Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung

AnschaPC · 20.02.2014, 13:11

Hallo,

Weihnachten war mein Neffe am Rechner seiner Oma und seitdem ist die Internetnutzung (Firefox) eine Katastrophe: unerwünschte Seiten, Popups, Weiterleitungen. Lt. Aussage meiner Mutter tauchen die Popups auch auf, wenn sie nicht im Internet ist.

Ende 2013 habe ich dann als Ursache "Lollipop" (ich bin mir nicht mehr ganz sicher, ob der so hieß) ausgemacht und mit Internethilfe (chip.de) deinstalliert. Sah auch kurze Zeit so aus, als würde das funktionieren.

Vor ca. zwei Wochen war diese Malware? Adware? (Sorry, auch ich bin nur Anwender) wieder unter den Programmen zu finden. Heute nicht mehr.

Ich hoffe, dass ihr uns weiterhelfen könnt.
Der PC läuft mit Windows 7.

Gruß,
Anscha

Anbei die Scans.

Wie bekomme ich die exportierten Scan-Ergebnisse von Avira hier rein?

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:54 on 20/02/2014 (Hannelore)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2014
Ran by Hannelore at 2014-02-20 11:57:40
Running from C:\Users\Hannelore\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 1.2.0 - Hewlett-Packard) Hidden
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03 - Adobe Systems Incorporated)
AI Manager (x32 Version: 1.08.10 - ASUSTeK)
Alamandi (x32 Version: 0.0.0.0 - INTENIUM GmbH)
Allway Sync version 12.16.1 (x32 Version:  - Botkind Inc)
AMD Fuel (Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
AMD USB Filter Driver (x32 Version: 1.0.15.94 - Advanced Micro Devices, Inc.) Hidden
ASUS Backup Wizard (x32 Version: 1.00.10 - ASUSTeK Computer Inc.)
ASUSUpdate (x32 Version: 7.18.03 - ASUSTeK Computer Inc.)
AsusVibe2.0 (x32 Version: 2.0.3.585 - ASUSTEK)
ATI AVIVO64 Codecs (Version: 11.6.0.10126 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (Version: 3.0.812.0 - ATI Technologies, Inc.)
Avira Free Antivirus (x32 Version: 14.0.3.338 - Avira)
Big Fish Games: Game Manager (x32 Version: 2.0.0.8 - )
Brickshooter Egypt (x32 Version: 1.00.0000 - Purplehills)
Build It Green (x32 Version:  - )
Butterfly Magic (x32 Version:  - )
Campgrounds (x32 Version:  - )
Canon Easy-PhotoPrint EX (x32 Version:  - )
Canon Easy-WebPrint EX (x32 Version:  - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (x32 Version:  - )
Canon MG5100 series Benutzerregistrierung (x32 Version:  - )
Canon MG5100 series MP Drivers (Version:  - )
Canon MP Navigator EX 4.0 (x32 Version:  - )
Canon My Printer (x32 Version:  - )
Canon Solution Menu EX (x32 Version:  - )
Casual Games 1  (x32 Version: 1 - KlickMedia)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0126.1749.31909 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0126.1749.31909 - ATI) Hidden
Catalyst Control Center Profiles Desktop (x32 Version: 2011.0126.1749.31909 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help English (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help French (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help German (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
ccc-core-static (x32 Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2011.0126.1749.31909 - ATI) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Crazy Machines Elements (x32 Version:  - dtp)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Das gelobte Land (x32 Version:  - )
Das Rettungsteam 2 (x32 Version: 1.00.0000 - PurpleHills)
Das Rettungsteam 3 (x32 Version:  - )
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version:  - Microsoft)
DEUTSCHLAND SPIELT GAME CENTER (x32 Version: 1.0.0.45 - INTENIUM GmbH)
Diamantenzauber (x32 Version:  - )
Die ersten 10 Jahre (x32 Version: 1.00.0000 - )
Die Legende von Pocahontas (x32 Version:  - cerasus.media GmbH)
Die Sage von Kolossus (x32 Version:  - Alawar Entertainment Inc.)
Die Sims™ 3 (x32 Version: 1.50.56 - Electronic Arts)
DMUninstaller (x32 Version:  - ) <==== ATTENTION
Dragon Portals (x32 Version: 1.00 - phenomedia publishing gmbh)
EPU-4 Engine (x32 Version: 1.01.02 - )
Euro Truck Simulator 2 (x32 Version: 1.1.1 - SCS Software)
Farm Frenzy - Helden der Vikinger (x32 Version:  - )
Farm Frenzy 3 - Madagaskar (x32 Version:  - )
Farm Frenzy 3 (x32 Version:  - )
Farm Frenzy: Frische Fische (x32 Version:  - Alawar Entertainment Inc.)
Farm Girl (x32 Version:  - )
FarmFrenzy (x32 Version:  - )
FarmFrenzy Pizza Party (x32 Version:  - )
Farmscapes (x32 Version:  - Playrix Entertainment)
Fishdom 2 Deluxe (x32 Version:  - Playrix Entertainment)
Fishdom 3 (x32 Version:  - Playrix Entertainment)
Fisher's Family Farm (x32 Version:  - )
flash-Enhancer (x32 Version: 2.1 - flash-Enhancer.com) <==== ATTENTION
Fruit Lockers 2 (x32 Version:  - )
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gardenscapes (x32 Version:  - Playrix Entertainment)
Goldene Jahre: Der weite Westen (x32 Version: 1.0.0.0 - INTENIUM GmbH)
GPL Ghostscript (x32 Version: 9.05 - Artifex Software Inc.)
Heroes of Hellas 2 - Olympia (x32 Version: 1.00.0000 - PurpleHills)
Hugo Retro Mania (x32 Version: 1.0.0 - Krea Medie)
Hund und Co. (x32 Version: 1.0.0.0 - INTENIUM GmbH)
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
Ice-Land (x32 Version:  - )
Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION
Jewel Quest: Heritage (nur deinstallation) (x32 Version:  - )
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kitten Sanctuary (x32 Version: 1.00 - phenomedia publishing gmbh)
Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)
Lost City of Gold (x32 Version:  - )
Media Player (x32 Version: 1.1 - Media Player)
Mein eigener Bauernhof (x32 Version:  - Realore Studios)
Mein eigenes Tierheim (HKCU Version: V1.000000 - )
Mein Landleben (x32 Version:  - )
Mein Landleben 2 (x32 Version:  - )
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft Zoo Tycoon (x32 Version:  - )
Minigolf Pro (x32 Version:  - )
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0 - Microsoft Corporation)
MultiScreen (x32 Version: 1.00.0000 - Samsung Electronics Ltd.)
Mysterious City: Vegas (nur deinstallation) (x32 Version:  - )
NeoBall (x32 Version:  - )
Nero 7 Premium (x32 Version: 7.02.5043 - Nero AG)
NVIDIA PhysX (x32 Version: 9.10.0513 - NVIDIA Corporation)
p.i.c.s. Rätsel-Generator (x32 Version:  - )
Pioneer Lands (x32 Version: 1.0.0.0 - INTENIUM GmbH)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Plus-HD-1.2 (x32 Version: 1.32.153.0 - Plus HD) <==== ATTENTION
PressAKey (www.blaeul.de) (x32 Version:  - )
Realtek Ethernet Controller Driver (x32 Version: 7.31.1025.2010 - Realtek)
Re-markit (x32 Version:  - Re-markit Software) <==== ATTENTION
Retter in der Not (x32 Version:  - )
Samsung_MonSetup (x32 Version: 1.00.0000 - Samsung)
secrets of tahiti (x32 Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Snowy - Fish Frenzy (x32 Version:  - )
Software Version Updater (x32 Version: 1.1.3.8 - ) <==== ATTENTION
Sunshine Acres (x32 Version:  - )
TeamViewer 6 (x32 Version: 6.0.13992 - TeamViewer GmbH)
Tetris (x32 Version: 1.64 - Crystal Office Systems)
The Treasures Of Montezuma 3 (x32 Version:  - Alawar Entertainment Inc.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version:  - Microsoft)
Updater (x32 Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
VIA Platform Device Manager (x32 Version: 1.34 - VIA Technologies, Inc.)
Video Player (x32 Version: 1.1 - Video Player) <==== ATTENTION
VirtualFarm (x32 Version:  - )
VLC media player 1.1.5 (x32 Version: 1.1.5 - VideoLAN)
Weltraum Tycoon (x32 Version: 1.00.0000 - IncaGold)
Wildlife Park 2 (x32 Version: 1.25 - Deep Silver)
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
World of Zoo (x32 Version: 1.0 - Blue Fang Games) Hidden
World of Zoo (x32 Version: 1.0 - THQ Inc.)
WPM17.8.0.3159 (x32 Version: 17.8.0.3159 - Cherished Technololgy LIMITED) <==== ATTENTION
XnView 1.98.2 (x32 Version: 1.98.2 - Gougelet Pierre-e)
Youda Survivor 2 (x32 Version:  - )
Zoo Safari (x32 Version:  - rondomedia Marketing & Vertriebs GmbH)

==================== Restore Points  =========================

11-01-2014 09:26:45 Windows Update
12-01-2014 18:00:11 Windows-Sicherung
14-01-2014 12:52:23 Windows Update
16-01-2014 02:00:17 Windows Update
19-01-2014 18:00:24 Windows-Sicherung
21-01-2014 12:07:18 Windows Update
26-01-2014 20:38:36 Windows-Sicherung
28-01-2014 13:23:58 Windows Update
29-01-2014 22:42:41 Windows Update
02-02-2014 18:00:23 Windows-Sicherung
04-02-2014 13:18:37 Windows Update
09-02-2014 18:00:22 Windows-Sicherung
10-02-2014 10:54:55 Windows Defender Checkpoint
11-02-2014 10:32:30 Windows Update
12-02-2014 14:04:37 Windows Update
16-02-2014 18:00:23 Windows-Sicherung
17-02-2014 15:26:33 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {19DD2CEA-55C6-45D2-B2D4-C4DD58CA4859} - System32\Tasks\Plus-HD-1.2-firefoxinstaller => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-firefoxinstaller.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {27FC4FDA-AC05-4B5F-A53A-7935CDFCA1E6} - System32\Tasks\Plus-HD-1.2-chromeinstaller => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-chromeinstaller.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {30EC7B48-AC3D-48B5-B358-6DC6F61ED044} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-29] (ASUSTeK Computer Inc.)
Task: {3414EC92-737B-4004-B4F7-F0E552C57C5C} - System32\Tasks\Re-markit Update => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe [2013-12-25] () <==== ATTENTION
Task: {4870C426-3459-4919-8E9F-64E5F6AB3A5A} - System32\Tasks\Plus-HD-1.2-codedownloader => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-codedownloader.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {5708778C-52CE-4C37-BEB2-94ECD98A43E7} - System32\Tasks\ASUS\AsBackupWizard_Run => C:\Program Files (x86)\ASUS\\AsBackupWizard\\AsRunBkWizardHelper.exe [2010-04-24] (ASUSTeK Computer Inc.)
Task: {711B9B3B-9B9D-45C7-BFFC-1C92DA0BD24B} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2009-11-18] (ASUSTeK Computer Inc.)
Task: {9097B978-769E-4C2A-9177-A845FD8DB109} - System32\Tasks\Plus-HD-1.2-enabler => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-enabler.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {95523D8D-D7C5-40E1-9880-A0C54C2F66E1} - System32\Tasks\Plus-HD-1.2-updater => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-updater.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {9607C6B8-D460-4953-80C0-FB233368DCAD} - System32\Tasks\AmiUpdXp => C:\Users\Hannelore\AppData\Local\SwvUpdater\Updater.exe [2013-12-29] (Amonetizé Ltd) <==== ATTENTION
Task: {C1F8DED2-34B2-484A-9B07-25E1A4803CE2} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.02\AsLoader.exe [2009-12-28] (ASUSTeK Computer Inc.)
Task: {D51A0DB4-0538-426A-90B2-E9406A6D84C0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\Hannelore\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-codedownloader.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-enabler.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-updater.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\Re-markit Update.job => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-10-18 19:30 - 2010-04-05 20:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2013-12-06 02:30 - 2013-12-06 02:30 - 00040448 _____ () C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
2011-01-26 18:00 - 2011-01-26 18:00 - 00079872 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll
2011-10-18 17:19 - 2009-08-11 12:57 - 00303104 _____ () C:\Program Files (x86)\MultiScreen\MultiScreen.exe
2011-05-27 05:16 - 2010-10-22 04:14 - 00078448 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 00386160 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 00105584 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 64643696 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2011-01-26 18:01 - 2011-01-26 18:01 - 00102912 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-01-26 17:48 - 2011-01-26 17:48 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-02-15 09:56 - 2011-02-15 09:56 - 00430080 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-02-15 09:35 - 2011-02-15 09:35 - 00032768 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResources.dll
2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe
2011-05-27 05:17 - 2009-01-15 23:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2011-05-27 05:17 - 2009-03-26 01:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2011-10-18 17:19 - 2009-08-11 12:54 - 00094208 _____ () C:\Program Files (x86)\MultiScreen\TitleBar.dll
2011-10-18 17:19 - 2009-08-11 12:54 - 00053248 _____ () C:\Program Files (x86)\MultiScreen\SmartMouseDll.dll
2011-10-18 17:19 - 2009-08-11 12:56 - 00057344 _____ () C:\Program Files (x86)\MultiScreen\MGResGer.dll
2013-03-01 20:21 - 2013-03-01 20:16 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-12-25 11:48 - 2013-12-25 11:48 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-01-11 10:23 - 2014-01-11 10:23 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:7D288858
AlternateDataStreams: C:\ProgramData\TEMP:DD95E6D9

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/20/2014 11:22:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/19/2014 01:11:34 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2014 10:16:40 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2014 10:16:37 AM) (Source: Application Error) (User: )
Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:
Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten
Speichertreibern, oder der Datenträger fehlt.
Das Programm Updater service wurde wegen dieses Fehlers geschlossen.

Programm: Updater service
Datei: 

Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1. Öffnen Sie die Datei erneut.
Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.
2.
Wenn Sie weiterhin nicht auf die Datei zugreifen können und
	- diese sich im Netzwerk befindet, 
dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.
	- diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.
3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.
5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt. 
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.

Zusätzliche Daten
Fehlerwert: 00000000
Datenträgertyp: 0

Error: (02/18/2014 10:16:37 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 1.0.0.1, Zeitstempel: 0x52b219b0
Name des fehlerhaften Moduls: ole32.DLL, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000096
Fehleroffset: 0x00048665
ID des fehlerhaften Prozesses: 0xb8c
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3

Error: (02/17/2014 07:36:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/17/2014 01:39:23 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2014 07:02:23 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Auf diesem Laufwerk ist nicht genügend Speicherplatz zum Speichern der Sicherung verfügbar. Löschen Sie ältere Sicherungen und nicht benötigte Daten, um Speicherplatz freizugeben, oder ändern Sie die Sicherungseinstellungen. (0x81000005)"

Error: (02/16/2014 05:30:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2014 01:28:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (02/19/2014 11:42:53 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (02/19/2014 07:56:47 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.

Error: (02/16/2014 01:27:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Updater" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/16/2014 01:27:21 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Updater erreicht.

Error: (02/15/2014 10:57:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Updater" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/15/2014 10:57:29 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Updater erreicht.

Error: (02/10/2014 01:18:04 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}


Microsoft Office Sessions:
=========================
Error: (02/20/2014 11:22:03 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/19/2014 01:11:34 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2014 10:16:40 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2014 10:16:37 AM) (Source: Application Error)(User: )
Description: Updater service000000000

Error: (02/18/2014 10:16:37 AM) (Source: Application Error)(User: )
Description: updater.exe1.0.0.152b219b0ole32.DLL6.1.7601.175144ce7b96fc000009600048665b8c01cf2c89ebfd4931C:\ProgramData\Updater\updater.exeC:\Windows\syswow64\ole32.DLL5da8406b-987d-11e3-9e04-14dae996d9a0

Error: (02/17/2014 07:36:02 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/17/2014 01:39:23 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2014 07:02:23 PM) (Source: Windows Backup)(User: )
Description: Auf diesem Laufwerk ist nicht genügend Speicherplatz zum Speichern der Sicherung verfügbar. Löschen Sie ältere Sicherungen und nicht benötigte Daten, um Speicherplatz freizugeben, oder ändern Sie die Sicherungseinstellungen. (0x81000005)

Error: (02/16/2014 05:30:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2014 01:28:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 6143.18 MB
Available physical RAM: 3899.86 MB
Total Pagefile: 12284.53 MB
Available Pagefile: 9523.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (WIN7) (Fixed) (Total:372.6 GB) (Free:183.75 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Externe Festplatte_Dasi) (Fixed) (Total:465.76 GB) (Free:0 GB) NTFS
Drive e: (DATA) (Fixed) (Total:544.72 GB) (Free:532.44 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: CB5BD2B2)
Partition 1: (Not Active) - (Size=14 GB) - (Type=1B)
Partition 2: (Active) - (Size=373 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=545 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0D29753D)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2014
Ran by Hannelore (administrator) on HANNELORE-PC on 20-02-2014 11:56:49
Running from C:\Users\Hannelore\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(ASUSTeK Computer Inc.) C:\Windows\SysWOW64\AsHookDevice.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
() C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files (x86)\MultiScreen\MultiScreen.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
(Updater) C:\ProgramData\Updater\updater.exe
(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(WatchDog) C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe
(WatchDog) C:\ProgramData\RHelpers\FireFoxHelper\FireFoxHelper.exe
(WatchDog) C:\ProgramData\RHelpers\IEHelper\IeHelper.exe
(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Users\Hannelore\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-10-22] (VIA)
HKLM-x32\...\Run: [RunAIShell] - C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe [232064 2009-12-23] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Updater] - C:\ProgramData\Updater\Updater.exe [486264 2013-12-18] (Updater)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [MultiScreen] - C:\Program Files (x86)\MultiScreen\MultiScreen.exe [303104 2009-08-11] ()
HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG)
HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [EA Core] - "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [Updater] - C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater)
HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll (Plus HD)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho.dll (Plus HD)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: flash-Enhancer - {5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - C:\Program Files (x86)\AmiExt\flashEnhancer\ie\AmiBho.dll ()
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Re-markit - {d5de32ce-bd33-4a3e-8bd2-67fcf9b1377f} - C:\Program Files (x86)\Re-markit\150.dll ()
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default
FF user.js: detected! => C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\user.js
FF Homepage: hxxp://www.zdfsport.de/ZDFsport-Startseite-4002.html
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Widget context - C:\Users\Hannelore\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-18]
FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff
FF Extension: No Name - C:\Program Files (x86)\AmiExt\flashEnhancer\ff [2013-12-29]
FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta61.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff
FF Extension: Video Player - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff [2014-01-13]
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha966.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff
FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff [2014-01-29]
FF HKCU\...\Firefox\Extensions: [{11307539-f37a-4068-81b0-5e786aad6f00}] - C:\Program Files (x86)\Re-markit\150.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.nationzoom.com/?type=sc&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9

Chrome: 
=======
CHR Extension: (No Name) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\idpcbdkoekecjkbjeccbapdkpcmoiloa [2014-01-18]
CHR Extension: (Widget context) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-18]
CHR HKLM-x32\...\Chrome\Extension: [dcpfhaghaadpjpgocojgnlhjcieeooel] - C:\Program Files (x86)\Re-markit\150.crx [2014-01-18]
CHR HKLM-x32\...\Chrome\Extension: [ehmnjgkmbpbohelngpclcdhgochdeoej] - C:\Program Files (x86)\AmiExt\flashEnhancer\ch\flashEnhancer.crx [2014-01-18]
CHR HKLM-x32\...\Chrome\Extension: [hjbmanngghbhohodnkbgkgmkajiheieg] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ch\VideoPlayerV3beta61.crx [2014-01-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-01-26] (Advanced Micro Devices, Inc.)
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [40448 2013-12-06] ()
R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2013-12-25] (Cherished Technololgy LIMITED)

==================== Drivers (Whitelisted) ====================

R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-20 11:56 - 2014-02-20 11:57 - 00017213 _____ () C:\Users\Hannelore\Desktop\FRST.txt
2014-02-20 11:56 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST
2014-02-20 11:55 - 2014-02-20 11:55 - 02153472 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe
2014-02-20 11:54 - 2014-02-20 11:54 - 00000480 _____ () C:\Users\Hannelore\Desktop\defogger_disable.log
2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable
2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe
2014-02-12 18:44 - 2014-02-12 18:44 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{D131D82E-02BA-45D5-AF9D-AA7786D30218}
2014-02-12 18:43 - 2014-02-12 18:43 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{B5D985A5-983E-49EB-A9B4-09526F979BD6}
2014-02-12 15:05 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 15:05 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 15:05 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 15:05 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 15:05 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 15:05 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 15:05 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 15:05 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 15:05 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 15:05 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 15:05 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 15:05 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 15:05 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 15:05 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 15:05 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 15:05 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 15:05 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 15:05 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 15:05 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 15:05 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 15:05 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 15:05 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 15:05 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 15:05 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 15:05 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 15:05 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 15:05 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 15:05 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 15:05 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 15:05 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 15:05 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 15:05 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 15:05 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 15:05 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 15:05 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 15:05 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 15:05 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 15:05 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 15:04 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 15:04 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 15:04 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 14:58 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 14:58 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 14:58 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 14:58 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 14:58 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 14:58 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 14:58 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 14:58 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 14:58 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 14:58 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 14:58 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 14:58 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 14:58 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 14:58 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 14:58 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 14:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 14:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 14:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 14:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 14:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 14:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 14:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 14:58 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 14:58 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-01-29 23:28 - 2014-01-29 23:28 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerV1

==================== One Month Modified Files and Folders =======

2014-02-20 11:57 - 2014-02-20 11:56 - 00017213 _____ () C:\Users\Hannelore\Desktop\FRST.txt
2014-02-20 11:56 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST
2014-02-20 11:55 - 2014-02-20 11:55 - 02153472 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe
2014-02-20 11:54 - 2014-02-20 11:54 - 00000480 _____ () C:\Users\Hannelore\Desktop\defogger_disable.log
2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable
2014-02-20 11:54 - 2011-10-18 11:50 - 00000000 ____D () C:\Users\Hannelore
2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe
2014-02-20 11:49 - 2012-03-01 08:35 - 00000000 ____D () C:\Users\Hannelore\Desktop\Laptop  Dateien\Documents\Anja Jöns,Kalender, Postkarten
2014-02-20 11:28 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-20 11:28 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-20 11:24 - 2011-10-18 11:49 - 01374822 _____ () C:\Windows\WindowsUpdate.log
2014-02-20 11:20 - 2013-12-29 13:05 - 00000372 _____ () C:\Windows\Tasks\AmiUpdXp.job
2014-02-20 11:20 - 2013-12-25 13:24 - 00002112 _____ () C:\Windows\Tasks\Plus-HD-1.2-firefoxinstaller.job
2014-02-20 11:20 - 2013-12-25 13:24 - 00001984 _____ () C:\Windows\Tasks\Plus-HD-1.2-chromeinstaller.job
2014-02-20 11:20 - 2013-12-25 13:24 - 00001336 _____ () C:\Windows\Tasks\Plus-HD-1.2-updater.job
2014-02-20 11:20 - 2013-12-25 13:24 - 00001238 _____ () C:\Windows\Tasks\Plus-HD-1.2-codedownloader.job
2014-02-20 11:20 - 2013-12-25 13:24 - 00001138 _____ () C:\Windows\Tasks\Plus-HD-1.2-enabler.job
2014-02-20 11:20 - 2013-12-25 13:23 - 00000392 _____ () C:\Windows\Tasks\Re-markit Update.job
2014-02-20 11:20 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-20 11:20 - 2009-07-14 05:51 - 00101255 _____ () C:\Windows\setupact.log
2014-02-18 22:16 - 2013-12-29 13:06 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\newnext.me
2014-02-17 16:28 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 16:26 - 2012-01-29 11:32 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 18:44 - 2014-02-12 18:44 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{D131D82E-02BA-45D5-AF9D-AA7786D30218}
2014-02-12 18:43 - 2014-02-12 18:43 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{B5D985A5-983E-49EB-A9B4-09526F979BD6}
2014-02-12 18:39 - 2010-11-21 04:47 - 00557246 _____ () C:\Windows\PFRO.log
2014-02-12 15:15 - 2011-11-04 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-12 15:14 - 2011-03-15 22:23 - 00665562 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 15:14 - 2011-03-15 22:23 - 00133774 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 15:14 - 2009-07-14 06:13 - 01550558 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-06 13:16 - 2014-02-12 15:05 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 15:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 15:05 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 15:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 15:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 15:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 15:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 15:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 15:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 15:05 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 15:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 15:04 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 15:05 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 15:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 15:04 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 15:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 15:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 15:05 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 15:05 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 15:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 15:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 15:05 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 15:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 15:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 15:05 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 15:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:25 - 2014-02-12 15:04 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:24 - 2014-02-12 15:05 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 15:05 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 15:05 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 15:05 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 15:05 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 15:05 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 15:05 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 15:05 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 15:05 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 15:05 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-04 19:32 - 2011-10-18 19:30 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-01-29 23:28 - 2014-01-29 23:28 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerV1
2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-01-26 12:55 - 2012-07-28 13:02 - 00000000 ____D () C:\ProgramData\AlawarWrapper
2014-01-22 15:38 - 2013-11-17 17:05 - 00000000 ____D () C:\ProgramData\Origin

Some content of TEMP:
====================
C:\Users\Hannelore\AppData\Local\Temp\AlawarGameBoxWebSetup.exe
C:\Users\Hannelore\AppData\Local\Temp\avgnt.exe
C:\Users\Hannelore\AppData\Local\Temp\BackupSetup.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD20D8.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD499C.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD581D.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6576.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD693D.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6B7E.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6BEB.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6CD5.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6CD6.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6ED8.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6F45.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD6F74.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7010.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7011.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7020.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD704E.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD708D.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7119.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7399.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7416.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD751F.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD75EA.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD75F9.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7647.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD76D4.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7722.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD77CD.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7992.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7A6C.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7A7C.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7ABA.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7AE9.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7C8E.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7C8F.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7F2D.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD7F9A.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8027.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8757.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD87D4.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD88FD.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD894B.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8B1F.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8C47.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8C66.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8C67.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD8FD0.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD93C6.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD93E5.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD9433.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD94B0.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD972F.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD9858.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD9A0D.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD9DA5.exe
C:\Users\Hannelore\AppData\Local\Temp\EAD9DF3.exe
C:\Users\Hannelore\AppData\Local\Temp\EADA14D.exe
C:\Users\Hannelore\AppData\Local\Temp\EADA237.exe
C:\Users\Hannelore\AppData\Local\Temp\EADA3FB.exe
C:\Users\Hannelore\AppData\Local\Temp\EADA41B.exe
C:\Users\Hannelore\AppData\Local\Temp\EADA765.exe
C:\Users\Hannelore\AppData\Local\Temp\EADA811.exe
C:\Users\Hannelore\AppData\Local\Temp\EADAABF.exe
C:\Users\Hannelore\AppData\Local\Temp\EADABF7.exe
C:\Users\Hannelore\AppData\Local\Temp\EADAC26.exe
C:\Users\Hannelore\AppData\Local\Temp\EADAF8F.exe
C:\Users\Hannelore\AppData\Local\Temp\EADB9AD.exe
C:\Users\Hannelore\AppData\Local\Temp\EADBE5E.exe
C:\Users\Hannelore\AppData\Local\Temp\EADC10.exe
C:\Users\Hannelore\AppData\Local\Temp\EADC5DD.exe
C:\Users\Hannelore\AppData\Local\Temp\EADC65A.exe
C:\Users\Hannelore\AppData\Local\Temp\EADCC72.exe
C:\Users\Hannelore\AppData\Local\Temp\EADD835.exe
C:\Users\Hannelore\AppData\Local\Temp\EADE63E.exe
C:\Users\Hannelore\AppData\Local\Temp\EBU24ED.exe
C:\Users\Hannelore\AppData\Local\Temp\EBU29CD.DLL
C:\Users\Hannelore\AppData\Local\Temp\EBU703.exe
C:\Users\Hannelore\AppData\Local\Temp\EBUB55.exe
C:\Users\Hannelore\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit.exe
C:\Users\Hannelore\AppData\Local\Temp\InstallVBRuntime.exe
C:\Users\Hannelore\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Hannelore\AppData\Local\Temp\Setup1.exe
C:\Users\Hannelore\AppData\Local\Temp\setup{A75B97A1-72B4-4D6F-87CC-0B1CFBFD2861}.exe
C:\Users\Hannelore\AppData\Local\Temp\UninstallEADM.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-20 11:10

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-20 12:45:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31000524AS rev.JC45 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\HANNEL~1\AppData\Local\Temp\uwldiuob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                  fffff80002dec000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594                                                                                                                  fffff80002dec042 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\ProgramData\WPM\wprotectmanager.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                0000000076811465 2 bytes [81, 76]
.text     C:\ProgramData\WPM\wprotectmanager.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                               00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2
.text     C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                       0000000076811465 2 bytes [81, 76]
.text     C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                      00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2
.text     C:\ProgramData\InternetUpdater\InternetUpdaterService.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                             0000000076811465 2 bytes [81, 76]
.text     C:\ProgramData\InternetUpdater\InternetUpdaterService.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                            00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2
.text     C:\Program Files (x86)\MultiScreen\MultiScreen.exe[2940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                    0000000076811465 2 bytes [81, 76]
.text     C:\Program Files (x86)\MultiScreen\MultiScreen.exe[2940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                   00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2
.text     C:\ProgramData\Updater\updater.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                    0000000076811465 2 bytes [81, 76]
.text     C:\ProgramData\Updater\updater.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                   00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2
.text     C:\Windows\SysWOW64\rundll32.exe[2224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                      0000000076811465 2 bytes [81, 76]
.text     C:\Windows\SysWOW64\rundll32.exe[2224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                     00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                        0000000076811465 2 bytes [81, 76]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                       00000000768114bb 2 bytes [81, 76]
.text     ...                                                                                                                                                                                 * 2

---- Threads - GMER 2.1 ----

Thread    C:\Windows\System32\svchost.exe [3592:5148]                                                                                                                                         000007feea9d9688
---- Processes - GMER 2.1 ----

Process   C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (*** suspicious ***) @ C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [1736](2013-12-06 01:30:04)              00000000002a0000
Library   C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.dll (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [2224] (NewNext Helper Engine/NewNextDotMe)(2013-12-29 12:06:34)  000000006c960000

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                                                               unknown MBR code

---- EOF - GMER 2.1 ----

Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung

Log-Analyse und Auswertung: Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung

Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung

Ähnliche Themen: Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung