Hallo,

ich bin heute auf eine Website geraten auf der auf einmal die Meldung kam das mein Browser nun gesperrt sein und ich zahlen müsste um dies zu beheben.
Allerdings funktioniert bei mir noch alles, der Browser geht, der Rechner startet normal, nun die Frage, bin ich infiziert? Wie kann ich es prüfen.

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Henriette (administrator) on RECHNNER on 01-04-2014 12:45:47
Running from C:\Users\Henriette\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Akamai Technologies, Inc.) C:\Users\Henriette\AppData\Local\Akamai\netsession_win.exe
() C:\Users\Henriette\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Dropbox, Inc.) C:\Users\Henriette\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Logitech, Inc.) C:\Program Files\Logitech\SetPointG\SetPointII.exe
(Akamai Technologies, Inc.) C:\Users\Henriette\AppData\Local\Akamai\netsession_win.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4971024 2014-03-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\Run: [EPSON S21 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFAE.EXE [223232 2008-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-03-06] (Google Inc.)
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\Run: [Akamai NetSession Interface] - C:\Users\Henriette\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Henriette\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\MountPoints2: {0fe6e9b9-4398-11e3-9ffa-bc5ff41c0df0} - F:\Setup.exe
Startup: C:\Users\Henriette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Henriette\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

ProxyServer: http=190.108.83.30:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://badoo.com/startpage/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA5F64EDCB6F0CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {8A244612-A1F7-11E0-95C0-E71F4824019B} URL = hxxp://badoo.com/startpage/?source=bsb&q={searchTerms}
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default
FF user.js: detected! => C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\user.js
FF SelectedSearchEngine: Google
FF Homepage: hxxp://badoo.com/startpage/
FF Keyword.URL: hxxp://badoo.com/startpage/?source=bsb&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.132.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @real.com/nppl3260;version=15.0.2.72 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.2.72 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.2.72 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.2.72 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=15.0.2.72 - c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Henriette\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\badoo.xml
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-23]
FF Extension: DownloadHelper - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-09-05]
FF Extension: ICQ Sparberater - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\ciuvo-extension@icq.de.xpi [2012-10-13]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2013-06-25]
FF Extension: BrowseSmart - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\firefox@browsesmart.net.xpi [2013-12-06]
FF Extension: Grooveshark Unlocker - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\groovesharkUnlocker@overlord1337.xpi [2012-03-12]
FF Extension: {717466b3-8c66-497c-9383-3da3722ff434} - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{717466b3-8c66-497c-9383-3da3722ff434}.xpi [2013-11-14]
FF Extension: Easy YouTube Video Downloader - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2012-12-22]
FF Extension: Web Install Plugin Pro - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{c69e0078-851d-4be4-b708-cf6edacf30c7}.xpi [2013-11-27]
FF Extension: Adblock Plus - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-07]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-02-26]

Chrome: 
=======
CHR HomePage: hxxp://msn.de/
CHR Extension: (Google Drive) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-22]
CHR Extension: (Paintbrush) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\benliocpgpijioclmdjjjjgmimgeodad [2012-09-08]
CHR Extension: (YouTube) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-22]
CHR Extension: (Google-Suche) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-22]
CHR Extension: (Sumo Paint) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod [2012-09-08]
CHR Extension: (PicMonkey) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgdgokchhicmaiacmgegjnppjkgogdhm [2013-08-13]
CHR Extension: (Pixlr Express) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmjpdlmjopaeginhldhiokeidchjid [2013-08-13]
CHR Extension: (Google Maps) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2013-08-13]
CHR Extension: (Google Wallet) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Psykopaint) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil [2012-09-08]
CHR Extension: (Google Mail) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-22]
CHR HKLM-x32\...\Chrome\Extension: [ippenodjaoidmkkfdlmdhofiebnpjddb] - C:\Program Files (x86)\BrowseSmart\ippenodjaoidmkkfdlmdhofiebnpjddb.crx [2013-12-06]
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [2012-10-14]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-02-26]

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3782672 2014-02-23] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-03] ()

==================== Drivers (Whitelisted) ====================

S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-11-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 XENfiltv; C:\Windows\System32\drivers\XENfiltv.sys [25600 2009-07-31] (Creative Technology Ltd.)
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-01 12:44 - 2014-04-01 12:44 - 00035396 _____ () C:\Users\Henriette\Downloads\Addition.txt
2014-04-01 12:43 - 2014-04-01 12:45 - 00022004 _____ () C:\Users\Henriette\Downloads\FRST.txt
2014-04-01 12:43 - 2014-04-01 12:45 - 00000000 ____D () C:\FRST
2014-04-01 12:42 - 2014-04-01 12:42 - 02157056 _____ (Farbar) C:\Users\Henriette\Downloads\FRST64.exe
2014-04-01 11:36 - 2014-04-01 11:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Malwarebytes
2014-04-01 11:30 - 2014-04-01 11:30 - 00000000 ____D () C:\Users\Henriette\Desktop\Neuer Ordner (3)
2014-04-01 11:28 - 2014-04-01 11:31 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-01 11:28 - 2014-04-01 11:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-01 11:28 - 2014-04-01 11:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-01 11:28 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 11:26 - 2014-04-01 11:30 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-01 11:25 - 2014-04-01 11:29 - 15063548 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0 (1).zip
2014-04-01 11:25 - 2014-04-01 11:25 - 04793000 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0.zip
2014-03-23 17:17 - 2014-03-23 17:17 - 00002520 _____ () C:\Users\Henriette\Downloads\n9yh88v1nm07x65-ul.to.dlc
2014-03-23 13:09 - 2014-03-23 13:09 - 00017156 _____ () C:\Users\Henriette\Downloads\x0p045x7o5o0092.dlc
2014-03-22 23:25 - 2014-03-22 23:33 - 00000000 ____D () C:\Users\Henriette\Desktop\Conan.The.Barbarian.2011.German.DTS-HD.DL.1080p.BluRay.AVC.Remux-HDS
2014-03-22 20:02 - 2014-03-22 20:03 - 11979132 _____ () C:\Users\Henriette\Downloads\SETUP_0.118.zip
2014-03-22 19:12 - 2014-03-22 19:12 - 00007748 _____ () C:\Users\Henriette\Downloads\f2731ss34s9376b.dlc
2014-03-22 00:42 - 2014-03-22 16:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-21 14:36 - 2014-03-21 14:36 - 00014704 _____ () C:\Users\Henriette\Downloads\334i788e655q8a9.dlc
2014-03-21 12:18 - 2014-03-21 12:18 - 00007472 _____ () C:\Users\Henriette\Downloads\20099dob6i9cmzc.dlc
2014-03-20 23:24 - 2014-03-20 23:24 - 00011716 _____ () C:\Users\Henriette\Downloads\5l8284lxk81x2sd.dlc
2014-03-20 23:20 - 2014-03-20 23:20 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk (1).dlc
2014-03-20 23:16 - 2014-03-20 23:16 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk.dlc
2014-03-19 22:36 - 2014-03-19 22:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-03-19 22:35 - 2014-03-22 20:09 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Raptr
2014-03-19 22:35 - 2014-03-22 20:09 - 00000000 ____D () C:\Program Files (x86)\Raptr
2014-03-19 22:35 - 2014-03-19 22:35 - 01007930 _____ () C:\Users\Henriette\Downloads\amddriverdownload_installer.exe
2014-03-19 22:35 - 2014-03-19 22:35 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\library_dir
2014-03-19 18:46 - 2014-03-19 18:47 - 00275176 _____ () C:\Windows\Minidump\031914-57907-01.dmp
2014-03-18 18:44 - 2014-03-18 18:44 - 00275176 _____ () C:\Windows\Minidump\031814-56815-01.dmp
2014-03-18 18:41 - 2014-03-18 18:41 - 00275176 _____ () C:\Windows\Minidump\031814-89014-01.dmp
2014-03-18 18:40 - 2014-03-19 18:46 - 662258539 _____ () C:\Windows\MEMORY.DMP
2014-03-16 23:23 - 2014-03-16 23:23 - 00282775 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.crx
2014-03-16 23:18 - 2014-03-16 23:18 - 00139952 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-050.crx
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.zip
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055 (1).zip
2014-03-13 18:03 - 2014-03-13 18:03 - 00000000 ____D () C:\Users\Henriette\Documents\Respawn
2014-03-13 18:02 - 2014-03-13 18:02 - 00002328 _____ () C:\Users\Henriette\Downloads\9q9v7hc91246aa0-ul.to.dlc
2014-03-13 17:47 - 2014-03-13 18:01 - 00001184 _____ () C:\Users\Public\Desktop\Titanfall.lnk
2014-03-13 13:17 - 2014-03-13 13:17 - 00001476 _____ () C:\Users\Henriette\Downloads\47_Ronin_2013_German_TS_LD_XviD_-_TOD-de8be1nprhcm.dlc
2014-03-13 13:13 - 2014-03-13 13:13 - 00001988 _____ () C:\Users\Henriette\Downloads\45u5267fl9862h4.dlc
2014-03-13 13:09 - 2014-03-13 13:09 - 00001840 _____ () C:\Users\Henriette\Downloads\u2n25w5evc34scw.dlc
2014-03-13 07:55 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 07:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 07:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 07:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 07:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 07:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 07:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 07:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 07:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 07:55 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 07:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 07:55 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 07:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 07:55 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 07:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 07:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 07:55 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 07:55 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 07:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 07:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 07:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 07:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 07:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 07:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 07:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 07:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 07:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 07:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 07:55 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 07:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 07:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 07:55 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 07:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 07:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 07:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 07:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 07:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 07:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 07:55 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 07:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 07:55 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 07:55 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 07:55 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 07:55 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 07:54 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 07:54 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 07:54 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 07:54 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-04 15:50 - 2014-03-05 16:46 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\QuickScan

==================== One Month Modified Files and Folders =======

2014-04-01 12:45 - 2014-04-01 12:43 - 00022004 _____ () C:\Users\Henriette\Downloads\FRST.txt
2014-04-01 12:45 - 2014-04-01 12:43 - 00000000 ____D () C:\FRST
2014-04-01 12:44 - 2014-04-01 12:44 - 00035396 _____ () C:\Users\Henriette\Downloads\Addition.txt
2014-04-01 12:44 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-01 12:44 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-01 12:44 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-01 12:43 - 2012-02-17 18:46 - 01134686 _____ () C:\Windows\WindowsUpdate.log
2014-04-01 12:42 - 2014-04-01 12:42 - 02157056 _____ (Farbar) C:\Users\Henriette\Downloads\FRST64.exe
2014-04-01 12:39 - 2013-04-26 19:18 - 00000000 ___RD () C:\Users\Henriette\Dropbox
2014-04-01 12:39 - 2013-04-26 19:13 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Dropbox
2014-04-01 12:38 - 2013-04-08 17:06 - 00228136 _____ () C:\Windows\PFRO.log
2014-04-01 12:38 - 2013-04-08 17:06 - 00052228 _____ () C:\Windows\setupact.log
2014-04-01 12:38 - 2012-03-06 15:16 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-01 12:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-01 12:37 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-01 12:37 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-01 11:59 - 2012-03-31 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-01 11:54 - 2012-03-06 15:16 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-01 11:49 - 2013-12-26 12:39 - 00000000 ____D () C:\Program Files (x86)\BrowseSmart
2014-04-01 11:48 - 2012-02-17 11:48 - 00000000 ____D () C:\Users\Henriette
2014-04-01 11:36 - 2014-04-01 11:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Malwarebytes
2014-04-01 11:31 - 2014-04-01 11:28 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-01 11:31 - 2014-04-01 11:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-01 11:30 - 2014-04-01 11:30 - 00000000 ____D () C:\Users\Henriette\Desktop\Neuer Ordner (3)
2014-04-01 11:30 - 2014-04-01 11:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-01 11:29 - 2014-04-01 11:25 - 15063548 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0 (1).zip
2014-04-01 11:28 - 2014-04-01 11:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-01 11:25 - 2014-04-01 11:25 - 04793000 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0.zip
2014-04-01 09:52 - 2012-10-18 09:05 - 00000000 ____D () C:\ProgramData\MFAData
2014-03-31 23:21 - 2013-12-05 00:48 - 00000000 ____D () C:\Users\Henriette\AppData\Local\Battle.net
2014-03-31 15:44 - 2013-09-27 22:08 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-03-27 22:43 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-27 08:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-25 16:14 - 2012-02-21 18:53 - 00000000 ____D () C:\ProgramData\Origin
2014-03-25 09:00 - 2012-03-26 21:51 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-03-23 18:11 - 2012-02-21 22:04 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\vlc
2014-03-23 17:17 - 2014-03-23 17:17 - 00002520 _____ () C:\Users\Henriette\Downloads\n9yh88v1nm07x65-ul.to.dlc
2014-03-23 13:09 - 2014-03-23 13:09 - 00017156 _____ () C:\Users\Henriette\Downloads\x0p045x7o5o0092.dlc
2014-03-23 09:53 - 2012-10-14 19:28 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-03-22 23:33 - 2014-03-22 23:25 - 00000000 ____D () C:\Users\Henriette\Desktop\Conan.The.Barbarian.2011.German.DTS-HD.DL.1080p.BluRay.AVC.Remux-HDS
2014-03-22 23:24 - 2013-12-11 20:22 - 00000000 ____D () C:\Users\Henriette\AppData\Local\QuickPar
2014-03-22 20:26 - 2012-06-12 13:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-22 20:26 - 2012-02-21 19:46 - 00000000 ____D () C:\Program Files (x86)\Pando Networks
2014-03-22 20:20 - 2014-01-26 18:59 - 00000000 ____D () C:\Program Files (x86)\DVDx 4.0 Open Edition
2014-03-22 20:16 - 2012-02-17 14:06 - 00000000 ____D () C:\Program Files (x86)\Futuremark
2014-03-22 20:15 - 2012-03-28 16:44 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-03-22 20:09 - 2014-03-19 22:35 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Raptr
2014-03-22 20:09 - 2014-03-19 22:35 - 00000000 ____D () C:\Program Files (x86)\Raptr
2014-03-22 20:09 - 2012-03-09 20:42 - 00000000 ____D () C:\Program Files (x86)\RapidSolution
2014-03-22 20:03 - 2014-03-22 20:02 - 11979132 _____ () C:\Users\Henriette\Downloads\SETUP_0.118.zip
2014-03-22 20:03 - 2013-12-09 22:11 - 00000000 ____D () C:\ProgramData\Freemake
2014-03-22 20:03 - 2013-12-09 22:11 - 00000000 ____D () C:\Program Files (x86)\Freemake
2014-03-22 20:01 - 2012-04-10 09:03 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\DVDVideoSoft
2014-03-22 19:58 - 2012-02-21 18:56 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-22 19:12 - 2014-03-22 19:12 - 00007748 _____ () C:\Users\Henriette\Downloads\f2731ss34s9376b.dlc
2014-03-22 16:44 - 2014-03-22 00:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-21 21:02 - 2014-02-06 23:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-03-21 14:36 - 2014-03-21 14:36 - 00014704 _____ () C:\Users\Henriette\Downloads\334i788e655q8a9.dlc
2014-03-21 12:18 - 2014-03-21 12:18 - 00007472 _____ () C:\Users\Henriette\Downloads\20099dob6i9cmzc.dlc
2014-03-20 23:24 - 2014-03-20 23:24 - 00011716 _____ () C:\Users\Henriette\Downloads\5l8284lxk81x2sd.dlc
2014-03-20 23:20 - 2014-03-20 23:20 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk (1).dlc
2014-03-20 23:16 - 2014-03-20 23:16 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk.dlc
2014-03-19 22:54 - 2013-08-14 13:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-19 22:51 - 2012-02-21 18:26 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-19 22:36 - 2014-03-19 22:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-03-19 22:35 - 2014-03-19 22:35 - 01007930 _____ () C:\Users\Henriette\Downloads\amddriverdownload_installer.exe
2014-03-19 22:35 - 2014-03-19 22:35 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\library_dir
2014-03-19 18:47 - 2014-03-19 18:46 - 00275176 _____ () C:\Windows\Minidump\031914-57907-01.dmp
2014-03-19 18:46 - 2014-03-18 18:40 - 662258539 _____ () C:\Windows\MEMORY.DMP
2014-03-19 18:46 - 2012-03-06 17:46 - 00000000 ____D () C:\Windows\Minidump
2014-03-19 18:44 - 2012-04-07 19:52 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\TS3Client
2014-03-19 18:44 - 2012-04-07 19:51 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-03-18 18:44 - 2014-03-18 18:44 - 00275176 _____ () C:\Windows\Minidump\031814-56815-01.dmp
2014-03-18 18:41 - 2014-03-18 18:41 - 00275176 _____ () C:\Windows\Minidump\031814-89014-01.dmp
2014-03-16 23:23 - 2014-03-16 23:23 - 00282775 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.crx
2014-03-16 23:18 - 2014-03-16 23:18 - 00139952 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-050.crx
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.zip
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055 (1).zip
2014-03-15 18:04 - 2014-02-22 22:00 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-14 09:37 - 2013-12-05 00:49 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-03-14 09:18 - 2009-07-14 06:45 - 00370136 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 00:48 - 2012-11-14 23:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-13 18:03 - 2014-03-13 18:03 - 00000000 ____D () C:\Users\Henriette\Documents\Respawn
2014-03-13 18:02 - 2014-03-13 18:02 - 00002328 _____ () C:\Users\Henriette\Downloads\9q9v7hc91246aa0-ul.to.dlc
2014-03-13 18:01 - 2014-03-13 17:47 - 00001184 _____ () C:\Users\Public\Desktop\Titanfall.lnk
2014-03-13 17:49 - 2013-05-01 09:57 - 00090779 _____ () C:\Windows\DirectX.log
2014-03-13 13:17 - 2014-03-13 13:17 - 00001476 _____ () C:\Users\Henriette\Downloads\47_Ronin_2013_German_TS_LD_XviD_-_TOD-de8be1nprhcm.dlc
2014-03-13 13:13 - 2014-03-13 13:13 - 00001988 _____ () C:\Users\Henriette\Downloads\45u5267fl9862h4.dlc
2014-03-13 13:09 - 2014-03-13 13:09 - 00001840 _____ () C:\Users\Henriette\Downloads\u2n25w5evc34scw.dlc
2014-03-12 19:59 - 2012-03-31 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 19:59 - 2012-03-31 21:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 19:59 - 2012-02-21 19:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 15:57 - 2012-05-22 22:12 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-03-05 16:46 - 2014-03-04 15:50 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\QuickScan
2014-03-05 00:02 - 2013-05-26 17:41 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-05 00:02 - 2012-05-28 22:28 - 00000000 ____D () C:\ProgramData\Skype

Some content of TEMP:
====================
C:\Users\Henriette\AppData\Local\Temp\13-12_win7_win8_64_dd_ccc_whql.exe
C:\Users\Henriette\AppData\Local\Temp\13-4_vista_win7_win8_64_dd_ccc_whql.exe
C:\Users\Henriette\AppData\Local\Temp\install_flashplayer12x32au_mssd_aaa_aih.exe
C:\Users\Henriette\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Henriette\AppData\Local\Temp\raptrpatch.exe
C:\Users\Henriette\AppData\Local\Temp\sonarinst.exe
C:\Users\Henriette\AppData\Local\Temp\swt-win32-3347.dll
C:\Users\Henriette\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-5200.exe
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-5408.exe
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-5980.exe
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-6008.exe
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-6148.exe
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-6356.exe
C:\Users\Henriette\AppData\Local\Temp\Uninstaller-6948.exe
C:\Users\Henriette\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\Henriette\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\Henriette\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Henriette\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-30 13:30

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Henriette at 2014-04-01 12:46:18
Running from C:\Users\Henriette\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Akamai NetSession Interface Service (HKLM-x32\...\Akamai) (Version:  - Akamai Technologies, Inc)
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Ashampoo Burning Studio 2012 v10.0.15 (HKLM-x32\...\Ashampoo Burning Studio 2012_is1) (Version: 10.0.15 - Ashampoo GmbH & Co. KG)
Audials (HKLM-x32\...\{8ABEEC21-B23C-4610-B57A-BE94345D4096}) (Version: 9.0.57913.1300 - RapidSolution Software AG)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4355 - AVG Technologies)
AVG 2014 (Version: 14.0.3722 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4355 - AVG Technologies) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.2.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB)
BurnInTest v6.0 Standard (HKLM\...\BurnInTest_is1) (Version: 6.0 - Passmark Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version:  - Microsoft)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
Druckerdeinstallation für EPSON S21 Series (HKLM\...\EPSON S21 Series) (Version:  - SEIKO EPSON Corporation)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.107 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.107 - Etron Technology) Hidden
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.0.0.0 - Futuremark Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.4.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
MSI Afterburner 2.1.0 (HKLM-x32\...\Afterburner) (Version: 2.1.0 - MSI Co., LTD)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
Origin (HKLM-x32\...\Origin) (Version: 8.5.0.4554 - Electronic Arts, Inc.)
PixiePack Codec Pack (HKLM-x32\...\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}) (Version: 1.1.1200.0 - None)
PlanetSide 2 Beta (HKCU\...\SOE-PlanetSide 2 Beta) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.47.714.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Source SDK Base 2007 (HKLM-x32\...\Steam App 218) (Version:  - Valve)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.0.3 - Electronic Arts)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E78E2B68-8FD1-42EE-BB74-99A4D9E6222D}) (Version:  - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WebM Media Foundation Components (HKLM-x32\...\webmmf) (Version: 1.0.1.0 - WebM Project)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Service-Center 2013 (HKLM\...\{7B324AC3-57C3-4701-B023-F54D78546BFA}_is1) (Version:  - IDG Tech Media GmbH)
WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)

==================== Restore Points  =========================

25-03-2014 08:35:33 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {26E3F6F0-95E0-4D04-A5BA-F471867888FA} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {30AD7817-1ACC-4B2E-854C-D3550A1B2595} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06] (Google Inc.)
Task: {5752584A-FB52-4041-B654-F1FFA94B794E} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2861206491-580732400-4040710124-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-01-30] (RealNetworks, Inc.)
Task: {592D19F5-B3C5-4B8A-A638-A8CBDB53BFFB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {6B943188-2018-4832-BE50-CD411B3B58B2} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {84937548-F3DE-426C-8C15-453C888DAEE3} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => c:\program files (x86)\real\realplayer\Update\realsched.exe [2012-02-26] (RealNetworks, Inc.)
Task: {930B5456-A42E-486F-99E9-87EB39DAD546} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06] (Google Inc.)
Task: {E2CF44EA-1D94-45B8-B2C9-293FC4106F7B} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2861206491-580732400-4040710124-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-01-30] (RealNetworks, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-02-21 20:03 - 2013-11-03 01:09 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-02-21 19:20 - 2012-01-09 20:44 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2013-05-22 20:50 - 2013-05-22 20:50 - 00400704 _____ () C:\Users\Henriette\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2013-12-06 17:06 - 2013-12-06 17:06 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Henriette\AppData\Roaming\Dropbox\bin\libcef.dll
2014-03-15 18:04 - 2014-03-15 02:50 - 00051016 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll
2014-03-15 18:04 - 2014-03-15 02:50 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll
2014-03-15 18:04 - 2014-03-15 02:50 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll
2014-03-15 18:04 - 2014-03-15 02:50 - 04061000 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll
2014-03-15 18:04 - 2014-03-15 02:50 - 00394568 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
2014-03-15 18:04 - 2014-03-15 02:50 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^Users^Henriette^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Badoo Desktop => C:\ProgramData\Badoo\Badoo Desktop\1.6.58.1220\Badoo.Desktop.exe
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/01/2014 00:42:50 PM) (Source: Application Hang) (User: )
Description: Programm mbam.exe, Version 1.75.0.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 13f8

Startzeit: 01cf4d96a2644ea7

Endzeit: 4

Anwendungspfad: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

Berichts-ID: 57a833df-b98a-11e3-a68b-bc5ff41c0df0

Error: (04/01/2014 00:39:48 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/01/2014 11:50:54 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/01/2014 09:32:35 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 03:36:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/30/2014 11:30:28 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2014 10:43:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2014 09:20:14 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/28/2014 10:27:00 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/28/2014 09:05:25 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (04/01/2014 00:39:18 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005

Error: (04/01/2014 00:38:44 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/01/2014 00:38:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/01/2014 11:49:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/01/2014 11:49:42 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/01/2014 09:31:45 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/01/2014 09:31:33 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (03/31/2014 03:35:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (03/31/2014 03:35:30 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (03/30/2014 11:29:25 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (04/01/2014 00:42:50 PM) (Source: Application Hang)(User: )
Description: mbam.exe1.75.0.113f801cf4d96a2644ea74C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe57a833df-b98a-11e3-a68b-bc5ff41c0df0

Error: (04/01/2014 00:39:48 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/01/2014 11:50:54 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/01/2014 09:32:35 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 03:36:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/30/2014 11:30:28 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2014 10:43:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2014 09:20:14 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/28/2014 10:27:00 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/28/2014 09:05:25 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 30%
Total physical RAM: 8169.41 MB
Available physical RAM: 5695.59 MB
Total Pagefile: 16336.99 MB
Available Pagefile: 13684.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:931.41 GB) (Free:156.51 GB) NTFS
Drive d: (Titanfall_3) (CDROM) (Total:1.8 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E24D24F9)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 14-03-24.01 - Henriette 02.04.2014  16:11:27.2.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8169.5956 [GMT 2:00]
ausgeführt von:: c:\users\Henriette\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REDUZIERTER FUNKTIONALITÄTSMODUS -
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
C:\install.exe
c:\program files (x86)\lol
c:\program files (x86)\lol\LeagueOfLegends\0x0407.ini
c:\program files (x86)\lol\LeagueOfLegends\0x0409.ini
c:\program files (x86)\lol\LeagueOfLegends\0x040a.ini
c:\program files (x86)\lol\LeagueOfLegends\0x040c.ini
c:\program files (x86)\lol\LeagueOfLegends\data1.cab
c:\program files (x86)\lol\LeagueOfLegends\data1.hdr
c:\program files (x86)\lol\LeagueOfLegends\data2.cab
c:\program files (x86)\lol\LeagueOfLegends\ISSetup.dll
c:\program files (x86)\lol\LeagueOfLegends\layout.bin
c:\program files (x86)\lol\LeagueOfLegends\setup.exe
c:\program files (x86)\lol\LeagueOfLegends\setup.ini
c:\program files (x86)\lol\LeagueOfLegends\setup.inx
c:\program files (x86)\lol\LeagueOfLegends\setup.isn
c:\programdata\windows
c:\users\Henriette\AppData\Roaming\Agiq
c:\users\Henriette\AppData\Roaming\Agiq\umyn.ene
c:\users\Henriette\AppData\Roaming\Akdu
c:\users\Henriette\AppData\Roaming\Akdu\eqoq.ovp
c:\users\Henriette\AppData\Roaming\Anemo
c:\users\Henriette\AppData\Roaming\Anemo\voyks.huz
c:\users\Henriette\AppData\Roaming\Apuvse
c:\users\Henriette\AppData\Roaming\Apuvse\ryxa.tmp
c:\users\Henriette\AppData\Roaming\Aret
c:\users\Henriette\AppData\Roaming\Aret\ociz.vef
c:\users\Henriette\AppData\Roaming\Avviol
c:\users\Henriette\AppData\Roaming\Avviol\wylas.nif
c:\users\Henriette\AppData\Roaming\Axcay
c:\users\Henriette\AppData\Roaming\Axcay\nyucu.usr
c:\users\Henriette\AppData\Roaming\Axxi
c:\users\Henriette\AppData\Roaming\Axxi\xokyo.meh
c:\users\Henriette\AppData\Roaming\Axxi\xokyo.tmp
c:\users\Henriette\AppData\Roaming\Banoh
c:\users\Henriette\AppData\Roaming\Banoh\oqhu.iry
c:\users\Henriette\AppData\Roaming\Byiq
c:\users\Henriette\AppData\Roaming\Byiq\pyin.yps
c:\users\Henriette\AppData\Roaming\Cuom
c:\users\Henriette\AppData\Roaming\Cuom\cecy.tmp
c:\users\Henriette\AppData\Roaming\Cyygc
c:\users\Henriette\AppData\Roaming\Cyygc\ukovi.tmp
c:\users\Henriette\AppData\Roaming\Daafpa
c:\users\Henriette\AppData\Roaming\Daafpa\erwo.tmp
c:\users\Henriette\AppData\Roaming\Dihyzi
c:\users\Henriette\AppData\Roaming\Dihyzi\veka.ofu
c:\users\Henriette\AppData\Roaming\Dike
c:\users\Henriette\AppData\Roaming\Dike\poikg.kul
c:\users\Henriette\AppData\Roaming\Eces
c:\users\Henriette\AppData\Roaming\Eces\piedd.hee
c:\users\Henriette\AppData\Roaming\Egler
c:\users\Henriette\AppData\Roaming\Egler\kixir.tmp
c:\users\Henriette\AppData\Roaming\Ekivn
c:\users\Henriette\AppData\Roaming\Ekivn\hera.owi
c:\users\Henriette\AppData\Roaming\Elapxy
c:\users\Henriette\AppData\Roaming\Elapxy\zefua.fau
c:\users\Henriette\AppData\Roaming\Ense
c:\users\Henriette\AppData\Roaming\Ense\xuzi.tmp
c:\users\Henriette\AppData\Roaming\Epzau
c:\users\Henriette\AppData\Roaming\Epzau\vyanw.tmp
c:\users\Henriette\AppData\Roaming\Eqylub
c:\users\Henriette\AppData\Roaming\Eqylub\koyh.tmp
c:\users\Henriette\AppData\Roaming\Eshitu
c:\users\Henriette\AppData\Roaming\Eshitu\ucna.haa
c:\users\Henriette\AppData\Roaming\Etez
c:\users\Henriette\AppData\Roaming\Etez\irca.kem
c:\users\Henriette\AppData\Roaming\Ewocga
c:\users\Henriette\AppData\Roaming\Ewocga\weqen.tmp
c:\users\Henriette\AppData\Roaming\Ewsoyq
c:\users\Henriette\AppData\Roaming\Ewsoyq\soduc.tmp
c:\users\Henriette\AppData\Roaming\Ewyw
c:\users\Henriette\AppData\Roaming\Ewyw\eltox.egu
c:\users\Henriette\AppData\Roaming\Exceu
c:\users\Henriette\AppData\Roaming\Exceu\anuk.tmp
c:\users\Henriette\AppData\Roaming\Foam
c:\users\Henriette\AppData\Roaming\Foam\byta.qir
c:\users\Henriette\AppData\Roaming\Fume
c:\users\Henriette\AppData\Roaming\Fume\vazu.yzi
c:\users\Henriette\AppData\Roaming\Giope
c:\users\Henriette\AppData\Roaming\Giope\tezif.tmp
c:\users\Henriette\AppData\Roaming\Guuduq
c:\users\Henriette\AppData\Roaming\Guuduq\athyu.uzu
c:\users\Henriette\AppData\Roaming\Hotui
c:\users\Henriette\AppData\Roaming\Hotui\oneca.tax
c:\users\Henriette\AppData\Roaming\Huni
c:\users\Henriette\AppData\Roaming\Huni\ivuxl.tmp
c:\users\Henriette\AppData\Roaming\Imgu
c:\users\Henriette\AppData\Roaming\Imgu\okeqe.xou
c:\users\Henriette\AppData\Roaming\Immev
c:\users\Henriette\AppData\Roaming\Immev\saqo.tef
c:\users\Henriette\AppData\Roaming\Ixse
c:\users\Henriette\AppData\Roaming\Ixse\laovo.kuy
c:\users\Henriette\AppData\Roaming\Ixyma
c:\users\Henriette\AppData\Roaming\Ixyma\eliga.beo
c:\users\Henriette\AppData\Roaming\Izuw
c:\users\Henriette\AppData\Roaming\Izuw\ceop.eby
c:\users\Henriette\AppData\Roaming\Izuw\ceop.tmp
c:\users\Henriette\AppData\Roaming\Izxi
c:\users\Henriette\AppData\Roaming\Izxi\urson.goq
c:\users\Henriette\AppData\Roaming\Kave
c:\users\Henriette\AppData\Roaming\Kave\cazeg.mil
c:\users\Henriette\AppData\Roaming\Kiux
c:\users\Henriette\AppData\Roaming\Kiux\pyum.tmp
c:\users\Henriette\AppData\Roaming\Laeh
c:\users\Henriette\AppData\Roaming\Laeh\amfay.rey
c:\users\Henriette\AppData\Roaming\Liri
c:\users\Henriette\AppData\Roaming\Liri\rino.zav
c:\users\Henriette\AppData\Roaming\Luav
c:\users\Henriette\AppData\Roaming\Luav\lozue.eww
c:\users\Henriette\AppData\Roaming\Lyegm
c:\users\Henriette\AppData\Roaming\Lyegm\tekea.xac
c:\users\Henriette\AppData\Roaming\Miidg
c:\users\Henriette\AppData\Roaming\Miidg\diuc.zoo
c:\users\Henriette\AppData\Roaming\Mooxf
c:\users\Henriette\AppData\Roaming\Mooxf\neloy.tmp
c:\users\Henriette\AppData\Roaming\Myaxpi
c:\users\Henriette\AppData\Roaming\Myaxpi\sily.tmp
c:\users\Henriette\AppData\Roaming\Nely
c:\users\Henriette\AppData\Roaming\Nely\qyma.uqi
c:\users\Henriette\AppData\Roaming\Oheco
c:\users\Henriette\AppData\Roaming\Oheco\huom.hai
c:\users\Henriette\AppData\Roaming\Ohmyg
c:\users\Henriette\AppData\Roaming\Ohmyg\ynpo.tmp
c:\users\Henriette\AppData\Roaming\Okaxd
c:\users\Henriette\AppData\Roaming\Okaxd\ahgu.fyh
c:\users\Henriette\AppData\Roaming\Omiruz
c:\users\Henriette\AppData\Roaming\Omiruz\heal.tmp
c:\users\Henriette\AppData\Roaming\Orciu
c:\users\Henriette\AppData\Roaming\Orciu\asemt.uzu
c:\users\Henriette\AppData\Roaming\Ovxay
c:\users\Henriette\AppData\Roaming\Ovxay\ufva.tmp
c:\users\Henriette\AppData\Roaming\Oxfuq
c:\users\Henriette\AppData\Roaming\Oxfuq\fuwi.tmp
c:\users\Henriette\AppData\Roaming\Pabe
c:\users\Henriette\AppData\Roaming\Pabe\poxe.tmp
c:\users\Henriette\AppData\Roaming\Piolyt
c:\users\Henriette\AppData\Roaming\Piolyt\akepk.tmp
c:\users\Henriette\AppData\Roaming\Qeavi
c:\users\Henriette\AppData\Roaming\Qeavi\olda.rib
c:\users\Henriette\AppData\Roaming\Qizaeq
c:\users\Henriette\AppData\Roaming\Qizaeq\uciqa.amn
c:\users\Henriette\AppData\Roaming\Qynily
c:\users\Henriette\AppData\Roaming\Qynily\makei.tmp
c:\users\Henriette\AppData\Roaming\Reim
c:\users\Henriette\AppData\Roaming\Reim\sohi.ofp
c:\users\Henriette\AppData\Roaming\Robee
c:\users\Henriette\AppData\Roaming\Robee\xaxu.fei
c:\users\Henriette\AppData\Roaming\Saof
c:\users\Henriette\AppData\Roaming\Saof\ydvys.tmp
c:\users\Henriette\AppData\Roaming\Seba
c:\users\Henriette\AppData\Roaming\Seba\dane.enz
c:\users\Henriette\AppData\Roaming\Seyzol
c:\users\Henriette\AppData\Roaming\Seyzol\ohoqe.ypa
c:\users\Henriette\AppData\Roaming\Surye
c:\users\Henriette\AppData\Roaming\Surye\qohon.tmp
c:\users\Henriette\AppData\Roaming\Taati
c:\users\Henriette\AppData\Roaming\Taati\fusuu.myl
c:\users\Henriette\AppData\Roaming\Tezere
c:\users\Henriette\AppData\Roaming\Tezere\ibyh.tmp
c:\users\Henriette\AppData\Roaming\Touf
c:\users\Henriette\AppData\Roaming\Touf\haxo.ipn
c:\users\Henriette\AppData\Roaming\Tyxeup
c:\users\Henriette\AppData\Roaming\Tyxeup\sufy.ono
c:\users\Henriette\AppData\Roaming\Ubeqy
c:\users\Henriette\AppData\Roaming\Ubeqy\agda.tmp
c:\users\Henriette\AppData\Roaming\Udixa
c:\users\Henriette\AppData\Roaming\Udixa\engyv.tmp
c:\users\Henriette\AppData\Roaming\Uhyvx
c:\users\Henriette\AppData\Roaming\Uhyvx\uskys.wyo
c:\users\Henriette\AppData\Roaming\Ulbi
c:\users\Henriette\AppData\Roaming\Ulbi\agira.beu
c:\users\Henriette\AppData\Roaming\Urhah
c:\users\Henriette\AppData\Roaming\Urhah\simim.tmp
c:\users\Henriette\AppData\Roaming\Uvecur
c:\users\Henriette\AppData\Roaming\Uvecur\ynxem.tmp
c:\users\Henriette\AppData\Roaming\Uvnia
c:\users\Henriette\AppData\Roaming\Uvnia\obcai.ovo
c:\users\Henriette\AppData\Roaming\Vaacze
c:\users\Henriette\AppData\Roaming\Vaacze\eqzei.tmp
c:\users\Henriette\AppData\Roaming\Vaer
c:\users\Henriette\AppData\Roaming\Vaer\imihk.tmp
c:\users\Henriette\AppData\Roaming\Vedyy
c:\users\Henriette\AppData\Roaming\Vedyy\ukri.tmp
c:\users\Henriette\AppData\Roaming\Vuykgi
c:\users\Henriette\AppData\Roaming\Vuykgi\filed.avb
c:\users\Henriette\AppData\Roaming\Waodpo
c:\users\Henriette\AppData\Roaming\Waodpo\ykuz.yce
c:\users\Henriette\AppData\Roaming\Wiuku
c:\users\Henriette\AppData\Roaming\Wiuku\vomeo.huu
c:\users\Henriette\AppData\Roaming\Wizo
c:\users\Henriette\AppData\Roaming\Wizo\upar.tmp
c:\users\Henriette\AppData\Roaming\Xuusuh
c:\users\Henriette\AppData\Roaming\Xuusuh\ylsab.ulu
c:\users\Henriette\AppData\Roaming\Yghuny
c:\users\Henriette\AppData\Roaming\Yghuny\igiz.tmp
c:\users\Henriette\AppData\Roaming\Ymhyh
c:\users\Henriette\AppData\Roaming\Ymhyh\eqam.lyq
c:\users\Henriette\AppData\Roaming\Ymka
c:\users\Henriette\AppData\Roaming\Ymka\osmy.xuw
c:\users\Henriette\AppData\Roaming\Ynun
c:\users\Henriette\AppData\Roaming\Ynun\avul.tmp
c:\users\Henriette\AppData\Roaming\Yreka
c:\users\Henriette\AppData\Roaming\Yreka\ceus.osu
c:\users\Henriette\AppData\Roaming\Yrifyz
c:\users\Henriette\AppData\Roaming\Yrifyz\afda.tmp
c:\users\Henriette\AppData\Roaming\Ytmax
c:\users\Henriette\AppData\Roaming\Ytmax\ycopb.sos
c:\users\Henriette\AppData\Roaming\Zaqi
c:\users\Henriette\AppData\Roaming\Zaqi\ycuf.ikn
c:\users\Henriette\AppData\Roaming\Zyvedo
c:\users\Henriette\AppData\Roaming\Zyvedo\fonu.qib
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-02 bis 2014-04-02  ))))))))))))))))))))))))))))))
.
.
2014-04-02 14:12 . 2014-04-02 14:12	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-01 11:55 . 2014-04-01 11:55	--------	d-----w-	c:\program files\CCleaner
2014-04-01 10:43 . 2014-04-01 10:46	--------	d-----w-	C:\FRST
2014-04-01 09:36 . 2014-04-01 09:36	--------	d-----w-	c:\users\Henriette\AppData\Roaming\Malwarebytes
2014-04-01 09:28 . 2014-04-01 09:28	--------	d-----w-	c:\programdata\Malwarebytes
2014-04-01 09:28 . 2014-04-01 09:31	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2014-04-01 09:28 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-04-01 09:26 . 2014-04-01 09:30	88280	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-03-21 22:42 . 2014-03-22 14:44	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2014-03-19 20:35 . 2014-03-19 20:35	--------	d-----w-	c:\users\Henriette\AppData\Roaming\library_dir
2014-03-19 20:35 . 2014-03-22 18:09	--------	d-----w-	c:\users\Henriette\AppData\Roaming\Raptr
2014-03-19 20:35 . 2014-03-22 18:09	--------	d-----w-	c:\program files (x86)\Raptr
2014-03-13 05:54 . 2014-02-04 02:32	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-03-13 05:54 . 2014-02-04 02:32	624128	----a-w-	c:\windows\system32\qedit.dll
2014-03-13 05:54 . 2014-02-04 02:04	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-03-13 05:54 . 2014-02-04 02:04	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-03-04 13:50 . 2014-03-05 14:46	--------	d-----w-	c:\users\Henriette\AppData\Roaming\QuickScan
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-19 20:51 . 2012-02-21 16:26	90015360	----a-w-	c:\windows\system32\MRT.exe
2014-03-12 17:59 . 2012-03-31 19:30	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-12 17:59 . 2012-02-21 17:19	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-02 17:20 . 2012-02-21 18:03	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-06 39408]
"Akamai NetSession Interface"="c:\users\Henriette\AppData\Local\Akamai\netsession_win.exe" [2013-06-04 4489472]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-03-19 4971024]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-12-06 766208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"UpdReg"=c:\windows\UpdReg.EXE
.
R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]
R3 XENfiltv;XENfiltv;c:\windows\system32\drivers\XENfiltv.sys;c:\windows\SYSNATIVE\drivers\XENfiltv.sys [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-15 15:59	1150280	----a-w-	c:\program files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 18:02	114688	----a-w-	c:\program files (x86)\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 17:59]
.
2014-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06 13:16]
.
2014-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06 13:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2000-01-01 12503184]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://badoo.com/startpage/
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=190.108.83.30:8080
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://badoo.com/startpage/
FF - prefs.js: keyword.URL - hxxp://badoo.com/startpage/?source=bsb&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va009]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-02  16:15:13
ComboFix-quarantined-files.txt  2014-04-02 14:15
.
Vor Suchlauf: 11 Verzeichnis(se), 169.736.200.192 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 169.578.647.552 Bytes frei
.
- - End Of File - - 11F1136DE738051012AA09C4EF12DCB8
A36C5E4F47E84449FF07ED3517B43A31
         

Combofix löschen udn neu laden, dann nochmal laufen lassen.

ComboFix 14-04-03.01 - Henriette 03.04.2014  17:21:35.3.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8169.6183 [GMT 2:00]
ausgeführt von:: c:\users\Henriette\Downloads\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-03 bis 2014-04-03  ))))))))))))))))))))))))))))))
.
.
2014-04-03 15:33 . 2014-04-03 15:33	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-01 11:55 . 2014-04-01 11:55	--------	d-----w-	c:\program files\CCleaner
2014-04-01 10:43 . 2014-04-01 10:46	--------	d-----w-	C:\FRST
2014-04-01 09:36 . 2014-04-01 09:36	--------	d-----w-	c:\users\Henriette\AppData\Roaming\Malwarebytes
2014-04-01 09:28 . 2014-04-01 09:28	--------	d-----w-	c:\programdata\Malwarebytes
2014-04-01 09:28 . 2014-04-01 09:31	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2014-04-01 09:28 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-04-01 09:26 . 2014-04-01 09:30	88280	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-03-21 22:42 . 2014-03-22 14:44	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2014-03-19 20:35 . 2014-03-19 20:35	--------	d-----w-	c:\users\Henriette\AppData\Roaming\library_dir
2014-03-19 20:35 . 2014-03-22 18:09	--------	d-----w-	c:\users\Henriette\AppData\Roaming\Raptr
2014-03-19 20:35 . 2014-03-22 18:09	--------	d-----w-	c:\program files (x86)\Raptr
2014-03-13 05:54 . 2014-02-04 02:32	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-03-13 05:54 . 2014-02-04 02:32	624128	----a-w-	c:\windows\system32\qedit.dll
2014-03-13 05:54 . 2014-02-04 02:04	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-03-13 05:54 . 2014-02-04 02:04	509440	----a-w-	c:\windows\SysWow64\qedit.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-19 20:51 . 2012-02-21 16:26	90015360	----a-w-	c:\windows\system32\MRT.exe
2014-03-12 17:59 . 2012-03-31 19:30	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-12 17:59 . 2012-02-21 17:19	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-02 17:20 . 2012-02-21 18:03	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-06 39408]
"Akamai NetSession Interface"="c:\users\Henriette\AppData\Local\Akamai\netsession_win.exe" [2014-03-06 4672920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-03-19 4971024]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-12-06 766208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"UpdReg"=c:\windows\UpdReg.EXE
.
R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]
R3 XENfiltv;XENfiltv;c:\windows\system32\drivers\XENfiltv.sys;c:\windows\SYSNATIVE\drivers\XENfiltv.sys [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-15 15:59	1150280	----a-w-	c:\program files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 18:02	114688	----a-w-	c:\program files (x86)\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 17:59]
.
2014-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06 13:16]
.
2014-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06 13:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\Henriette\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2000-01-01 12503184]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://badoo.com/startpage/
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=190.108.83.30:8080
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://badoo.com/startpage/
FF - prefs.js: keyword.URL - hxxp://badoo.com/startpage/?source=bsb&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va009]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-03  17:35:52
ComboFix-quarantined-files.txt  2014-04-03 15:35
ComboFix2.txt  2014-04-02 14:15
.
Vor Suchlauf: 15 Verzeichnis(se), 169.107.836.928 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 169.035.595.776 Bytes frei
.
- - End Of File - - CA234C83690A7A5A81AFDF3008E10096
A36C5E4F47E84449FF07ED3517B43A31
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Malewarebytes

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.04.04.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
Henriette :: RECHNNER [Administrator]

Schutz: Aktiviert

04.04.2014 16:00:18
mbam-log-2014-04-04 (16-00-18).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 234103
Laufzeit: 4 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

ADW

# AdwCleaner v3.023 - Bericht erstellt am 04/04/2014 um 16:08:45
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Henriette - RECHNNER
# Gestartet von : C:\Users\Henriette\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Windows\SysWOW64\AI_RecycleBin
Ordner Gelöscht : C:\Users\Henriette\AppData\Local\CrashRpt
Ordner Gelöscht : C:\Users\Henriette\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Henriette\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\ICQToolbarData
Datei Gelöscht : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\SweetIm.xml
Datei Gelöscht : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_clipgrab_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_clipgrab_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8A244612-A1F7-11E0-95C0-E71F4824019B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.aniweather.timeShifted", 682263);
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);
Zeile gelöscht : user_pref("icqtoolbar.firstTbRun", false);
Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1350066839);
Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options itb_people itb_zoom_in itb_zoom_out itb_zoom_default itb_games itb_highlight");
Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Zeile gelöscht : user_pref("icqtoolbar.installTime", "1350288322");
Zeile gelöscht : user_pref("icqtoolbar.newtab_most_visited_state", "0");
Zeile gelöscht : user_pref("icqtoolbar.newtab_recently_closed_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "15.0.1");
Zeile gelöscht : user_pref("icqtoolbar.showPc", false);
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uninstStatSent", true);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "135004841513499775111350066839410");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1350288290);
Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

-\\ Google Chrome v33.0.1750.154

[ Datei : C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6371 octets] - [04/04/2014 16:07:51]
AdwCleaner[S0].txt - [5947 octets] - [04/04/2014 16:08:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6007 octets] ##########
         

Junk Removal

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x64
Ran by Henriette on 04.04.2014 at 16:16:11,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2861206491-580732400-4040710124-1000\Software\sweetim



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\drivergenius"



~~~ FireFox

Successfully deleted: [File] C:\Users\Henriette\AppData\Roaming\mozilla\firefox\profiles\7vm1pdd6.default\extensions\firefox@browsesmart.net.xpi
Emptied folder: C:\Users\Henriette\AppData\Roaming\mozilla\firefox\profiles\7vm1pdd6.default\minidumps [291 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.04.2014 at 16:28:22,62
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Frst

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Henriette (administrator) on RECHNNER on 04-04-2014 17:00:22
Running from C:\Users\Henriette\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Akamai Technologies, Inc.) C:\Users\Henriette\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Henriette\AppData\Local\Akamai\netsession_win.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Logitech, Inc.) C:\Program Files\Logitech\SetPointG\SetPointII.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4971024 2014-03-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-03-06] (Google Inc.)
HKU\S-1-5-21-2861206491-580732400-4040710124-1000\...\Run: [Akamai NetSession Interface] - C:\Users\Henriette\AppData\Local\Akamai\netsession_win.exe [4672920 2014-03-06] (Akamai Technologies, Inc.)

==================== Internet (Whitelisted) ====================

ProxyServer: http=190.108.83.30:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://badoo.com/startpage/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA5F64EDCB6F0CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://badoo.com/startpage/
FF Keyword.URL: hxxp://badoo.com/startpage/?source=bsb&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.132.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @real.com/nppl3260;version=15.0.2.72 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.2.72 - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.2.72 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.2.72 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=15.0.2.72 - c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Henriette\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\badoo.xml
FF SearchPlugin: C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-23]
FF Extension: DownloadHelper - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-09-05]
FF Extension: ICQ Sparberater - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\ciuvo-extension@icq.de.xpi [2012-10-13]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2013-06-25]
FF Extension: Grooveshark Unlocker - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\groovesharkUnlocker@overlord1337.xpi [2012-03-12]
FF Extension: {717466b3-8c66-497c-9383-3da3722ff434} - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{717466b3-8c66-497c-9383-3da3722ff434}.xpi [2013-11-14]
FF Extension: Easy YouTube Video Downloader - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2012-12-22]
FF Extension: Web Install Plugin Pro - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{c69e0078-851d-4be4-b708-cf6edacf30c7}.xpi [2013-11-27]
FF Extension: Adblock Plus - C:\Users\Henriette\AppData\Roaming\Mozilla\Firefox\Profiles\7vm1pdd6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-07]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-02-26]

Chrome: 
=======
CHR HomePage: hxxp://msn.de/
CHR Extension: (Google Drive) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-22]
CHR Extension: (Paintbrush) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\benliocpgpijioclmdjjjjgmimgeodad [2012-09-08]
CHR Extension: (YouTube) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-22]
CHR Extension: (Google-Suche) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-22]
CHR Extension: (Sumo Paint) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod [2012-09-08]
CHR Extension: (PicMonkey) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgdgokchhicmaiacmgegjnppjkgogdhm [2013-08-13]
CHR Extension: (Pixlr Express) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmjpdlmjopaeginhldhiokeidchjid [2013-08-13]
CHR Extension: (Google Maps) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2013-08-13]
CHR Extension: (Google Wallet) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Psykopaint) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil [2012-09-08]
CHR Extension: (Google Mail) - C:\Users\Henriette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-22]
CHR HKLM-x32\...\Chrome\Extension: [ippenodjaoidmkkfdlmdhofiebnpjddb] - C:\Program Files (x86)\BrowseSmart\ippenodjaoidmkkfdlmdhofiebnpjddb.crx [2014-02-22]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-02-26]

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3782672 2014-02-23] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-03] ()

==================== Drivers (Whitelisted) ====================

S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-11-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 XENfiltv; C:\Windows\System32\drivers\XENfiltv.sys [25600 2009-07-31] (Creative Technology Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-04 16:59 - 2014-04-04 16:59 - 02157056 _____ (Farbar) C:\Users\Henriette\Downloads\FRST64.exe
2014-04-04 16:16 - 2014-04-04 16:16 - 00000000 ____D () C:\Windows\ERUNT
2014-04-04 16:15 - 2014-04-04 16:15 - 01038974 _____ (Thisisu) C:\Users\Henriette\Desktop\JRT.exe
2014-04-04 16:07 - 2014-04-04 16:58 - 00000000 ____D () C:\Users\Henriette\Desktop\Neuer Ordner (4)
2014-04-04 16:07 - 2014-04-04 16:08 - 00000000 ____D () C:\AdwCleaner
2014-04-04 16:06 - 2014-04-04 16:06 - 01426178 _____ () C:\Users\Henriette\Desktop\adwcleaner.exe
2014-04-03 17:35 - 2014-04-03 17:35 - 00019609 _____ () C:\ComboFix.txt
2014-04-03 17:16 - 2014-04-03 17:16 - 05193944 ____R (Swearware) C:\Users\Henriette\Downloads\ComboFix.exe
2014-04-03 17:16 - 2014-04-03 17:16 - 00001182 _____ () C:\Users\Henriette\Desktop\ComboFix.exe - Verknüpfung.lnk
2014-04-02 15:53 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-02 15:53 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-02 15:53 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-02 15:53 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-02 15:53 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-02 15:53 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-02 15:53 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-02 15:53 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-02 15:52 - 2014-04-03 17:35 - 00000000 ____D () C:\Qoobox
2014-04-02 15:51 - 2014-04-02 16:13 - 00000000 ____D () C:\Windows\erdnt
2014-04-01 13:58 - 2014-04-01 13:58 - 00341554 _____ () C:\Users\Henriette\Documents\cc_20140401_135822.reg
2014-04-01 13:55 - 2014-04-01 13:55 - 03710504 _____ (Piriform Ltd) C:\Users\Henriette\Downloads\ccsetup412_slim.exe
2014-04-01 13:55 - 2014-04-01 13:55 - 03710504 _____ (Piriform Ltd) C:\Users\Henriette\Downloads\ccsetup412_slim (1).exe
2014-04-01 13:55 - 2014-04-01 13:55 - 00002780 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-01 13:55 - 2014-04-01 13:55 - 00000828 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-04-01 13:55 - 2014-04-01 13:55 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-01 12:44 - 2014-04-01 12:46 - 00035244 _____ () C:\Users\Henriette\Downloads\Addition.txt
2014-04-01 12:43 - 2014-04-04 17:00 - 00020191 _____ () C:\Users\Henriette\Downloads\FRST.txt
2014-04-01 12:43 - 2014-04-04 17:00 - 00000000 ____D () C:\FRST
2014-04-01 11:36 - 2014-04-01 11:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Malwarebytes
2014-04-01 11:30 - 2014-04-01 11:30 - 00000000 ____D () C:\Users\Henriette\Desktop\Neuer Ordner (3)
2014-04-01 11:28 - 2014-04-01 11:31 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-01 11:28 - 2014-04-01 11:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-01 11:28 - 2014-04-01 11:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-01 11:28 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 11:26 - 2014-04-01 11:30 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-01 11:25 - 2014-04-01 11:29 - 15063548 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0 (1).zip
2014-04-01 11:25 - 2014-04-01 11:25 - 04793000 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0.zip
2014-03-23 17:17 - 2014-03-23 17:17 - 00002520 _____ () C:\Users\Henriette\Downloads\n9yh88v1nm07x65-ul.to.dlc
2014-03-23 13:09 - 2014-03-23 13:09 - 00017156 _____ () C:\Users\Henriette\Downloads\x0p045x7o5o0092.dlc
2014-03-22 23:25 - 2014-03-22 23:33 - 00000000 ____D () C:\Users\Henriette\Desktop\Conan.The.Barbarian.2011.German.DTS-HD.DL.1080p.BluRay.AVC.Remux-HDS
2014-03-22 20:02 - 2014-03-22 20:03 - 11979132 _____ () C:\Users\Henriette\Downloads\SETUP_0.118.zip
2014-03-22 19:12 - 2014-03-22 19:12 - 00007748 _____ () C:\Users\Henriette\Downloads\f2731ss34s9376b.dlc
2014-03-22 00:42 - 2014-03-22 16:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-21 14:36 - 2014-03-21 14:36 - 00014704 _____ () C:\Users\Henriette\Downloads\334i788e655q8a9.dlc
2014-03-21 12:18 - 2014-03-21 12:18 - 00007472 _____ () C:\Users\Henriette\Downloads\20099dob6i9cmzc.dlc
2014-03-20 23:24 - 2014-03-20 23:24 - 00011716 _____ () C:\Users\Henriette\Downloads\5l8284lxk81x2sd.dlc
2014-03-20 23:20 - 2014-03-20 23:20 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk (1).dlc
2014-03-20 23:16 - 2014-03-20 23:16 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk.dlc
2014-03-19 22:36 - 2014-03-19 22:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-03-19 22:35 - 2014-03-22 20:09 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Raptr
2014-03-19 22:35 - 2014-03-22 20:09 - 00000000 ____D () C:\Program Files (x86)\Raptr
2014-03-19 22:35 - 2014-03-19 22:35 - 01007930 _____ () C:\Users\Henriette\Downloads\amddriverdownload_installer.exe
2014-03-19 22:35 - 2014-03-19 22:35 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\library_dir
2014-03-19 18:46 - 2014-03-19 18:47 - 00275176 _____ () C:\Windows\Minidump\031914-57907-01.dmp
2014-03-18 18:44 - 2014-03-18 18:44 - 00275176 _____ () C:\Windows\Minidump\031814-56815-01.dmp
2014-03-18 18:41 - 2014-03-18 18:41 - 00275176 _____ () C:\Windows\Minidump\031814-89014-01.dmp
2014-03-18 18:40 - 2014-03-19 18:46 - 662258539 _____ () C:\Windows\MEMORY.DMP
2014-03-16 23:23 - 2014-03-16 23:23 - 00282775 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.crx
2014-03-16 23:18 - 2014-03-16 23:18 - 00139952 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-050.crx
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.zip
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055 (1).zip
2014-03-13 18:03 - 2014-03-13 18:03 - 00000000 ____D () C:\Users\Henriette\Documents\Respawn
2014-03-13 18:02 - 2014-03-13 18:02 - 00002328 _____ () C:\Users\Henriette\Downloads\9q9v7hc91246aa0-ul.to.dlc
2014-03-13 17:47 - 2014-03-13 18:01 - 00001184 _____ () C:\Users\Public\Desktop\Titanfall.lnk
2014-03-13 13:17 - 2014-03-13 13:17 - 00001476 _____ () C:\Users\Henriette\Downloads\47_Ronin_2013_German_TS_LD_XviD_-_TOD-de8be1nprhcm.dlc
2014-03-13 13:13 - 2014-03-13 13:13 - 00001988 _____ () C:\Users\Henriette\Downloads\45u5267fl9862h4.dlc
2014-03-13 13:09 - 2014-03-13 13:09 - 00001840 _____ () C:\Users\Henriette\Downloads\u2n25w5evc34scw.dlc
2014-03-13 07:55 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 07:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 07:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 07:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 07:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 07:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 07:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 07:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 07:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 07:55 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 07:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 07:55 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 07:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 07:55 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 07:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 07:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 07:55 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 07:55 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 07:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 07:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 07:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 07:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 07:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 07:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 07:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 07:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 07:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 07:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 07:55 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 07:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 07:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 07:55 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 07:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 07:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 07:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 07:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 07:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 07:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 07:55 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 07:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 07:55 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 07:55 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 07:55 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 07:55 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 07:54 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 07:54 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 07:54 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 07:54 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

==================== One Month Modified Files and Folders =======

2014-04-04 17:00 - 2014-04-01 12:43 - 00020191 _____ () C:\Users\Henriette\Downloads\FRST.txt
2014-04-04 17:00 - 2014-04-01 12:43 - 00000000 ____D () C:\FRST
2014-04-04 16:59 - 2014-04-04 16:59 - 02157056 _____ (Farbar) C:\Users\Henriette\Downloads\FRST64.exe
2014-04-04 16:59 - 2012-03-31 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-04 16:58 - 2014-04-04 16:07 - 00000000 ____D () C:\Users\Henriette\Desktop\Neuer Ordner (4)
2014-04-04 16:18 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-04 16:18 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-04 16:16 - 2014-04-04 16:16 - 00000000 ____D () C:\Windows\ERUNT
2014-04-04 16:15 - 2014-04-04 16:15 - 01038974 _____ (Thisisu) C:\Users\Henriette\Desktop\JRT.exe
2014-04-04 16:15 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-04 16:15 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-04 16:15 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-04 16:10 - 2013-04-08 17:06 - 00052564 _____ () C:\Windows\setupact.log
2014-04-04 16:10 - 2012-03-06 15:16 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-04 16:10 - 2012-02-17 11:48 - 00000000 ____D () C:\Users\Henriette
2014-04-04 16:10 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-04 16:09 - 2012-02-17 18:46 - 01202974 _____ () C:\Windows\WindowsUpdate.log
2014-04-04 16:08 - 2014-04-04 16:07 - 00000000 ____D () C:\AdwCleaner
2014-04-04 16:06 - 2014-04-04 16:06 - 01426178 _____ () C:\Users\Henriette\Desktop\adwcleaner.exe
2014-04-04 16:01 - 2012-03-06 15:16 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-04 15:58 - 2014-02-06 23:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-04 15:58 - 2013-12-05 00:48 - 00000000 ____D () C:\Users\Henriette\AppData\Local\Battle.net
2014-04-04 15:54 - 2012-03-06 15:16 - 00000000 ____D () C:\Users\Henriette\AppData\Local\Google
2014-04-04 15:46 - 2012-10-18 09:05 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-04 15:41 - 2013-04-08 17:06 - 00233736 _____ () C:\Windows\PFRO.log
2014-04-03 17:35 - 2014-04-03 17:35 - 00019609 _____ () C:\ComboFix.txt
2014-04-03 17:35 - 2014-04-02 15:52 - 00000000 ____D () C:\Qoobox
2014-04-03 17:33 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-03 17:16 - 2014-04-03 17:16 - 05193944 ____R (Swearware) C:\Users\Henriette\Downloads\ComboFix.exe
2014-04-03 17:16 - 2014-04-03 17:16 - 00001182 _____ () C:\Users\Henriette\Desktop\ComboFix.exe - Verknüpfung.lnk
2014-04-03 17:13 - 2012-08-02 18:22 - 00000000 ____D () C:\Users\Henriette\AppData\Local\Akamai
2014-04-02 16:13 - 2014-04-02 15:51 - 00000000 ____D () C:\Windows\erdnt
2014-04-01 19:56 - 2012-03-06 15:16 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 19:56 - 2012-03-06 15:16 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-01 13:58 - 2014-04-01 13:58 - 00341554 _____ () C:\Users\Henriette\Documents\cc_20140401_135822.reg
2014-04-01 13:56 - 2013-09-14 12:02 - 00000000 ____D () C:\Windows\pss
2014-04-01 13:56 - 2012-02-17 11:48 - 00000000 ___RD () C:\Users\Henriette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-01 13:55 - 2014-04-01 13:55 - 03710504 _____ (Piriform Ltd) C:\Users\Henriette\Downloads\ccsetup412_slim.exe
2014-04-01 13:55 - 2014-04-01 13:55 - 03710504 _____ (Piriform Ltd) C:\Users\Henriette\Downloads\ccsetup412_slim (1).exe
2014-04-01 13:55 - 2014-04-01 13:55 - 00002780 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-01 13:55 - 2014-04-01 13:55 - 00000828 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-04-01 13:55 - 2014-04-01 13:55 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-01 13:54 - 2013-04-26 19:13 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Dropbox
2014-04-01 13:53 - 2013-04-26 19:18 - 00000000 ___RD () C:\Users\Henriette\Dropbox
2014-04-01 12:46 - 2014-04-01 12:44 - 00035244 _____ () C:\Users\Henriette\Downloads\Addition.txt
2014-04-01 11:36 - 2014-04-01 11:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Malwarebytes
2014-04-01 11:31 - 2014-04-01 11:28 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-01 11:31 - 2014-04-01 11:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-01 11:30 - 2014-04-01 11:30 - 00000000 ____D () C:\Users\Henriette\Desktop\Neuer Ordner (3)
2014-04-01 11:30 - 2014-04-01 11:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-01 11:29 - 2014-04-01 11:25 - 15063548 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0 (1).zip
2014-04-01 11:28 - 2014-04-01 11:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-01 11:25 - 2014-04-01 11:25 - 04793000 _____ () C:\Users\Henriette\Downloads\malwarebytes_chameleon_2.0.26.0.zip
2014-03-31 15:44 - 2013-09-27 22:08 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-03-27 22:43 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-27 08:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-25 16:14 - 2012-02-21 18:53 - 00000000 ____D () C:\ProgramData\Origin
2014-03-25 09:00 - 2012-03-26 21:51 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-03-23 18:11 - 2012-02-21 22:04 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\vlc
2014-03-23 17:17 - 2014-03-23 17:17 - 00002520 _____ () C:\Users\Henriette\Downloads\n9yh88v1nm07x65-ul.to.dlc
2014-03-23 13:09 - 2014-03-23 13:09 - 00017156 _____ () C:\Users\Henriette\Downloads\x0p045x7o5o0092.dlc
2014-03-23 09:53 - 2012-10-14 19:28 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-03-22 23:33 - 2014-03-22 23:25 - 00000000 ____D () C:\Users\Henriette\Desktop\Conan.The.Barbarian.2011.German.DTS-HD.DL.1080p.BluRay.AVC.Remux-HDS
2014-03-22 23:24 - 2013-12-11 20:22 - 00000000 ____D () C:\Users\Henriette\AppData\Local\QuickPar
2014-03-22 20:26 - 2012-06-12 13:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-22 20:26 - 2012-02-21 19:46 - 00000000 ____D () C:\Program Files (x86)\Pando Networks
2014-03-22 20:20 - 2014-01-26 18:59 - 00000000 ____D () C:\Program Files (x86)\DVDx 4.0 Open Edition
2014-03-22 20:16 - 2012-02-17 14:06 - 00000000 ____D () C:\Program Files (x86)\Futuremark
2014-03-22 20:15 - 2012-03-28 16:44 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-03-22 20:09 - 2014-03-19 22:35 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Raptr
2014-03-22 20:09 - 2014-03-19 22:35 - 00000000 ____D () C:\Program Files (x86)\Raptr
2014-03-22 20:09 - 2012-03-09 20:42 - 00000000 ____D () C:\Program Files (x86)\RapidSolution
2014-03-22 20:03 - 2014-03-22 20:02 - 11979132 _____ () C:\Users\Henriette\Downloads\SETUP_0.118.zip
2014-03-22 20:03 - 2013-12-09 22:11 - 00000000 ____D () C:\ProgramData\Freemake
2014-03-22 20:03 - 2013-12-09 22:11 - 00000000 ____D () C:\Program Files (x86)\Freemake
2014-03-22 20:01 - 2012-04-10 09:03 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\DVDVideoSoft
2014-03-22 19:58 - 2012-02-21 18:56 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-22 19:12 - 2014-03-22 19:12 - 00007748 _____ () C:\Users\Henriette\Downloads\f2731ss34s9376b.dlc
2014-03-22 16:44 - 2014-03-22 00:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-21 14:36 - 2014-03-21 14:36 - 00014704 _____ () C:\Users\Henriette\Downloads\334i788e655q8a9.dlc
2014-03-21 12:18 - 2014-03-21 12:18 - 00007472 _____ () C:\Users\Henriette\Downloads\20099dob6i9cmzc.dlc
2014-03-20 23:24 - 2014-03-20 23:24 - 00011716 _____ () C:\Users\Henriette\Downloads\5l8284lxk81x2sd.dlc
2014-03-20 23:20 - 2014-03-20 23:20 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk (1).dlc
2014-03-20 23:16 - 2014-03-20 23:16 - 00016344 _____ () C:\Users\Henriette\Downloads\3r9x95h6i02j8jk.dlc
2014-03-19 22:54 - 2013-08-14 13:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-19 22:51 - 2012-02-21 18:26 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-19 22:36 - 2014-03-19 22:36 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-03-19 22:35 - 2014-03-19 22:35 - 01007930 _____ () C:\Users\Henriette\Downloads\amddriverdownload_installer.exe
2014-03-19 22:35 - 2014-03-19 22:35 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\library_dir
2014-03-19 18:47 - 2014-03-19 18:46 - 00275176 _____ () C:\Windows\Minidump\031914-57907-01.dmp
2014-03-19 18:46 - 2014-03-18 18:40 - 662258539 _____ () C:\Windows\MEMORY.DMP
2014-03-19 18:46 - 2012-03-06 17:46 - 00000000 ____D () C:\Windows\Minidump
2014-03-19 18:44 - 2012-04-07 19:52 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\TS3Client
2014-03-19 18:44 - 2012-04-07 19:51 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-03-18 18:44 - 2014-03-18 18:44 - 00275176 _____ () C:\Windows\Minidump\031814-56815-01.dmp
2014-03-18 18:41 - 2014-03-18 18:41 - 00275176 _____ () C:\Windows\Minidump\031814-89014-01.dmp
2014-03-16 23:23 - 2014-03-16 23:23 - 00282775 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.crx
2014-03-16 23:18 - 2014-03-16 23:18 - 00139952 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-050.crx
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055.zip
2014-03-16 23:17 - 2014-03-16 23:17 - 00279792 _____ () C:\Users\Henriette\Downloads\YouTube-Unblocker-055 (1).zip
2014-03-15 18:04 - 2014-02-22 22:00 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-14 09:37 - 2013-12-05 00:49 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-03-14 09:18 - 2009-07-14 06:45 - 00370136 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 00:48 - 2012-11-14 23:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-13 18:03 - 2014-03-13 18:03 - 00000000 ____D () C:\Users\Henriette\Documents\Respawn
2014-03-13 18:02 - 2014-03-13 18:02 - 00002328 _____ () C:\Users\Henriette\Downloads\9q9v7hc91246aa0-ul.to.dlc
2014-03-13 18:01 - 2014-03-13 17:47 - 00001184 _____ () C:\Users\Public\Desktop\Titanfall.lnk
2014-03-13 17:49 - 2013-05-01 09:57 - 00090779 _____ () C:\Windows\DirectX.log
2014-03-13 13:17 - 2014-03-13 13:17 - 00001476 _____ () C:\Users\Henriette\Downloads\47_Ronin_2013_German_TS_LD_XviD_-_TOD-de8be1nprhcm.dlc
2014-03-13 13:13 - 2014-03-13 13:13 - 00001988 _____ () C:\Users\Henriette\Downloads\45u5267fl9862h4.dlc
2014-03-13 13:09 - 2014-03-13 13:09 - 00001840 _____ () C:\Users\Henriette\Downloads\u2n25w5evc34scw.dlc
2014-03-12 19:59 - 2012-03-31 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 19:59 - 2012-03-31 21:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 19:59 - 2012-02-21 19:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 15:57 - 2012-05-22 22:12 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-03-05 16:46 - 2014-03-04 15:50 - 00000000 ____D () C:\Users\Henriette\AppData\Roaming\QuickScan
2014-03-05 00:02 - 2013-05-26 17:41 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-05 00:02 - 2012-05-28 22:28 - 00000000 ____D () C:\ProgramData\Skype

Some content of TEMP:
====================
C:\Users\Henriette\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-30 13:30

==================== End Of Log ============================
         

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?