {A5F1E51A-C1D9-4AF2-AD26-3E15BAFE86B5} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {A72083A4-EC26-4FE0-B9FE-645E5102CD1A} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {B3DF58E0-8FA8-4AC3-BEC2-E101DD8BC394} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {C91AF251-93C2-4CD9-B62A-84D799114D8A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001Core => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {CC57DF7F-DEFC-44CA-BC40-1BD6818C992D} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-07-13] ()
Task: {E9F4BA80-463C-46ED-BCB9-FDDA48521203} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\AutoKMSCustom.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001Core.job => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001UA.job => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-08-30 09:01 - 2013-08-30 09:01 - 03358064 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll
2012-06-22 02:12 - 2012-06-22 02:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2013-01-31 23:26 - 2013-01-31 23:31 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-01-28 13:45 - 2013-01-28 13:45 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-01-28 13:42 - 2013-01-28 13:42 - 00084992 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2012-08-11 21:46 - 2012-08-07 15:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-22 09:28 - 2014-01-21 23:40 - 02156032 _____ () C:\Program Files\AVAST Software\Avast\defs\14012101\algo.dll
2013-05-28 17:44 - 2013-05-28 17:44 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-05-28 17:41 - 2013-05-28 17:41 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-05-28 17:44 - 2013-05-28 17:44 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-05-28 17:45 - 2013-05-28 17:45 - 00627712 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2013-05-28 17:42 - 2013-05-28 17:42 - 00037888 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-10-21 18:54 - 2013-10-21 18:54 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\Susanne\AppData\Roaming\Dropbox\bin\libcef.dll
2012-08-29 14:52 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-12-20 17:29 - 2013-12-20 17:29 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: WAN-Miniport (Netzwerkmonitor)
Description: WAN-Miniport (Netzwerkmonitor)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: NdisWan
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Der angeforderte Dienst wurde bereits gestartet.

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 3914.27 MB
Available physical RAM: 2290.11 MB
Total Pagefile: 4618.27 MB
Available Pagefile: 2903 MB
Total Virtual: 8192 MB
Available Virtual: 8191.75 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:678.33 GB) (Free:625.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 5A191643)

Partition: GPT Partition Type
==================== End Of Log ============================
Die Logfile von gmer:

Code:
ATTFilter
GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-23 11:00:37
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003f WDC_WD7500BPVT-22HXZT3 rev.01.01A01 698,64GB
Running: gmer.exe; Driver: C:\Users\Susanne\AppData\Local\Temp\fwloypow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\csrss.exe[608] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                                                                                                                                                                                   000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\wininit.exe[692] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\csrss.exe[708] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                                                                                                                                                                                   000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\winlogon.exe[764] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\services.exe[788] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\lsass.exe[796] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                   000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[912] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[984] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\svchost.exe[312] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\dwm.exe[424] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                     000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\dwm.exe[424] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                        000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\dwm.exe[424] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                        000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\dwm.exe[424] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                      000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\svchost.exe[444] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[628] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\svchost.exe[852] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[1136] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[1656] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[1656] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                                                                                                                         000007f9fdf4177a 4 bytes [F4, FD, F9, 07]
.text    C:\Windows\System32\spoolsv.exe[1656] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                                                                                                                         000007f9fdf41782 4 bytes [F4, FD, F9, 07]
.text    C:\Windows\system32\svchost.exe[1684] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe[1836] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                       000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\dashost.exe[1152] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\taskhostex.exe[1852] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                             000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\taskhostex.exe[1852] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\taskhostex.exe[1852] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\taskhostex.exe[1852] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                              000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\Explorer.EXE[2080] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                        000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\Explorer.EXE[2080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                           000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\Explorer.EXE[2080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                           000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\Explorer.EXE[2080] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                         000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Elantech\ETDService.exe[2316] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                       000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrl.exe[2364] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrl.exe[2364] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                             000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrl.exe[2364] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                             000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrl.exe[2364] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                           000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Intel\iCLS Client\HeciServer.exe[2372] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                              000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\RfBtnSvc64.exe[2652] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                      000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2676] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2440] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\wmiprvse.exe[3256] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\unsecapp.exe[3448] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\unsecapp.exe[3448] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                             000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3448] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                             000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3448] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                           000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3576] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                             000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3576] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3576] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3576] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                              000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\igfxext.exe[3676] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\igfxext.exe[3676] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                   000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\igfxext.exe[3676] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                   000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\igfxext.exe[3676] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                 000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\SearchIndexer.exe[3984] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\svchost.exe[3380] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[1108] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                    000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[1108] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                       000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[1108] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                       000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[1108] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                     000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4116] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                           000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4116] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                              000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4116] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                              000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4116] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                            000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4116] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                                                                                                                                                  000007f9f7481b32 4 bytes [48, F7, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4116] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                                                                                                                                                  000007f9f7481b3a 4 bytes [48, F7, F9, 07]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4132] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4132] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                    000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4132] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                    000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4132] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                  000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4148] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                    000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                       000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                       000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4148] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                     000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\igfxtray.exe[4268] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                               000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\igfxtray.exe[4268] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                  000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\igfxtray.exe[4268] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                  000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\igfxtray.exe[4268] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\igfxsrvc.exe[4292] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                               000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\igfxsrvc.exe[4292] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                  000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\igfxsrvc.exe[4292] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                  000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\igfxsrvc.exe[4292] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\hkcmd.exe[4404] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                  000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\hkcmd.exe[4404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                     000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\hkcmd.exe[4404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                     000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\hkcmd.exe[4404] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                   000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[4520] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                               000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\System32\igfxpers.exe[4520] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                                                                                                                        000007f9fdf4177a 4 bytes [F4, FD, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[4520] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                                                                                                                        000007f9fdf41782 4 bytes [F4, FD, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[4520] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                  000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[4520] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                  000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[4520] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4812] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                      000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4812] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                                                                                               000007f9fdf4177a 4 bytes [F4, FD, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4812] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                                                                                               000007f9fdf41782 4 bytes [F4, FD, F9, 07]
.text    C:\Windows\System32\RuntimeBroker.exe[4820] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\unsecapp.exe[5084] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\unsecapp.exe[5084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                             000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[5084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                             000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[5084] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                           000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\DllHost.exe[5116] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\printfilterpipelinesvc.exe[5208] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                 000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5884] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                    000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5884] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                       000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5884] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                       000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5884] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                     000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[2332] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                           000007f9fdf5f7eb 1 byte [62]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[2332] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                              000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[2332] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                              000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[2332] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                            000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\DllHost.exe[2160] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\DllHost.exe[2160] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                   000007f9f8b71532 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\DllHost.exe[2160] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                   000007f9f8b7153a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\DllHost.exe[2160] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                 000007f9f8b7165a 4 bytes [B7, F8, F9, 07]
.text    C:\Windows\system32\SearchProtocolHost.exe[5360] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                     000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\SearchFilterHost.exe[3668] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                       000007f9fdf5f7eb 1 byte [62]
.text    C:\Windows\system32\AUDIODG.EXE[4924] C:\Windows\SYSTEM32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f9fdf5f7eb 1 byte [62]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [708:732]                                                                                                                                                                                                                                                    fffff960009635e8
Thread    [4916:4956]                                                                                                                                                                                                                                                                               00000000770f50a7
---- Processes - GMER 2.1 ----

Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2080]                                                                                                                                                                     000007f9f19f0000
Process  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Commu(2013-01-31 22:26:40)  000007f76f210000
Library  C:\Program Files\WindowsApps\Microsoft.VCLibs.110.00_11.0.51106.1_x64__8wekyb3d8bbwe\MSVCR110.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Microsoft® C Runtim(2013-01-31 19:26:47)  000007f9f0f60000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\wllog.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Windows (2013-01-31 22:26:44)  000007f9f0e10000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Microsoft.WindowsLive.Platform.Service.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8b(2013-01-31 22:26:40)  000007f9f0a90000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\shared\bici.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3136] (Wi(2013-01-31 22:26:44)  000007f9f06b0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Microsoft.WindowsLive.Platform.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Live(2013-01-31 22:26:40)  000007f9f03b0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb(2013-01-31 22:26:43)  000007f9ef3b0000
Process  C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4792]                                                                                                                                            0000000000400000
Process  C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4804]                                                                                                                                            0000000000400000
Process  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052]                                                                                                                                            0000000000400000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052](2014-01-03 00:45:04)                                                                                                                  0000000003ec0000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052](2013-10-18 23:55:02)                                                                                                                        000000006c8d0000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [5052]                                                                                                                                              000000006b940000
Process  C:\Users\Susanne\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe [3364](2014-01-21 20:56:24)                                                                                             0000000000400000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
Ich habe schon jetzt noch einen how to entfernen websearch.toolksearch.info Virus Eintrag gefunden. Unter anderem soll Malwarebytes helfen. Habe das jetzt schon einmal durchlaufen lassen u die gefundenen infizierten Einträge gelöscht. Das Ergebnis ist hier:

Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.23.02

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
Susanne :: SUSES-PC [Administrator]

23.01.2014 12:19:09
mbam-log-2014-01-23 (12-19-09).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 279235
Laufzeit: 7 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 16
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} (PUP.Optional.WebSearchInfo) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\babylontoolbar (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 3
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DefaultScope (PUP.Optional.WebSearchInfo) -> Daten: {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.WebSearchInfo) -> Bösartig: (hxxp://websearch.toolksearchbook.info/?pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.WebSearchInfo) -> Bösartig: (hxxp://websearch.toolksearchbook.info/?pid=1574&r=2014/01/20&hid=17083675476069503747&lg=EN&cc=DE&unqvl=46) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 12
C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Gophoto.it (PUP.Optional.Gophoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Gast\AppData\Roaming\Iminent\Mediator (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Gast\AppData\Roaming\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.10.0 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\mt_ffx\BabylonToolbar (PUP.Optional.BabylonToolbar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\mt_ffx\BabylonToolbar\BabylonToolbar (PUP.Optional.BabylonToolbar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\mt_ffx\BabylonToolbar\BabylonToolbar\1.8.11.10 (PUP.Optional.BabylonToolbar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\hdvidcodec.com (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\YoutubeAdblocker (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 14
C:\ProgramData\SNT\G_Cpf.exe (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\DeltaTB.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\MyBabylonTB.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\pricepeep_130001_1001.exe (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Temp\02F1BDD0-BAB0-7891-BDD4-C0725867E0B8\Latest\MyBabylonTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\Downloads\Miro_setup.exe (PUP.BundleInstaller.OI) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\HDVidCodec.lnk (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\Uninstall.lnk (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Gophoto.it\gophotoit14.crx (PUP.Optional.Gophoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Gast\AppData\Roaming\Iminent\Mediator\Datas\globalcache.dat (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Gast\AppData\Roaming\Iminent\Mediator\Datas\user.dat (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\hdvidcodec.com\HDVidCodec.exe (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\hdvidcodec.com\uninst.exe (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Arbeite jetzt noch die andere empfohlende Software durch. Hoffe es klappt. Ergebnisse poste ich dann.
__________________
Alt 23.01.2014, 21:46   #4
susalisk
 
websearch.toolksearch.info Virus vollständig vom Rechner entfernen - Standard

websearch.toolksearch.info Virus vollständig vom Rechner entfernen


Hallo.
Ich glaube, es ist vollbracht. Ich habe den Admin-Leitfaden durchinstalliert und gescannt. Bis vermeintlich alle infizierten Dateien und Vorgänge in Quarantäne o gelöscht waren.
Malewarebytes, AdwCleaner, Junkware Removal Tool, Shortcut Cleaner, Eset Online Scanner (zuerst nur Suche dann nochmals mit Beseitigung der Funde) und Absolute Uninstaller. Dann nochmals vollständige Untersuchung durch avast premier - ohne Fund.

Hier die Logfiles von FRST zum Abschluss, nach der großen Putzaktion:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014
Ran by Susanne (administrator) on SUSES-PC on 23-01-2014 21:19:39
Running from C:\Users\Susanne\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Akamai Technologies, Inc.) C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Dropbox, Inc.) C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2873744 2013-02-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] - "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM-x32\...\Run: [BakupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [533056 2012-07-31] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - [x]
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-24] (RealNetworks, Inc.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-27] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-01-28] ( (Atheros Communications))
HKCU\...\Run: [Google Update] - C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-24] (Google Inc.)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
MountPoints2: {dedf1ce5-6eee-11e2-be7d-74e5436d1452} - "E:\Startme.exe" 
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-07-20] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-07-20] (Acer Incorporated)
HKU\Gast\...\Run: [Google Update] - C:\Users\Gast\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-24] (Google Inc.)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM - DefaultScope {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {FF9A139E-55F7-4851-B726-DAB6A55ACF71} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default
FF Homepage: https://startpage.com/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Susanne\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Susanne\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Susanne\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Susanne\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Susanne\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Susanne\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Susanne\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Susanne\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\firebug@software.joehewitt.com.xpi [2013-04-13]
FF Extension: Ghostery - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\firefox@ghostery.com.xpi [2013-08-03]
FF Extension: Pin It button - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\pinterest@robertnyman.com.xpi [2013-10-16]
FF Extension: RSS Icon In Awesombar - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\rssicon@jasnapaka.com.xpi [2013-03-23]
FF Extension: Google Analytics Opt-out Browser Add-on - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}.xpi [2013-10-14]
FF Extension: Adblock Plus - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-11]
FF Extension: Pixlr Grabber - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\Extensions\{d47a9f51-8281-43fa-f450-f28ef8735e9a}.xpi [2013-06-21]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-24]
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR RestoreOnStartup: "www.google.com"
CHR DefaultSearchProvider: WebSearch
CHR DefaultSearchURL: hxxp://www.google.com
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-24]
CHR Extension: (Google Drive) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-24]
CHR Extension: (YouTube) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-24]
CHR Extension: (Google Search) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-24]
CHR Extension: (avast! Online Security) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-09-09]
CHR Extension: (SNT) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbcnfkmcjcddglfhakjmmifhbacjcpfg [2014-01-20]
CHR Extension: (YTBoookeMairk) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdipfnbeehjpldlkadeinolgnejdcefb [2014-01-20]
CHR Extension: (RealDownloader) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-05-13]
CHR Extension: (YoutubeAdblocker) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\naoggjappffchnkkbglebmenaamiggbi [2014-01-20]
CHR Extension: (graeatsaver) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmccemiggmlhalfcdpcfgefcjcmlfmfo [2014-01-20]
CHR Extension: (Chrome In-App Payments service) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-09]
CHR Extension: (Gmail) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-24]
CHR Extension: (Streak for Gmail) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik [2014-01-20]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

==================== Services (Whitelisted) =================

U2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227456 2013-01-28] (Qualcomm Atheros Commnucations)
U2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-27] (AVAST Software)
U2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [113704 2013-12-27] (AVAST Software)
U2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2415760 2012-07-27] (Acer Incorporated)
U3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
U2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-05-28] ()
U3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
U2 ETDService; C:\Program Files\Elantech\ETDService.exe [92560 2013-02-13] (ELAN Microelectronics Corp.)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
U3 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-07-31] (NTI Corporation)
U2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
U2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-29] (Dritek System INC.)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-21] (AVAST Software)
U2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software)
U1 aswNdisFlt; C:\Windows\system32\DRIVERS\aswNdisFlt.sys [439648 2014-01-09] (AVAST Software)
U1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-21] (AVAST Software)
U0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-21] ()
U1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software)
U1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software)
U3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software)
U0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] ()
U3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-28] (Qualcomm Atheros)
U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
U3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-29] (Dritek System Inc.)
U3 s1018bus; C:\Windows\System32\drivers\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)
U3 s1018mdfl; C:\Windows\system32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)
U3 s1018mdm; C:\Windows\system32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)
U3 s1018mgmt; C:\Windows\system32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)
U3 s1018nd5; C:\Windows\system32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)
U3 s1018obex; C:\Windows\system32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)
U3 s1018unic; C:\Windows\System32\drivers\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-23 21:17 - 2014-01-23 21:17 - 00000614 _____ C:\Users\Susanne\Desktop\JRT2.txt
2014-01-23 21:17 - 2014-01-23 21:17 - 00000614 _____ C:\Users\Susanne\Desktop\JRT.txt
2014-01-23 21:10 - 2014-01-23 21:10 - 00001692 _____ C:\Users\Susanne\Desktop\AdwCleaner[S1].txt
2014-01-23 21:08 - 2014-01-23 21:08 - 00000022 _____ C:\Windows\S.dirmngr
2014-01-23 16:56 - 2014-01-23 17:21 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\GlarySoft
2014-01-23 16:56 - 2014-01-23 16:56 - 00001070 _____ C:\Users\Susanne\Desktop\Absolute Uninstaller.lnk
2014-01-23 16:56 - 2014-01-23 16:56 - 00000169 _____ C:\Users\Susanne\Desktop\Glarysoft Freeware.url
2014-01-23 14:25 - 2014-01-23 14:25 - 02347384 _____ (ESET) C:\Users\Susanne\Downloads\esetsmartinstaller_deu.exe
2014-01-23 14:25 - 2014-01-23 14:25 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-23 13:10 - 2014-01-23 13:10 - 00001754 _____ C:\sc-cleaner.txt
2014-01-23 13:03 - 2014-01-23 13:03 - 00000000 ____D C:\Windows\ERUNT
2014-01-23 13:00 - 2014-01-23 13:00 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Susanne\Downloads\sc-cleaner.exe
2014-01-23 12:48 - 2014-01-23 21:10 - 00000000 ____D C:\AdwCleaner
2014-01-23 12:47 - 2014-01-23 12:47 - 01236282 _____ C:\Users\Susanne\Downloads\adwcleaner.exe
2014-01-23 12:13 - 2014-01-23 12:13 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-23 12:13 - 2014-01-23 12:13 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Malwarebytes
2014-01-23 12:13 - 2014-01-23 12:13 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-23 12:13 - 2014-01-23 12:13 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 12:13 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-23 12:06 - 2014-01-23 12:08 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Susanne\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 11:54 - 2014-01-23 20:01 - 00000000 ____D C:\Users\Susanne\Desktop\txt
2014-01-23 11:52 - 2014-01-23 11:52 - 00005925 _____ C:\Users\Susanne\Downloads\Addition.zip
2014-01-23 10:34 - 2014-01-23 10:34 - 00370971 _____ C:\Users\Susanne\Downloads\gmer_2.1.19355.zip
2014-01-23 10:29 - 2014-01-23 10:29 - 00021758 _____ C:\Users\Susanne\Downloads\Addition.txt
2014-01-23 10:27 - 2014-01-23 21:19 - 00021215 _____ C:\Users\Susanne\Downloads\FRST.txt
2014-01-23 10:26 - 2014-01-23 10:26 - 00000000 ____D C:\FRST
2014-01-23 10:24 - 2014-01-23 10:25 - 02077184 _____ (Farbar) C:\Users\Susanne\Downloads\FRST64.exe
2014-01-23 10:23 - 2014-01-23 21:19 - 00000248 _____ C:\Users\Susanne\Downloads\defogger_enable.log
2014-01-23 10:21 - 2014-01-23 21:19 - 00000476 _____ C:\Users\Susanne\Downloads\defogger_disable.log
2014-01-23 10:19 - 2014-01-23 10:19 - 00050477 _____ C:\Users\Susanne\Downloads\Defogger.exe
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\ProgramData\House Of Soft
2014-01-20 01:00 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\f67cf11b6bf62c97
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Susanne\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Gast\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator
2014-01-20 00:59 - 2014-01-20 01:24 - 00000000 ____D C:\ProgramData\InstallMate
2014-01-16 11:32 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-16 11:32 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-16 11:32 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-16 11:32 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-16 11:32 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-01-16 11:32 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2014-01-16 11:32 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2014-01-16 11:32 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2014-01-16 11:32 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-01-16 11:32 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-01-16 11:32 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-01-16 11:32 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-01-16 11:32 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-01-16 11:32 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-01-16 11:32 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-01-08 12:04 - 2014-01-08 12:04 - 00002753 _____ C:\Users\Susanne\AppData\Local\recently-used.xbel
2014-01-08 10:45 - 2014-01-08 10:45 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-30 17:03 - 2013-12-30 17:02 - 00007735 _____ C:\Users\Susanne\Documents\CHK_038.csv
2013-12-27 19:39 - 2013-12-27 19:39 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-27 11:25 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-27 11:25 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-27 11:25 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-27 11:25 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-27 11:25 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-27 11:25 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-27 11:25 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-27 11:25 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-27 11:25 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-27 11:25 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-27 11:25 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

==================== One Month Modified Files and Folders =======

2014-01-23 21:19 - 2014-01-23 10:27 - 00021215 _____ C:\Users\Susanne\Downloads\FRST.txt
2014-01-23 21:19 - 2014-01-23 10:23 - 00000248 _____ C:\Users\Susanne\Downloads\defogger_enable.log
2014-01-23 21:19 - 2014-01-23 10:21 - 00000476 _____ C:\Users\Susanne\Downloads\defogger_disable.log
2014-01-23 21:19 - 2013-01-29 03:01 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1243414234-900039719-3115000681-1001
2014-01-23 21:19 - 2013-01-29 02:52 - 00000000 ____D C:\Users\Susanne
2014-01-23 21:17 - 2014-01-23 21:17 - 00000614 _____ C:\Users\Susanne\Desktop\JRT2.txt
2014-01-23 21:17 - 2014-01-23 21:17 - 00000614 _____ C:\Users\Susanne\Desktop\JRT.txt
2014-01-23 21:10 - 2014-01-23 21:10 - 00001692 _____ C:\Users\Susanne\Desktop\AdwCleaner[S1].txt
2014-01-23 21:10 - 2014-01-23 12:48 - 00000000 ____D C:\AdwCleaner
2014-01-23 21:09 - 2013-10-25 12:59 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-23 21:09 - 2013-10-25 12:59 - 00003214 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-23 21:09 - 2013-06-19 16:57 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Dropbox
2014-01-23 21:09 - 2013-03-24 11:57 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-23 21:08 - 2014-01-23 21:08 - 00000022 _____ C:\Windows\S.dirmngr
2014-01-23 21:08 - 2012-08-02 12:15 - 00223994 _____ C:\Windows\PFRO.log
2014-01-23 21:08 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-23 21:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-23 20:33 - 2013-03-24 11:57 - 00001130 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-23 20:24 - 2013-04-17 17:50 - 00001146 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001UA.job
2014-01-23 20:01 - 2014-01-23 11:54 - 00000000 ____D C:\Users\Susanne\Desktop\txt
2014-01-23 17:32 - 2013-04-10 20:35 - 00015360 ___SH C:\Users\Susanne\Thumbs.db
2014-01-23 17:21 - 2014-01-23 16:56 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\GlarySoft
2014-01-23 17:14 - 2013-09-25 18:46 - 00000000 ____D C:\Program Files\Adobe
2014-01-23 17:11 - 2013-02-01 18:59 - 00000000 ____D C:\ProgramData\Adobe
2014-01-23 17:04 - 2013-01-29 02:53 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Adobe
2014-01-23 16:59 - 2012-08-29 14:58 - 00182554 _____ C:\Windows\DPINST.LOG
2014-01-23 16:56 - 2014-01-23 16:56 - 00001070 _____ C:\Users\Susanne\Desktop\Absolute Uninstaller.lnk
2014-01-23 16:56 - 2014-01-23 16:56 - 00000169 _____ C:\Users\Susanne\Desktop\Glarysoft Freeware.url
2014-01-23 14:25 - 2014-01-23 14:25 - 02347384 _____ (ESET) C:\Users\Susanne\Downloads\esetsmartinstaller_deu.exe
2014-01-23 14:25 - 2014-01-23 14:25 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-23 13:22 - 2012-08-30 00:32 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-23 13:22 - 2012-08-30 00:32 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-23 13:22 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-23 13:10 - 2014-01-23 13:10 - 00001754 _____ C:\sc-cleaner.txt
2014-01-23 13:03 - 2014-01-23 13:03 - 00000000 ____D C:\Windows\ERUNT
2014-01-23 13:00 - 2014-01-23 13:00 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Susanne\Downloads\sc-cleaner.exe
2014-01-23 12:56 - 2013-06-19 17:14 - 00000000 ___RD C:\Users\Susanne\Desktop\Dropbox
2014-01-23 12:47 - 2014-01-23 12:47 - 01236282 _____ C:\Users\Susanne\Downloads\adwcleaner.exe
2014-01-23 12:13 - 2014-01-23 12:13 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-23 12:13 - 2014-01-23 12:13 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Malwarebytes
2014-01-23 12:13 - 2014-01-23 12:13 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-23 12:13 - 2014-01-23 12:13 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 12:08 - 2014-01-23 12:06 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Susanne\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 11:52 - 2014-01-23 11:52 - 00005925 _____ C:\Users\Susanne\Downloads\Addition.zip
2014-01-23 10:34 - 2014-01-23 10:34 - 00370971 _____ C:\Users\Susanne\Downloads\gmer_2.1.19355.zip
2014-01-23 10:29 - 2014-01-23 10:29 - 00021758 _____ C:\Users\Susanne\Downloads\Addition.txt
2014-01-23 10:26 - 2014-01-23 10:26 - 00000000 ____D C:\FRST
2014-01-23 10:25 - 2014-01-23 10:24 - 02077184 _____ (Farbar) C:\Users\Susanne\Downloads\FRST64.exe
2014-01-23 10:24 - 2013-04-17 17:50 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001Core.job
2014-01-23 10:19 - 2014-01-23 10:19 - 00050477 _____ C:\Users\Susanne\Downloads\Defogger.exe
2014-01-23 07:51 - 2013-10-22 10:25 - 00000000 ____D C:\Windows\AutoKMS
2014-01-22 21:55 - 2013-06-10 16:46 - 00099840 ___SH C:\Users\Susanne\Downloads\Thumbs.db
2014-01-22 13:34 - 2014-01-20 01:00 - 00000000 ____D C:\ProgramData\f67cf11b6bf62c97
2014-01-22 09:30 - 2013-11-29 18:43 - 00003236 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-22 09:29 - 2013-08-15 15:04 - 00003366 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001
2014-01-21 17:45 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-20 13:26 - 2013-06-26 13:00 - 00258560 ___SH C:\Users\Susanne\Documents\Thumbs.db
2014-01-20 12:21 - 2013-09-22 22:44 - 00000000 ____D C:\Users\Susanne\Documents\jobcenter
2014-01-20 01:24 - 2014-01-20 00:59 - 00000000 ____D C:\ProgramData\InstallMate
2014-01-20 01:02 - 2014-01-20 01:02 - 00000000 ____D C:\ProgramData\House Of Soft
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Susanne\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\HomeGroupUser$
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Gast\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Torch
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Comodo
2014-01-20 01:00 - 2014-01-20 01:00 - 00000000 ____D C:\Users\Administrator
2014-01-20 01:00 - 2013-02-10 16:41 - 00000000 ____D C:\Users\Susanne\AppData\Local\Google
2014-01-19 18:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2014-01-19 18:25 - 2013-02-02 15:10 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Mozilla
2014-01-19 17:48 - 2013-09-25 16:03 - 00000000 ____D C:\Users\Susanne\AppData\Local\Adobe
2014-01-18 21:39 - 2013-01-29 02:52 - 01633434 _____ C:\Windows\WindowsUpdate.log
2014-01-18 17:44 - 2013-09-04 19:23 - 00000000 ____D C:\Windows\system32\MRT
2014-01-18 17:39 - 2013-01-31 20:12 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-18 17:38 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2014-01-17 21:02 - 2013-03-05 17:47 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\vlc
2014-01-17 20:47 - 2013-08-13 20:05 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\dvdcss
2014-01-17 20:07 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-16 21:07 - 2013-03-24 12:01 - 00002139 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 21:05 - 2013-06-19 17:14 - 00001027 _____ C:\Users\Susanne\Desktop\Dropbox.lnk
2014-01-16 21:05 - 2013-06-19 16:58 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-16 21:05 - 2013-01-29 02:53 - 00000000 ___RD C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-12 18:38 - 2013-01-29 22:28 - 00000000 ____D C:\Users\Susanne\AppData\Local\clear.fi
2014-01-09 14:09 - 2013-05-03 09:53 - 00439648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-01-09 09:02 - 2013-11-25 18:28 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-09 09:02 - 2013-11-25 18:28 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-08 12:52 - 2013-03-23 20:11 - 00000000 ____D C:\Users\Susanne\.gimp-2.8
2014-01-08 12:04 - 2014-01-08 12:04 - 00002753 _____ C:\Users\Susanne\AppData\Local\recently-used.xbel
2014-01-08 11:57 - 2012-07-26 08:21 - 00036240 _____ C:\Windows\setupact.log
2014-01-08 10:45 - 2014-01-08 10:45 - 00000000 ____D C:\Users\Public\CyberLink
2014-01-08 10:45 - 2013-08-13 19:45 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\CyberLink
2013-12-30 17:02 - 2013-12-30 17:03 - 00007735 _____ C:\Users\Susanne\Documents\CHK_038.csv
2013-12-27 19:39 - 2013-12-27 19:39 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-27 19:39 - 2013-10-21 18:54 - 00002016 _____ C:\Users\Public\Desktop\avast! SafeZone.lnk
2013-12-27 19:39 - 2013-05-03 09:53 - 00001956 _____ C:\Users\Public\Desktop\avast! Premier.lnk
2013-12-27 19:39 - 2013-04-24 19:19 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-27 19:39 - 2013-04-24 19:19 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-27 19:39 - 2013-04-24 19:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-27 19:39 - 2013-03-24 11:57 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

Some content of TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\7z920.exe
C:\Users\Susanne\AppData\Local\Temp\AAMHelper.exe
C:\Users\Susanne\AppData\Local\Temp\AdobeApplicationManager.exe
C:\Users\Susanne\AppData\Local\Temp\COMAP.EXE
C:\Users\Susanne\AppData\Local\Temp\Quarantine.exe
C:\Users\Susanne\AppData\Local\Temp\SHSetup.exe
C:\Users\Susanne\AppData\Local\Temp\stubhelper.dll
C:\Users\Susanne\AppData\Local\Temp\uninst1.exe
C:\Users\Susanne\AppData\Local\Temp\{A3FFA942-E0B3-4520-B69B-1CEC5994BC1D}-28.0.1500.72_chrome_installer.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-18 17:38

==================== End Of Log ============================
--- --- ---

--- --- ---


Und die Addition.txt:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-01-2014
Ran by Susanne at 2014-01-23 21:21:23
Running from C:\Users\Susanne\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

 clear.fi SDK - Video 2 (x32 Version: 2.1.1910 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.1910 - CyberLink Corp.) Hidden
7-Zip 9.20 (x32 Version:  - )
Absolute Uninstaller 2.9.0.722 (x32 Version:  - Glarysoft.com)
Acer Backup Manager (x32 Version: 4.0.0.0053 - NTI Corporation)
Acer Device Fast-lane (Version: 1.00.3003 - Acer Incorporated)
Acer Instant Update Service (Version: 1.00.3012 - Acer Incorporated)
Acer Power Management (Version: 7.00.3003 - Acer Incorporated)
Acer Recovery Management (Version: 6.00.3006 - Acer Incorporated)
AcerCloud (x32 Version: 2.01.3112 - Acer Incorporated)
AcerCloud Docs (x32 Version: 1.00.3103 - Acer Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU Version:  - Akamai Technologies, Inc)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.4 - Atheros Communications Inc.)
Audacity 2.0.3 (x32 Version: 2.0.3 - Audacity Team)
avast! Premier (x32 Version: 9.0.2011 - Avast Software)
Backup Manager v4 (x32 Version: 4.0.0.0053 - NTI Corporation) Hidden
clear.fi Media (x32 Version: 2.01.3107 - Acer Incorporated)
clear.fi Photo (x32 Version: 2.01.3107 - Acer Incorporated)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version:  - Microsoft)
Dolby Home Theater v4 (x32 Version: 7.2.8000.16 - Dolby Laboratories Inc)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
ESET Online Scanner v3 (x32 Version:  - )
ETDWare PS/2-X64 11.6.11.002_WHQL (Version: 11.6.11.002 - ELAN Microelectronic Corp.)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0 - )
FFmpeg v0.6.2 for Audacity (x32 Version:  - )
FileZilla Client 3.7.3 (HKCU Version: 3.7.3 - Tim Kosse)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Talk Plugin (x32 Version: 4.5.3.14917 - Google)
Google Talk Plugin (x32 Version: 5.1.2.17113 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Gpg4win (2.1.1) (x32 Version: 2.1.1 - The Gpg4win Project)
Identity Card (x32 Version: 2.00.3002 - Acer Incorporated)
Inkscape 0.48.4 (x32 Version: 0.48.4 - )
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2867 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
LAME v3.99.3 (for Windows) (x32 Version:  - )
Launch Manager (x32 Version: 7.0.4 - Acer Inc.)
Live Updater (x32 Version: 2.00.3002 - Acer Incorporated)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Miro (x32 Version: 6.0 - Participatory Culture Foundation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla)
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden
Office Addin (x32 Version: 2.01.3102 - Acer)
Office Addin 2003 (x32 Version: 2.01.3102 - Acer)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
PDF24 Creator 5.7.0 (x32 Version:  - PDF24.org)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.220 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (x32 Version: 11.41 - Qualcomm Atheros)
RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (x32 Version: 16.0.3 - RealNetworks)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (x32 Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Safari (x32 Version: 5.34.57.2 - Apple Inc.)
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2553065) (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2566458) (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version:  - Microsoft)
Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1 - Microsoft Corporation)
VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN)

==================== Restore Points  =========================

04-01-2014 14:01:56 Geplanter Prüfpunkt
14-01-2014 12:11:05 Geplanter Prüfpunkt
17-01-2014 19:07:11 Windows Update
23-01-2014 16:02:25 Removed Adobe AIR

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0A44C2EE-8E21-46D9-BE0F-006D6B773CEA} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-07-13] ()
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1CFF7D44-F5E7-42E9-891D-F5AD64DE9DFB} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {1E114134-D0BE-4D07-A9E7-BC1D85D02F7C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {478FA25E-1494-4827-81A2-5C86B79FF891} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {49E0386D-E74F-454E-A83C-BAD460F6AFFE} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {4BB34737-2102-4490-B92E-EC17E4F22976} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001UA => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {5231172E-0320-4F0D-BBC8-5EFC302C4EF7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {73A0AE8D-26E5-4EBC-A1FA-D8091F29BF4D} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {7AA88508-2E1A-46A7-9A5A-3BDF163C8E26} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-07-31] (Acer Incorporated)
Task: {7C435C37-741E-420A-8DE4-FCA9444D905F} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {7CD5FFF9-DD8F-4B60-83DA-DAEDD826AEA1} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {84C33C4A-EB98-4BFE-8245-EA5DF2B195E4} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-27] (AVAST Software)
Task: {8FE54917-6179-432A-BBBF-2AC11E819AD5} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {9F8A4BBA-C7D9-4B7A-886D-7271DD5B8641} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-07-13] ()
Task: {A72083A4-EC26-4FE0-B9FE-645E5102CD1A} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {B3DF58E0-8FA8-4AC3-BEC2-E101DD8BC394} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B73CA243-3408-44CA-AC05-60DD58D09727} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1243414234-900039719-3115000681-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {C91AF251-93C2-4CD9-B62A-84D799114D8A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001Core => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {CC57DF7F-DEFC-44CA-BC40-1BD6818C992D} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-07-13] ()
Task: {E9F4BA80-463C-46ED-BCB9-FDDA48521203} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-24] (Google Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\AutoKMSCustom.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001Core.job => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1243414234-900039719-3115000681-1001UA.job => C:\Users\Susanne\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-01-31 23:26 - 2013-01-31 23:31 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-01-28 13:45 - 2013-01-28 13:45 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-01-28 13:42 - 2013-01-28 13:42 - 00084992 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2012-08-11 21:46 - 2012-08-07 15:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-06-22 02:12 - 2012-06-22 02:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2014-01-23 20:57 - 2014-01-23 19:33 - 02166272 _____ () C:\Program Files\AVAST Software\Avast\defs\14012301\algo.dll
2013-05-28 17:44 - 2013-05-28 17:44 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-05-28 17:41 - 2013-05-28 17:41 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-05-28 17:44 - 2013-05-28 17:44 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-05-28 17:45 - 2013-05-28 17:45 - 00627712 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2013-05-28 17:42 - 2013-05-28 17:42 - 00037888 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\Susanne\AppData\Roaming\Dropbox\bin\libcef.dll
2013-10-21 18:54 - 2013-10-21 18:54 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-08-29 14:52 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: WAN-Miniport (Netzwerkmonitor)
Description: WAN-Miniport (Netzwerkmonitor)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: NdisWan
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Der angeforderte Dienst wurde bereits gestartet.

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.


==================== Memory info =========================== 

Percentage of memory in use: 31%
Total physical RAM: 3914.27 MB
Available physical RAM: 2678.64 MB
Total Pagefile: 4618.27 MB
Available Pagefile: 3347.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:678.33 GB) (Free:626.55 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 5A191643)

Partition: GPT Partition Type
==================== End Of Log ============================
Logfile von gmer:

Code:
ATTFilter
GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-23 21:28:50
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003f WDC_WD7500BPVT-22HXZT3 rev.01.01A01 698,64GB
Running: gmer.exe; Driver: C:\Users\Susanne\AppData\Local\Temp\fwloypow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                                                                                                                                                                                   000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\wininit.exe[648] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\csrss.exe[672] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                                                                                                                                                                                   000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\winlogon.exe[724] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\services.exe[768] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\lsass.exe[776] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                   000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[912] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[988] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\svchost.exe[304] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[348] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\dwm.exe[484] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                     000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\dwm.exe[484] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                        000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\dwm.exe[484] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                        000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\dwm.exe[484] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                      000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\svchost.exe[572] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\svchost.exe[124] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[1216] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[1588] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[1588] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                                                                                                                         000007f959d7177a 4 bytes [D7, 59, F9, 07]
.text    C:\Windows\System32\spoolsv.exe[1588] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                                                                                                                         000007f959d71782 4 bytes [D7, 59, F9, 07]
.text    C:\Windows\system32\svchost.exe[1640] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe[1768] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                       000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\dashost.exe[1016] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDService.exe[1756] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                       000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Intel\iCLS Client\HeciServer.exe[1400] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                              000007f95a64f7eb 1 byte [62]
.text    C:\Windows\RfBtnSvc64.exe[2128] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                      000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2200] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2592] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\taskhostex.exe[3004] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                             000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\taskhostex.exe[3004] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\taskhostex.exe[3004] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\taskhostex.exe[3004] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                              000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\wmiprvse.exe[1868] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\SearchIndexer.exe[3240] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrl.exe[3388] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrl.exe[3388] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                             000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrl.exe[3388] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                             000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrl.exe[3388] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                           000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[3608] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                    000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[3608] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                       000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[3608] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                       000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[3608] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                     000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3728] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\unsecapp.exe[3728] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                             000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3728] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                             000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3728] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                           000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3796] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                             000007f95a64f7eb 1 byte [62]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3796] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3796] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3796] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                              000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\igfxext.exe[3820] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                   000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                   000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                 000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4020] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                           000007f95a64f7eb 1 byte [62]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4020] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                              000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4020] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                              000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4020] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                            000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4020] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                                                                                                                                                  000007f94b351b32 4 bytes [35, 4B, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4020] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                                                                                                                                                  000007f94b351b3a 4 bytes [35, 4B, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4048] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                    000007f95a64f7eb 1 byte [62]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4048] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                       000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4048] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                       000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4048] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                     000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2236] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                    000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                    000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                  000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\RuntimeBroker.exe[1116] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\igfxtray.exe[3528] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                               000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\igfxtray.exe[3528] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                  000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\igfxtray.exe[3528] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                  000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\igfxtray.exe[3528] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\hkcmd.exe[2920] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                  000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\hkcmd.exe[2920] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                     000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\hkcmd.exe[2920] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                     000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\hkcmd.exe[2920] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                   000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[2240] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                               000007f95a64f7eb 1 byte [62]
.text    C:\Windows\System32\igfxpers.exe[2240] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                                                                                                                        000007f959d7177a 4 bytes [D7, 59, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[2240] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                                                                                                                        000007f959d71782 4 bytes [D7, 59, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[2240] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                  000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[2240] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                  000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\System32\igfxpers.exe[2240] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\printfilterpipelinesvc.exe[4576] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                 000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[5008] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                      000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[5008] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                                                                                               000007f959d7177a 4 bytes [D7, 59, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[5008] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                                                                                               000007f959d71782 4 bytes [D7, 59, F9, 07]
.text    C:\Windows\system32\igfxsrvc.exe[4288] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                               000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\igfxsrvc.exe[4288] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                  000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\igfxsrvc.exe[4288] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                  000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\igfxsrvc.exe[4288] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3724] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                          000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\wbem\unsecapp.exe[3724] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                             000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3724] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                             000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\wbem\unsecapp.exe[3724] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                           000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[1176] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                    000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[4424] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                    000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[4424] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                       000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[4424] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                       000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[4424] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                     000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[4080] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                           000007f95a64f7eb 1 byte [62]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[4080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                              000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[4080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                              000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[4080] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                            000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[4276] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                             000007f95a64f7eb 1 byte [62]
.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[4276] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                                                                                                                                                                    000007f94b351b32 4 bytes [35, 4B, F9, 07]
.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[4276] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                                                                                                                                                                    000007f94b351b3a 4 bytes [35, 4B, F9, 07]
.text    C:\Windows\explorer.exe[660] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                         000007f95a64f7eb 1 byte [62]
.text    C:\Windows\explorer.exe[660] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                            000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\explorer.exe[660] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                            000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\explorer.exe[660] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                          000007f955af165a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\explorer.exe[660] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                                                                                                                                                                                                000007f94b351b32 4 bytes [35, 4B, F9, 07]
.text    C:\Windows\explorer.exe[660] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                                                                                                                                                                                                000007f94b351b3a 4 bytes [35, 4B, F9, 07]
.text    C:\Windows\system32\taskeng.exe[3380] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                                                                                                                000007f95a64f7eb 1 byte [62]
.text    C:\Windows\system32\taskeng.exe[3380] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                                                                                                                                                   000007f955af1532 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\taskeng.exe[3380] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                                                                                                                                                   000007f955af153a 4 bytes [AF, 55, F9, 07]
.text    C:\Windows\system32\taskeng.exe[3380] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                                                                                                                                                 000007f955af165a 4 bytes [AF, 55, F9, 07]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [672:700]                                                                                                                                                                                                                                                    fffff960008bc5e8
---- Processes - GMER 2.1 ----

Process  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3120] (Commu(2013-01-31 22:26:40)  000007f78cd50000
Library  C:\Program Files\WindowsApps\Microsoft.VCLibs.110.00_11.0.51106.1_x64__8wekyb3d8bbwe\MSVCR110.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3120] (Microsoft® C Runtim(2013-01-31 19:26:47)  000007f94e260000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\wllog.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3120] (Windows (2013-01-31 22:26:44)  000007f94d5f0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Microsoft.WindowsLive.Platform.Service.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8b(2013-01-31 22:26:40)  000007f94d2a0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\shared\bici.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe [3120] (Wi(2013-01-31 22:26:44)  000007f94d220000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Microsoft.WindowsLive.Platform.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\Live(2013-01-31 22:26:40)  000007f94cff0000
Library  C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll (*** suspicious ***) @ C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb(2013-01-31 22:26:43)  000007f949cc0000
Process  C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4136]                                                                                                                                            0000000000400000
Process  C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Akamai\netsession_win.exe [4180]                                                                                                                                            0000000000400000
Process  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [4268]                                                                                                                                            0000000000400000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [4268](2014-01-03 00:45:04)                                                                                                                  0000000003ed0000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [4268](2013-10-18 23:55:02)                                                                                                                        00000000632c0000
Library  C:\Users\Susanne\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Susanne\AppData\Roaming\Dropbox\bin\Dropbox.exe [4268]                                                                                                                                              00000000620a0000
Process  C:\Users\Susanne\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe (*** suspicious ***) @ C:\Users\Susanne\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe [4904](2014-01-21 20:56:24)                                                                                             0000000000400000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
und eset online scanner fund:
Code:
ATTFilter
C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir	Variante von Win32/Adware.Yontoo.B Anwendung
C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R6ZQZP5I\yontoosetup[1].exe	Mehrere Bedrohungen
hinterher gelöscht und die Funde in Quarantäne von AdwCleaner:

Code:
ATTFilter
# AdwCleaner v3.017 - Bericht erstellt am 23/01/2014 um 21:07:36
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Susanne - SUSES-PC
# Gestartet von : C:\Users\Susanne\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnjcnjlaajofpendibcoodneacalfho
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnjcnjlaajofpendibcoodneacalfho
Ordner Gelöscht : C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\n7q5ytvq.default\prefs.js ]


[ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\pko8v4d0.default\prefs.js ]


-\\ Google Chrome v32.0.1700.76

[ Datei : C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [20258 octets] - [23/01/2014 12:48:39]
AdwCleaner[R1].txt - [1631 octets] - [23/01/2014 21:06:27]
AdwCleaner[S0].txt - [20189 octets] - [23/01/2014 12:50:27]
AdwCleaner[S1].txt - [1552 octets] - [23/01/2014 21:07:36]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1612 octets] ##########
Alle Browser sind wieder normal am Arbeiten. Der Rechner läuft wieder ohne Verzögerung. Fährt schnell hoch. Werbung ist weg. Ich habe ein richtig gutes Gefühl. Muss ich noch auf etwas Acht geben?

Tausend Dank an den Admin für den Leitfaden.

Alt 24.01.2014, 14:30   #5
schrauber
/// the machine
/// TB-Ausbilder
 
websearch.toolksearch.info Virus vollständig vom Rechner entfernen - Standard

websearch.toolksearch.info Virus vollständig vom Rechner entfernen


Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu websearch.toolksearch.info Virus vollständig vom Rechner entfernen
.dll, adblock, browser, fehlermeldung, livecomm.exe, malware / spyware, pup.bundleinstaller.oi, pup.optional.1clickdownload.a, pup.optional.babylon.a, pup.optional.babylontoolbar.a, pup.optional.bprotector.a, pup.optional.browserdefender.a, pup.optional.datamngr.a, pup.optional.delta, pup.optional.delta.a, pup.optional.gophoto.a, pup.optional.greatsaver.a, pup.optional.hdvidcodec.a, pup.optional.iminent.a, pup.optional.multiplug, pup.optional.multiplug.a, pup.optional.pricepeep.a, pup.optional.sweetim.a, pup.optional.websearchinfo, win32/adware.yontoo.b, windowsapps


« Trojaner nach Adobe Flash Player Update | XP: svchost.exe krampft sich die komplette CPU-Zeit »


Ähnliche Themen: websearch.toolksearch.info Virus vollständig vom Rechner entfernen


  1. Websearch.searchouse.info entfernen
    Anleitungen, FAQs & Links - 10.09.2015 (2)
  2. websearch.coolsearches.info entfernen
    Anleitungen, FAQs & Links - 04.04.2015 (2)
  3. Websearch.searchdominion.info entfernen
    Anleitungen, FAQs & Links - 04.03.2015 (2)
  4. websearch.look-for-it.info entfernen
    Anleitungen, FAQs & Links - 15.02.2015 (2)
  5. Websearch.searchplazanow.info entfernen
    Anleitungen, FAQs & Links - 27.01.2015 (2)
  6. Websearch.Searchoholic.info entfernen
    Anleitungen, FAQs & Links - 14.12.2014 (2)
  7. websearch.searchmania.info entfernen
    Anleitungen, FAQs & Links - 26.11.2014 (2)
  8. Websearch.wonderfulsearches.info entfernen
    Anleitungen, FAQs & Links - 21.07.2014 (2)
  9. websearch.flyandsearch.info entfernen
    Anleitungen, FAQs & Links - 08.07.2014 (2)
  10. Websearch.calcitapp.info entfernen
    Anleitungen, FAQs & Links - 01.07.2014 (2)
  11. Websearch.eazytosearch.info entfernen
    Anleitungen, FAQs & Links - 23.05.2014 (2)
  12. Websearch.searchissimple.info entfernen
    Anleitungen, FAQs & Links - 28.03.2014 (2)
  13. websearch.exitingsearch.info entfernen
    Anleitungen, FAQs & Links - 24.02.2014 (2)
  14. Websearch.WebIsAwsome.info entfernen
    Anleitungen, FAQs & Links - 13.02.2014 (2)
  15. Websearch.toolksearchbook.info entfernen
    Anleitungen, FAQs & Links - 06.01.2014 (2)
  16. websearch.pu-results.info entfernen
    Anleitungen, FAQs & Links - 29.12.2013 (2)
  17. Websearch.searchsunmy.info entfernen
    Anleitungen, FAQs & Links - 19.12.2013 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema websearch.toolksearch.info Virus vollständig vom Rechner entfernen - Hallo. Ich habe mir dummerweise den websearch.toolksearch.info Virus beim Download einer freeware zugezogen. Daraufhin öffnete sich als neuer Tab im Firefox diese vermeintliche Suchmaschine. Mein Adblock, Ghostery und die Linkleiste - websearch.toolksearch.info Virus vollständig vom Rechner entfernen...
Archiv
Du betrachtest: websearch.toolksearch.info Virus vollständig vom Rechner entfernen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55