Hallo,

hier die Scans:
ADWCleaner:

# AdwCleaner v3.017 - Bericht erstellt am 24/01/2014 um 01:36:49
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Papagena - HOME
# Gestartet von : C:\Users\Papagena\Downloads\AdwCleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


Und Dankeschön für die Zeit, die Du opferst, um Laien wie mir zu helfen.:dankeschoen:



***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\AskToolbar

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Google Chrome v

[ Datei : C:\Users\Papagena\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [10971 octets] - [28/11/2013 18:59:36]
AdwCleaner[R1].txt - [11032 octets] - [28/11/2013 19:20:41]
AdwCleaner[R2].txt - [11093 octets] - [28/11/2013 19:35:15]
AdwCleaner[R3].txt - [11154 octets] - [28/11/2013 19:49:06]
AdwCleaner[R4].txt - [2014 octets] - [28/11/2013 21:41:03]
AdwCleaner[R5].txt - [2021 octets] - [24/01/2014 01:08:34]
AdwCleaner[R6].txt - [1863 octets] - [24/01/2014 01:32:17]
AdwCleaner[S0].txt - [10924 octets] - [28/11/2013 21:21:21]
AdwCleaner[S1].txt - [2086 octets] - [24/01/2014 01:28:26]
AdwCleaner[S2].txt - [1734 octets] - [24/01/2014 01:36:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1794 octets] ##########
         

JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Papagena on 24.02.2014 at 11:17:15,12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{DBFD8F59-B386-4152-A699-8FFBB643E036}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Papagena\appdata\local\apn"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.02.2014 at 11:22:47,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Farbar:


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-02-2014 02
Ran by Papagena (administrator) on HOME on 24-02-2014 12:18:10
Running from C:\Users\Papagena\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Acer Incorporated) C:\Program Files\eMachines\eMachines Power Management\ePowerEvent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent.exe
() C:\Program Files (x86)\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Launcher.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files (x86)\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Users\Papagena\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Papagena\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Papagena\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Papagena\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Papagena\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2097960 2010-04-22] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11046504 2010-07-13] (Realtek Semiconductor)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2013-05-14] (Microsoft 

Corporation)
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\Run: [Google Update] - C:\Users\Papagena\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-09-18] 

(Google Inc.)
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] 

(FileHippo.com)
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: E - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: G - G:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: H - H:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {0bf68197-6351-11e3-aec1-5cac4c10752e} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {0bf681a4-6351-11e3-aec1-5cac4c10752e} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {0bf68253-6351-11e3-aec1-60eb696c34a2} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {2f16472e-4860-11e3-80c7-46ac4c10752e} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {63a49862-4dca-11e2-ac58-5cac4c10752e} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {721d8243-3964-11e3-904a-60eb696c34a2} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {c41d2e9d-3851-11e3-b0e9-5cac4c10752e} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {c41d2ecb-3851-11e3-b0e9-5cac4c10752e} - E:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-3809914474-2379848128-2296167677-1000\...\MountPoints2: {f64ab3bf-1aa9-11e0-b28b-5cac4c10752e} - H:\.\Autorun.exe AUTORUN=1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live

\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\..\Interfaces\{34527D74-4FD1-4E39-BA9A-4E464207F035}: [NameServer]212.23.115.84 212.23.115.148

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR DefaultSearchURL: hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Users\Papagena\AppData\Local\Google\Chrome\Application\33.0.1750.117\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Papagena\AppData\Local\Google\Chrome\Application\33.0.1750.117\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Papagena\AppData\Local\Google\Chrome\Application\33.0.1750.117\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (Google Wallet) - C:\Users\Papagena\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2011-01-09] ()
R2 ALDITALKVerbindungsassistent_Service; C:\Program Files (x86)\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe [358968 2013-07-26] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe [868896 2010-06-11] (Acer Incorporated)
S3 GameConsoleService; C:\Program Files (x86)\eMachines Games\eMachines Game Console\GameConsoleService.exe [246520 2010-04-04] (WildTangent, Inc.)
R2 GREGService; C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 ewsercd; C:\Windows\System32\DRIVERS\ewsercd.sys [112896 2011-01-08] (Huawei Technologies Co., Ltd.)
S3 ew_hwusbdev; C:\Windows\SysWOW64\DRIVERS\ew_hwusbdev.sys [117248 2013-12-12] (Huawei Technologies Co., Ltd.)
R3 hwdatacard; C:\Windows\SysWOW64\DRIVERS\ewusbmdm.sys [121600 2013-12-12] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U3 Usbilt; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-24 12:18 - 2014-02-24 12:18 - 00013195 _____ () C:\Users\Papagena\Downloads\FRST.txt
2014-02-24 12:06 - 2014-02-24 12:16 - 02155520 _____ (Farbar) C:\Users\Papagena\Downloads\FRST64.exe
2014-02-24 11:17 - 2014-02-24 11:17 - 00000000 ____D () C:\Windows\ERUNT
2014-02-24 01:47 - 2014-02-24 01:51 - 01037734 _____ (Thisisu) C:\Users\Papagena\Downloads\JRT.exe
2014-02-24 00:48 - 2014-02-24 01:11 - 00000000 ____D () C:\AdwCleaner
2014-02-24 00:06 - 2014-02-24 00:12 - 01241834 _____ () C:\Users\Papagena\Downloads\adwcleaner.exe
2014-02-23 17:46 - 2014-02-23 17:46 - 00642688 _____ () C:\Windows\Minidump\022314-42198-01.dmp
2014-02-23 17:45 - 2014-02-23 17:45 - 425685574 _____ () C:\Windows\MEMORY.DMP
2014-02-23 17:45 - 2014-02-23 17:45 - 00000618 _____ () C:\Windows\PFRO.log
2014-02-23 15:56 - 2014-02-23 17:12 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-23 15:56 - 2014-02-23 15:56 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-23 15:25 - 2014-02-23 15:26 - 50837888 _____ (Adobe Systems Incorporated) C:\Program Files (x86)\AdbeRdr11006_en_US.exe
2014-02-23 15:14 - 2014-02-23 15:14 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-02-23 15:14 - 2014-02-23 15:14 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-02-23 15:12 - 2014-02-23 15:13 - 18126032 _____ (Adobe Systems Inc.) C:\Program Files (x86)\AdobeAIRInstaller.exe
2014-02-23 10:17 - 2014-02-24 10:54 - 00000392 _____ () C:\Windows\setupact.log
2014-02-23 10:17 - 2014-02-23 10:17 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-20 19:04 - 2014-02-20 19:04 - 00002904 _____ () C:\Windows\System32\Tasks\{33895D5D-61F2-46B0-9ECC-0D1DEF8C2466}
2014-02-20 18:52 - 2014-02-23 15:54 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-19 16:35 - 2014-02-19 16:35 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-02-19 16:33 - 2014-02-19 16:33 - 01110476 _____ () C:\Users\Papagena\ZIP-Programm-7z920.exe
2014-02-19 02:08 - 2014-02-19 02:08 - 00000000 _____ () C:\Users\Papagena\defogger_reenable
2014-02-19 01:56 - 2014-02-19 02:07 - 00052841 _____ () C:\Program Files (x86)\Papagena Farbar-Addition.txt
2014-02-19 01:55 - 2014-02-24 12:18 - 00000000 ____D () C:\FRST
2014-02-19 01:22 - 2014-02-19 01:30 - 02153472 _____ (Farbar) C:\Program Files (x86)\Farbar Recovery Scan-FRST64.exe
2014-02-18 23:34 - 2014-02-18 23:34 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-18 23:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-18 11:16 - 2014-02-18 11:16 - 00002012 _____ () C:\Users\Papagena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2014-02-18 11:16 - 2014-02-18 11:16 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-18 02:57 - 2014-02-18 02:58 - 00264757 _____ () C:\Program Files (x86)\File Hippo Update Checker-FHSetup.exe
2014-02-18 02:00 - 2014-02-18 02:00 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Fax
2014-02-18 01:54 - 2014-02-18 01:56 - 00700980 _____ () C:\Program Files (x86)\adblock_edge-2.0.7-sm+an+tb+fx-windows.xpi
2014-02-16 11:59 - 2014-02-16 12:27 - 00019968 _____ () C:\Users\Papagena\Eigene Dokumente\Tati Lohn berechnen.xls
2014-02-14 01:02 - 2014-02-14 01:02 - 00007698 _____ () C:\Program Files (x86)\hijackthis.log
2014-02-13 04:58 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-13 04:58 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-13 04:58 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-13 04:58 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-13 04:58 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-13 04:58 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-13 04:58 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-13 04:58 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-13 04:58 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-13 04:58 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-13 04:58 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-13 04:58 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-13 04:58 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-13 04:58 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-13 04:58 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-13 04:58 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-13 04:58 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-13 04:58 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-13 04:58 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-13 04:58 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-13 04:58 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-13 04:58 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-13 04:58 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-13 04:58 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-13 04:58 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-13 04:58 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-13 04:58 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-13 04:58 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-13 04:58 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-13 04:58 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-13 04:58 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-13 04:58 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-13 04:58 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-13 04:58 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-13 04:58 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-13 04:58 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-13 04:58 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-13 04:58 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-13 04:58 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-13 02:46 - 2014-02-13 02:46 - 00003024 _____ () C:\Windows\System32\Tasks\{379DF8EF-DFCC-468D-ADE2-9AC566292CF1}
2014-02-13 01:38 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-13 01:38 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-13 01:38 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-13 01:38 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-13 01:38 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-13 01:38 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-13 01:38 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-13 01:38 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-13 01:38 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-13 01:38 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-13 01:38 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-13 01:38 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-13 01:38 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-13 01:38 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-13 01:38 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-13 01:38 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-13 01:38 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-13 01:38 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-13 01:37 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-13 01:37 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-13 01:37 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-13 01:37 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-13 00:01 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-13 00:01 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 23:18 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 23:18 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 23:18 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 23:18 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 23:11 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 23:11 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-02 14:00 - 2014-02-02 14:00 - 00000000 ____D () C:\Program Files (x86)\backups
2014-01-28 22:49 - 2014-01-28 22:49 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Meine empfangenen Dateien
2014-01-25 21:00 - 2014-01-25 21:00 - 00000000 ____D () C:\Users\Papagena\AppData\Roaming\Avira
2014-01-25 20:12 - 2014-01-25 20:20 - 130658432 _____ () C:\Program Files (x86)\avira_free_antivirus_de.exe

==================== One Month Modified Files and Folders =======

2014-02-24 12:18 - 2014-02-24 12:18 - 00013195 _____ () C:\Users\Papagena\Downloads\FRST.txt
2014-02-24 12:18 - 2014-02-19 01:55 - 00000000 ____D () C:\FRST
2014-02-24 12:16 - 2014-02-24 12:06 - 02155520 _____ (Farbar) C:\Users\Papagena\Downloads\FRST64.exe
2014-02-24 12:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-24 11:33 - 2011-01-09 11:07 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-24 11:32 - 2012-09-18 14:46 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3809914474-2379848128-2296167677-1000UA.job
2014-02-24 11:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-02-24 11:17 - 2014-02-24 11:17 - 00000000 ____D () C:\Windows\ERUNT
2014-02-24 11:02 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-24 11:02 - 2009-07-14 05:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-24 10:57 - 2011-01-10 19:09 - 00000000 ____D () C:\Users\Papagena\Tracing
2014-02-24 10:54 - 2014-02-23 10:17 - 00000392 _____ () C:\Windows\setupact.log
2014-02-24 10:54 - 2011-01-09 11:07 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-24 10:54 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-24 02:47 - 2009-01-01 01:24 - 01268857 _____ () C:\Windows\WindowsUpdate.log
2014-02-24 01:51 - 2014-02-24 01:47 - 01037734 _____ (Thisisu) C:\Users\Papagena\Downloads\JRT.exe
2014-02-24 01:11 - 2014-02-24 00:48 - 00000000 ____D () C:\AdwCleaner
2014-02-24 00:12 - 2014-02-24 00:06 - 01241834 _____ () C:\Users\Papagena\Downloads\adwcleaner.exe
2014-02-23 20:57 - 2009-07-14 06:13 - 00006512 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-23 20:57 - 2009-01-01 10:12 - 09596424 _____ () C:\Windows\system32\perfh007.dat
2014-02-23 20:57 - 2009-01-01 10:12 - 03010450 _____ () C:\Windows\system32\perfc007.dat
2014-02-23 18:32 - 2012-09-18 14:46 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3809914474-2379848128-2296167677-1000Core.job
2014-02-23 17:46 - 2014-02-23 17:46 - 00642688 _____ () C:\Windows\Minidump\022314-42198-01.dmp
2014-02-23 17:46 - 2012-12-10 22:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-23 17:45 - 2014-02-23 17:45 - 425685574 _____ () C:\Windows\MEMORY.DMP
2014-02-23 17:45 - 2014-02-23 17:45 - 00000618 _____ () C:\Windows\PFRO.log
2014-02-23 17:14 - 2013-03-26 18:50 - 00000000 ___RD () C:\Users\Papagena\Eigene Dokumente
2014-02-23 17:12 - 2014-02-23 15:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-23 17:00 - 2010-07-26 03:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-23 16:57 - 2011-01-07 16:33 - 00000000 ____D () C:\Users\Papagena\AppData\Roaming\Adobe
2014-02-23 15:56 - 2014-02-23 15:56 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-23 15:54 - 2014-02-20 18:52 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-23 15:44 - 2011-01-07 16:11 - 00000000 ____D () C:\Users\Papagena
2014-02-23 15:32 - 2010-07-26 03:19 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-02-23 15:31 - 2011-01-13 23:09 - 00000000 ____D () C:\Users\Papagena\AppData\Local\Adobe
2014-02-23 15:26 - 2014-02-23 15:25 - 50837888 _____ (Adobe Systems Incorporated) C:\Program Files (x86)\AdbeRdr11006_en_US.exe
2014-02-23 15:14 - 2014-02-23 15:14 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-02-23 15:14 - 2014-02-23 15:14 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-02-23 15:13 - 2014-02-23 15:12 - 18126032 _____ (Adobe Systems Inc.) C:\Program Files (x86)\AdobeAIRInstaller.exe
2014-02-23 10:17 - 2014-02-23 10:17 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-20 19:04 - 2014-02-20 19:04 - 00002904 _____ () C:\Windows\System32\Tasks\{33895D5D-61F2-46B0-9ECC-0D1DEF8C2466}
2014-02-20 14:51 - 2013-12-12 18:18 - 00000000 ____D () C:\Users\Papagena\AppData\Roaming\ALDITALKVerbindungsassistent
2014-02-19 16:35 - 2014-02-19 16:35 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-02-19 16:33 - 2014-02-19 16:33 - 01110476 _____ () C:\Users\Papagena\ZIP-Programm-7z920.exe
2014-02-19 02:08 - 2014-02-19 02:08 - 00000000 _____ () C:\Users\Papagena\defogger_reenable
2014-02-19 02:07 - 2014-02-19 01:56 - 00052841 _____ () C:\Program Files (x86)\Papagena Farbar-Addition.txt
2014-02-19 01:33 - 2013-06-08 20:19 - 00000000 ____D () C:\Firefox
2014-02-19 01:30 - 2014-02-19 01:22 - 02153472 _____ (Farbar) C:\Program Files (x86)\Farbar Recovery Scan-FRST64.exe
2014-02-18 23:34 - 2014-02-18 23:34 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-18 11:16 - 2014-02-18 11:16 - 00002012 _____ () C:\Users\Papagena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2014-02-18 11:16 - 2014-02-18 11:16 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-18 02:58 - 2014-02-18 02:57 - 00264757 _____ () C:\Program Files (x86)\File Hippo Update Checker-FHSetup.exe
2014-02-18 02:00 - 2014-02-18 02:00 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Fax
2014-02-18 01:56 - 2014-02-18 01:54 - 00700980 _____ () C:\Program Files (x86)\adblock_edge-2.0.7-sm+an+tb+fx-windows.xpi
2014-02-17 12:28 - 2011-01-09 11:07 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-17 12:28 - 2011-01-09 11:07 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-16 18:27 - 2012-09-18 14:46 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3809914474-2379848128-2296167677-1000UA
2014-02-16 18:27 - 2012-09-18 14:46 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3809914474-2379848128-2296167677-1000Core
2014-02-16 12:27 - 2014-02-16 11:59 - 00019968 _____ () C:\Users\Papagena\Eigene Dokumente\Tati Lohn berechnen.xls
2014-02-14 01:02 - 2014-02-14 01:02 - 00007698 _____ () C:\Program Files (x86)\hijackthis.log
2014-02-13 14:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-13 02:46 - 2014-02-13 02:46 - 00003024 _____ () C:\Windows\System32\Tasks\{379DF8EF-DFCC-468D-ADE2-9AC566292CF1}
2014-02-13 01:12 - 2013-07-14 01:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-13 01:09 - 2011-03-27 23:02 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-08 02:18 - 2013-11-21 02:28 - 00025600 _____ () C:\Users\Papagena\Eigene Dokumente\Unterlagen Dt. RV.xls
2014-02-06 13:16 - 2014-02-13 04:58 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-13 04:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-13 04:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-13 04:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-13 04:58 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-13 04:58 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-13 04:58 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-13 04:58 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-13 04:58 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-13 04:58 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-13 04:58 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-13 04:58 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-13 04:58 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-13 04:58 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-13 04:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-13 04:58 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-13 04:58 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-13 04:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-13 04:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-13 04:58 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-13 04:58 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-13 04:58 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-13 04:58 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-13 04:58 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-13 04:58 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-13 04:58 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-13 04:58 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-13 04:58 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-13 04:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-13 04:58 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-13 04:58 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-13 04:58 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-13 04:58 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-13 04:58 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-13 04:58 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-13 04:58 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-13 04:58 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-13 04:58 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-13 04:58 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-04 22:52 - 2012-01-17 23:52 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-02-04 12:33 - 2014-01-06 23:34 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Ausdrucken Jan. 2014
2014-02-03 13:27 - 2013-09-23 17:31 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Gewinnspiele Newsletter
2014-02-03 12:23 - 2009-01-01 01:23 - 00000000 ____D () C:\Program Files (x86)\Launch Manager
2014-02-02 14:00 - 2014-02-02 14:00 - 00000000 ____D () C:\Program Files (x86)\backups
2014-01-30 15:08 - 2014-01-23 23:37 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Münzen
2014-01-28 22:49 - 2014-01-28 22:49 - 00000000 ____D () C:\Users\Papagena\Eigene Dokumente\Meine empfangenen Dateien
2014-01-25 21:00 - 2014-01-25 21:00 - 00000000 ____D () C:\Users\Papagena\AppData\Roaming\Avira
2014-01-25 20:20 - 2014-01-25 20:12 - 130658432 _____ () C:\Program Files (x86)\avira_free_antivirus_de.exe
2014-01-25 16:51 - 2013-06-08 20:18 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-01-25 16:51 - 2013-02-14 12:57 - 00000000 ____D () C:\ProgramData\Avira
2014-01-25 16:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

Files to move or delete:
====================
C:\Users\Papagena\ZIP-Programm-7z920.exe


Some content of TEMP:
====================
C:\Users\Papagena\AppData\Local\Temp\avgnt.exe
C:\Users\Papagena\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-18 11:49

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---
--- --- ---


Und Dankeschön für die Zeit, die Du opferst, um Laien wie mir zu helfen.

adwCleaner neu runterladen und wiederholen

Habe neuen Scan gemacht:

[CODE]# AdwCleaner v3.019 - Bericht erstellt am 26/02/2014 um 14:38:27
# Aktualisiert 17/02/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Papagena - HOME
# Gestartet von : C:\Users\Papagena \Downloads\adwcleaner (2).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Google Chrome v

[ Datei : C:\Users\Papagena \AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R10].txt - [961 octets] - [25/02/2014 17:45:38]
AdwCleaner[R11].txt - [1021 octets] - [26/02/2014 14:35:01]
AdwCleaner[R8].txt - [778 octets] - [24/02/2014 00:48:45]
AdwCleaner[R9].txt - [837 octets] - [24/02/2014 00:54:42]
AdwCleaner[S3].txt - [909 octets] - [24/02/2014 01:11:20]
AdwCleaner[S4].txt - [943 octets] - [26/02/2014 14:38:27]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1002 octets] ##########
[/CODE
Mir ist aufgefallen, daß bei dem Scan, also wenn ich auf Suche geklickt habe, der Scan läuft, wenn dieser dann abgeschlossen ist, dann erscheint da wo steht "Warte auf Aktion", Warte ab......
Ich weiß nicht, ob der Scan dann noch sucht oder nicht, habe längere Zeit gewartet, getan hat sich aber nichts.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Papagena\ZIP-Programm-7z920.exe
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-02-2014 01
Ran by Papagena  at 2014-02-26 15:34:13 Run:1
Running from C:\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Papagena\ZIP-Programm-7z920.exe
         
*****************

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
"C:\Users\Papagena\ZIP-Programm-7z920.exe" => File/Directory not found.

==== End of Fixlog ====
         

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Malwarebytes-Scan:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.26.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Papagena  :: HOME [Administrator]

26.02.2014 17:16:20
mbam-log-2014-02-26 (17-16-20).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 241085
Laufzeit: 6 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Also hatte ich wohl einen Virus "PUP Optional Softonic", der am 19.2.14 in Quarantäne gestellt wurde. Das war wohl unter C:\Program Files Softonic Downloader f. Messenger" gespeichert war.

Kann ich denn den Messenger weiter nutzen? Oder ist dann der Virus oder was immer das war, wieder auf dem PC?

ESET lade ich später und stelle das ein.

Messenger kannst du nutzen, Softonic wurde entfernt. Am besten wärs wenn du aber garnix mehr von Softonic lädst.

Ja, dann werde ich Softonic nicht mehr nutzen, war wohl das Portal, wo ich Messenger heruntergeladen hatte. Ich dachte, das sei sicher. Falsch gedacht.

Hatte Gestern noch probiert, mit Eset zu prüfen, hat noch nicht funktioniert, werde das Heute abends noch machen, hoffe mein Laptop macht dann nicht wieder schlapp.

Helau

Hatte 2 Mal mit ESET gescannt, hat jeweils fast 2 Std. gedauert.

Leider war bei beiden Malen keine neue Logdatei vorhanden, sondern die die Log.txt von dem Tag, an dem ich das ESET aus dem Internet heruntergeladen hatte.
Hatte diese Woche leider nicht so viel Zeit, werde das am WE noch einmal probieren. Ich werde das ESET löschen, neu herunterladen und dann noch einmal scannen und die Log.txt hier einstellen.

LG Papagena