Windows 7; Malwarebytes findet täglich zw 150 und 200 infizierte Dateien

frangirl

Obwohl ich mittlerweile fast täglich Malwarebytes laufen lasse und alle infizierten Dateien entferne, habe ich immer wieder neue auf dem Rechner. Ich würde gerne die Löcher stopfen.
AVG Internet Security 2014 ist offenbar keine Hilfe.
Hier meine log Dateien:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.04.06.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
Franziska :: FRANZISKA-PC [Administrator]

08.04.2014 19:55:43
mbam-log-2014-04-08 (19-55-43).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 433938
Laufzeit: 59 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 5
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Keine Aktion durchgeführt.
HKCU\Software\Distromatic\Toolbars (PUP.Optional.AlexaTB.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Keine Aktion durchgeführt.
HKLM\Software\awesomehpSoftware (PUP.Optional.Awesomehp.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKLM\SOFTWARE\Mozilla\Firefox\Extensions|quick_start@gmail.com (PUP.Optional.QuickStart.A) -> Daten: C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\extensions\quick_start@gmail.com -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 9
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Search_URL (PUP.Optional.Awesomehp.A) -> Bösartig: (hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.Awesomehp.A) -> Bösartig: (hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\Software\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Awesomehp.A) -> Bösartig: (hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (PUP.Optional.Awesomehp.A) -> Bösartig: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.awesomehp.com/?type=sc&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072) Gut: (firefox.exe) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (PUP.Optional.Awesomehp.A) -> Bösartig: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.awesomehp.com/?type=sc&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072) Gut: (iexplore.exe) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Search_URL (PUP.Optional.Awesomehp.A) -> Bösartig: (hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Awesomehp.A) -> Bösartig: (hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DefaultScope (PUP.Optional.Qone8) -> Bösartig: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}) Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}) -> Keine Aktion durchgeführt.
HKLM\Software\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.Awesomehp.A) -> Bösartig: (hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 45
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\Install (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\en_us (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\es_es (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\pt_br (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\tr_tr (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\zh_cn (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\zh_tw (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout\default (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\style (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Common Files\337\libcef (PUP.Optional.337Technologies.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123 (PUP.Optional.337Technologies.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales (PUP.Optional.337Technologies.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0 (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\ProgramData\IePluginService (PUP.Optional.IePluginService.A) -> Keine Aktion durchgeführt.
C:\ProgramData\IePluginService\update (PUP.Optional.IePluginService.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0 (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\weather (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\en (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\es (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\es_419 (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-BE (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-CA (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-CH (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-LU (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\it (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\it-CH (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\pl (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\pt_BR (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\ru (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\ru-MO (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\tr (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\vi (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\zh_CN (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\zh_TW (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 108
C:\Program Files (x86)\SupTab\SupTab.dll (PUP.Optional.SupTab.A) -> Keine Aktion durchgeführt.
C:\Sandbox\Franziska\DefaultBox\user\current\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000 (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt.
C:\Sandbox\Franziska\DefaultBox\user\current\Downloads\wtr-12yearsaslave.exe (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000 (PUP.Optional.Tarma) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1UDO89HG\adks_awesomehp[1].exe (PUP.Optional.SkyTech.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48E0MDLN\EnhanceTronicSetup_20131220[1].exe (PUP.Optional.EnhanceTronic.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48E0MDLN\Setup[1].exe (PUP.Optional.EnhanceTronic.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UXFORXXD\component_libcef_1.1364.1123[1].exe (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\eInstall.exe (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\fullpackage_temp1393418835\package1.zip (PUP.Optional.SkyTech.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\fullpackage_temp1393418835\QQBrowserFrame.dll (PUP.Optional.SkyTech.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\fullpackage_temp1393418835\tmp\desk365.exe (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\fullpackage_temp1393418835\tmp\SupTab.exe (PUP.Optional.SupTab.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\fullpackage_temp1393418835\tmp\wpm.exe (PUP.Optional.WpManager) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Roaming\SupTab\SupTab.dll (PUP.Optional.SupTab.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\Downloads\Skype - CHIP-Downloader.exe (PUP.Optional.DownloadSponsor) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\awesomehp.xml (PUP.Optional.Awesomehp.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv2.crx (PUP.Optional.NewTab.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\main (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\msvcp100.dll (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\msvcr100.dll (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\segoeui.ttf (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\segoeuib.ttf (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\app_icon.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\change_skin.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\combo_skin.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\edit_skin.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_back.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_button_skin.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_checked.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_intermediate.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_uncheck.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_logo.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\install_resource.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\patch_file_icon.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\pic-error.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\pic-info.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\pic-question.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\pic-warning.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\popup_dialog_bk.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_bk.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_image.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\radio_normal.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\radio_selected.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\image\default\sys_close.png (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\Install\4zip.inst (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\Install\AirZip.inst (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\Install\edesk.inst (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\Install\gamelogin.inst (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\protocol.txt (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\en_us\install_lang.ini (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\es_es\install_lang.ini (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\pt_br\install_lang.ini (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\language\tr_tr\install_lang.ini (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout\default\eDeskInstall.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout\default\gamelogin.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout\default\install_msgbox.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout\default\languageSelect.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\layout\default\uninstgl.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Temp\Desk365\eInstall\style\install_style.xml (PUP.Optional.Desk365.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\icudt.dll (PUP.Optional.337Technologies.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\libcef.dll (PUP.Optional.337Technologies.A) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales\en-US.pak (PUP.Optional.337Technologies.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\background.html (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\background.js (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\data.json (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\icon128.png (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\inject.js (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\jquery.js (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\jquery2.js (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\manifest.json (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\xa.js (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\xagainit.js (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.
C:\ProgramData\IePluginService\update\conf (PUP.Optional.IePluginService.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\index.html (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\manifest.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\style.css (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\default_logo.png (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\icon128.png (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\icon16.png (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\icon48.png (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\loading.gif (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\search.png (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\img\weather\0.png (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js\background.js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js\ga.js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js\jquery-base.js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js\jquery.autocomplete.js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js\js.js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\js\xagainit.js (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\en\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\es\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\es_419\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-BE\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-CA\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-CH\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\fr-LU\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\it\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\it-CH\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\pl\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\pt_BR\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\ru\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\ru-MO\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\tr\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\vi\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\zh_CN\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.
C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\3.2.0_0\_locales\zh_TW\messages.json (PUP.Optional.QuickStart.A) -> Keine Aktion durchgeführt.

(Ende)

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Franziska at 2014-04-09 19:24:46
Running from C:\Users\Franziska\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG Internet Security 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2014 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
ALDI Bestellsoftware 4.13 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.13 - ORWO Net)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4355 - AVG Technologies)
AVG 2014 (Version: 14.0.3882 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4355 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.0.5.292 - AVG Technologies)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother HL-3070CW (HKLM-x32\...\{E3A8429C-B475-48AD-B667-483B531A120C}) (Version: 1.00 - Brother)
calibre (HKLM-x32\...\{04DA2FBD-B750-4070-90DE-D387DAC13C71}) (Version: 1.21.0 - Kovid Goyal)
Canon MP Navigator EX 1.0 (HKLM-x32\...\MP Navigator EX 1.0) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.02 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4255 - CDBurnerXP)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.13345 - Landesfinanzdirektion Thüringen)
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Earth (HKLM-x32\...\{3E8A20E1-223F-11E2-9116-B8AC6F98CCE3}) (Version: 7.0.1.8244 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
KeePass Password Safe 2.25 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.25 - Dominik Reichl)
Kobo (HKLM-x32\...\Kobo) (Version: 3.2.2 - Kobo Inc.)
Lern-o-Mat (HKLM-x32\...\{0D509231-F06C-4A79-BF77-91077226626B}) (Version: - )
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.51 (HKLM\...\Logitech Gaming Software) (Version: 8.51.5 - Logitech Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.889 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.15.2 - NVIDIA Corporation) Hidden
PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Sandboxie 4.06 (64-bit) (HKLM\...\Sandboxie) (Version: 4.06 - Sandboxie Holdings, LLC)
Secunia PSI (3.0.0.7009) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7009 - Secunia)
Skype™ 6.13 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.13.104 - Skype Technologies S.A.)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 2.2.1 - Krzysztof Kowalczyk)
TP-LINK Wireless Client Utility (HKLM-x32\...\{1E03C8BE-0848-430F-BECA-7D7709401626}) (Version: 7.0 - TP-LINK)
Tyre (HKLM-x32\...\Tyre_is1) (Version: 6.4.0.9 - 't Schrijverke)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VR-NetWorld (HKLM-x32\...\{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}) (Version: - )

==================== Restore Points =========================

12-03-2014 15:58:19 Geplanter Prüfpunkt
13-03-2014 02:00:30 Windows Update
18-03-2014 14:59:57 Windows Update
26-03-2014 08:54:01 Geplanter Prüfpunkt
03-04-2014 08:09:14 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0055FBAD-1891-4DC9-852F-D67A89CBCA04} - System32\Tasks\AllmyappsUpdateTask => C:\Users\Franziska\AppData\Roaming\Allmyapps\Allmyapps.exe
Task: {0126C46C-CAE0-48D5-A25A-2C508A010943} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {0146CB2E-0062-4382-8F96-02CF60AA6A8F} - System32\Tasks\{C300EB4F-69CC-4E0D-9053-478044A9522F} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-02-21] (Apple Inc.)
Task: {04273422-D77A-4566-B412-E41A179A0031} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {09F82638-9F27-4102-B365-2ACE854AFCDE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02] (Google Inc.)
Task: {272BEBEC-18BF-432E-B9E2-4FEB0140B73B} - System32\Tasks\{54006131-CA30-4004-8446-BD85E6B675CB} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-02-21] (Apple Inc.)
Task: {298413B0-6866-493D-9D20-45155E89B6D9} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {550EC6F0-61A3-4B99-9D3E-0962DF6A7B38} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {6C4C565E-79DA-46A1-AC00-11D9349ABFBA} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {72820729-8BF7-40BE-976F-3D8AA17634AF} - System32\Tasks\{466E051E-DBDC-49FD-BA91-F68A412C7B28} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-02-21] (Apple Inc.)
Task: {7DE31B71-6E58-49F6-AA82-511050A45B82} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {7E0D8036-B311-426C-8D59-4547A2CDC573} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {9D080DE9-1D8B-4C2A-A2E2-93BC6236DB07} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {9FED8FC7-2F92-4A7C-AAEA-BE2B47A84D86} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {A2AA4D3D-50F5-49E0-90C5-89AC7722F2C3} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {B6A4711C-D9E1-48EC-975F-F39B5F43A066} - System32\Tasks\{26EE1328-1CD5-4F68-BE55-8C5A0F513E49} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-02-21] (Apple Inc.)
Task: {C9F2E78E-5848-4A6A-BB63-9E9602EBA573} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02] (Google Inc.)
Task: {CE0300EA-E643-40DA-B49E-A79873526F88} - System32\Tasks\{24EB8321-B9A3-4F8E-917B-8BC439943C34} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-02-21] (Apple Inc.)
Task: {D1540E75-C844-40A1-ABEC-2A6898943D23} - System32\Tasks\{B62D8103-224B-49EF-8EB7-4EABA3599A8A} => C:\Program Files (x86)\iTunes\iTunes.exe [2014-02-21] (Apple Inc.)
Task: {EAE61E91-33C3-46D6-A957-A1ED4D8B7AFE} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-12-03 21:39 - 2013-10-23 10:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-12-09 22:49 - 2013-12-10 17:48 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-03-22 19:42 - 2014-03-22 19:41 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\loggingserver.exe
2014-02-08 23:54 - 2014-03-22 19:41 - 02544664 _____ () C:\Program Files (x86)\AVG Secure Search\vprot.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-22 19:42 - 2014-03-22 19:41 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\log4cplusU.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Franziska\AppData\Roaming\Dropbox\bin\libcef.dll
2014-02-08 23:54 - 2014-03-22 19:41 - 01603608 _____ () C:\Program Files (x86)\AVG Secure Search\TBAPI.dll
2014-04-09 15:20 - 2014-04-02 03:57 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-09 15:20 - 2014-04-02 03:57 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-09 15:20 - 2014-04-02 03:57 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\libegl.dll
2014-04-09 15:20 - 2014-04-02 03:57 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-09 15:20 - 2014-04-02 03:58 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-09 15:20 - 2014-04-02 03:57 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: HID-konforme Maus
Description: HID-konforme Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: mouhid
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/09/2014 09:30:21 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 41736710

Error: (04/09/2014 09:30:21 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 41736710

Error: (04/09/2014 09:30:21 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/08/2014 06:00:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 09:03:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 01:23:00 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/04/2014 04:43:32 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/03/2014 11:39:15 AM) (Source: Application Hang) (User: )
Description: Programm mbam.exe, Version 1.75.0.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 10c8

Startzeit: 01cf4f07ec394d7e

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

Berichts-ID: cd395c14-bb13-11e3-b4db-bc12b0b35033

Error: (04/03/2014 08:43:25 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/02/2014 07:29:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (04/09/2014 07:17:57 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/09/2014 11:32:43 AM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/09/2014 09:52:05 AM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/09/2014 09:30:33 AM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/09/2014 09:30:25 AM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/08/2014 08:21:45 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/08/2014 08:01:34 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/08/2014 05:58:45 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\athExt.dll
Fehlercode: 126

Error: (04/07/2014 09:02:05 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\athExt.dll
Fehlercode: 126

Error: (04/07/2014 00:39:36 AM) (Source: ipnathlp) (User: )
Description: 0


Microsoft Office Sessions:
=========================
Error: (04/09/2014 09:30:21 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 41736710

Error: (04/09/2014 09:30:21 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 41736710

Error: (04/09/2014 09:30:21 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/08/2014 06:00:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 09:03:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 01:23:00 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/04/2014 04:43:32 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/03/2014 11:39:15 AM) (Source: Application Hang)(User: )
Description: mbam.exe1.75.0.110c801cf4f07ec394d7e0C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.execd395c14-bb13-11e3-b4db-bc12b0b35033

Error: (04/03/2014 08:43:25 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/02/2014 07:29:36 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 46%
Total physical RAM: 4093.41 MB
Available physical RAM: 2192.49 MB
Total Pagefile: 8185.01 MB
Available Pagefile: 5685.67 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:175.69 GB) (Free:96.69 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:755.72 GB) (Free:688.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 09F9F89F)
Partition 1: (Active) - (Size=102 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=176 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=756 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 27 days old and could be outdated)
Ran by Franziska (administrator) on FRANZISKA-PC on 09-04-2014 19:24:13
Running from C:\Users\Franziska\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\loggingserver.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Franziska\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
() C:\Program Files (x86)\AVG Secure Search\vprot.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDRSS.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(brother) C:\Program Files (x86)\Brownie\BrStsW64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brownie\Brnipmon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8292120 2013-11-14] (Logitech Inc.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4971024 2014-03-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2544664 2014-03-22] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BrStsWnd] - C:\Program Files (x86)\Brownie\BrstsW64.exe [3695984 2011-03-25] (brother)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2092032 2014-02-03] (Dominik Reichl)
HKLM-x32\...\Run: [BrowserSafeguard] - "C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe"
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-3297303612-2724352440-3301426173-1000\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759496 2013-10-16] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-3297303612-2724352440-3301426173-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3297303612-2724352440-3301426173-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3297303612-2724352440-3301426173-1001\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB
AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL => "C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL" File Not Found
Startup: C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Franziska\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFBE3D8108DD1CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.awesomehp.com/?type=sc&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
SearchScopes: HKCU - D9874BF6BF9C4BC483EA64141216B580 URL = hxxp://isearch.avg.com/search?cid={102A4A09-6A85-43E8-A555-0D3AAD624C17}&mid=c55b68b2738047d0a78652fe050452d3-2f69cd91cf018a65008cf19ff25b20aa43db7b54&lang=de&ds=AVG&pr=pr&d=2012-12-03 20:46:26&v=13.2.0.4&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072&q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} - No File
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.0.5\ViProtocol.dll (AVG Secure Search)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default
FF user.js: detected! => C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\user.js
FF DefaultSearchEngine: awesomehp
FF SearchEngineOrder.3: Bing
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.0.5\\npsitesafety.dll (AVG Technologies)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\awesomehp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Quick Start - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\Extensions\quick_start@gmail.com [2014-02-26]
FF Extension: WOT - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-29]
FF Extension: Adblock Plus - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-01-03]
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\17.3.0.49
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-07]
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\extensions\quick_start@gmail.com
FF Extension: Quick Start - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\ipgk7fbd.default\extensions\quick_start@gmail.com [2014-02-26]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.awesomehp.com/?type=sc&ts=1393418864&from=adks&uid=SAMSUNGXHD103SI_S2SDJ1CB702072

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR Extension: (Google Docs) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-02]
CHR Extension: (Google Drive) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-02]
CHR Extension: (YouTube) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-02]
CHR Extension: (Extended Protection) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml [2014-02-26]
CHR Extension: (Google-Suche) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-02]
CHR Extension: (Google Wallet) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-02]
CHR Extension: (Quick Start) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-02-26]
CHR Extension: (Google Mail) - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-02]
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.1.91\avg.crx [2014-02-02]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Franziska\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv2.crx [2014-02-26]

==================== Services (Whitelisted) =================

R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1358944 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3782672 2014-02-23] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-10] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [186056 2013-10-16] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)
R2 vToolbarUpdater18.0.5; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe [1771032 2014-03-22] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-11-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [49952 2014-03-22] (AVG Technologies)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [200552 2013-10-16] (Sandboxie Holdings, LLC)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-09 19:24 - 2014-04-09 19:24 - 02157056 _____ (Farbar) C:\Users\Franziska\Downloads\FRST64 (1).exe
2014-04-09 19:24 - 2014-04-09 19:24 - 00023337 _____ () C:\Users\Franziska\Downloads\FRST.txt
2014-04-09 19:23 - 2014-04-09 19:24 - 00000000 ____D () C:\FRST
2014-04-09 19:23 - 2014-04-09 19:23 - 02157056 _____ (Farbar) C:\Users\Franziska\Downloads\FRST64.exe
2014-04-09 19:22 - 2014-04-09 19:22 - 00050477 _____ () C:\Users\Franziska\Downloads\Defogger (2).exe
2014-04-09 19:22 - 2014-04-09 19:22 - 00000480 _____ () C:\Users\Franziska\Downloads\defogger_disable.log
2014-04-09 19:22 - 2014-04-09 19:22 - 00000000 _____ () C:\Users\Franziska\defogger_reenable
2014-04-09 19:20 - 2014-04-09 19:20 - 00050477 _____ () C:\Users\Franziska\Downloads\Defogger (1).exe
2014-04-09 19:19 - 2014-04-09 19:19 - 00050477 _____ () C:\Users\Franziska\Downloads\Defogger.exe
2014-04-03 11:58 - 2014-04-03 11:58 - 02232340 _____ () C:\Users\Franziska\Downloads\fw_Speedport_W503V_TypC_v.1.10.000.bin
2014-03-26 12:01 - 2014-03-26 12:01 - 00307344 _____ () C:\Windows\Minidump\032614-35989-01.dmp
2014-03-22 19:42 - 2014-03-22 19:42 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-03-13 03:20 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 03:20 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 03:20 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 03:20 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 03:20 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 03:20 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 03:20 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 03:20 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 03:20 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 03:20 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 03:20 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 03:20 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 03:20 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 03:20 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 03:20 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 03:20 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 03:20 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 03:20 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 03:20 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 03:20 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 03:20 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 03:20 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 03:20 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 03:20 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 03:20 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 03:20 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 03:20 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 03:20 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 03:20 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 03:20 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 03:20 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 03:20 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 03:20 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 03:20 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 03:20 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 03:20 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 03:20 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 03:20 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 03:20 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 03:20 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 03:20 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 03:20 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 03:20 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 03:20 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 03:19 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 03:19 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 03:19 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 03:19 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

==================== One Month Modified Files and Folders =======

2014-04-09 19:24 - 2014-04-09 19:24 - 02157056 _____ (Farbar) C:\Users\Franziska\Downloads\FRST64 (1).exe
2014-04-09 19:24 - 2014-04-09 19:24 - 00023337 _____ () C:\Users\Franziska\Downloads\FRST.txt
2014-04-09 19:24 - 2014-04-09 19:23 - 00000000 ____D () C:\FRST
2014-04-09 19:23 - 2014-04-09 19:23 - 02157056 _____ (Farbar) C:\Users\Franziska\Downloads\FRST64.exe
2014-04-09 19:22 - 2014-04-09 19:22 - 00050477 _____ () C:\Users\Franziska\Downloads\Defogger (2).exe
2014-04-09 19:22 - 2014-04-09 19:22 - 00000480 _____ () C:\Users\Franziska\Downloads\defogger_disable.log
2014-04-09 19:22 - 2014-04-09 19:22 - 00000000 _____ () C:\Users\Franziska\defogger_reenable
2014-04-09 19:22 - 2012-12-03 21:18 - 00000000 ____D () C:\Users\Franziska
2014-04-09 19:20 - 2014-04-09 19:20 - 00050477 _____ () C:\Users\Franziska\Downloads\Defogger (1).exe
2014-04-09 19:19 - 2014-04-09 19:19 - 00050477 _____ () C:\Users\Franziska\Downloads\Defogger.exe
2014-04-09 19:17 - 2014-02-02 15:01 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-09 19:10 - 2012-12-09 21:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-09 19:09 - 2012-12-03 21:42 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-09 18:24 - 2012-12-03 21:05 - 01410397 _____ () C:\Windows\WindowsUpdate.log
2014-04-09 14:17 - 2014-02-02 15:01 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-08 18:06 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-08 18:06 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-08 18:05 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-08 18:05 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-08 18:05 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-08 17:59 - 2013-10-20 19:22 - 00000000 ___RD () C:\Users\Franziska\Dropbox
2014-04-08 17:59 - 2013-10-20 19:17 - 00000000 ____D () C:\Users\Franziska\AppData\Roaming\Dropbox
2014-04-08 17:59 - 2013-08-06 15:31 - 00000440 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-08 17:59 - 2013-02-28 19:31 - 00000332 _____ () C:\Windows\Brownie.ini
2014-04-08 17:58 - 2013-06-20 07:41 - 00033972 _____ () C:\Windows\setupact.log
2014-04-08 17:58 - 2012-12-03 21:28 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-08 17:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-06 13:28 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-04-03 11:58 - 2014-04-03 11:58 - 02232340 _____ () C:\Users\Franziska\Downloads\fw_Speedport_W503V_TypC_v.1.10.000.bin
2014-04-03 11:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-02 19:28 - 2012-12-06 22:22 - 00002434 _____ () C:\Windows\Sandboxie.ini
2014-03-26 15:12 - 2014-02-02 15:01 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-26 15:12 - 2014-02-02 15:01 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-26 12:01 - 2014-03-26 12:01 - 00307344 _____ () C:\Windows\Minidump\032614-35989-01.dmp
2014-03-26 12:01 - 2013-12-05 20:38 - 558964875 _____ () C:\Windows\MEMORY.DMP
2014-03-26 12:01 - 2013-12-05 20:38 - 00000000 ____D () C:\Windows\Minidump
2014-03-26 10:15 - 2012-12-09 21:31 - 00000000 ____D () C:\Users\Franziska\AppData\Local\Adobe
2014-03-22 23:42 - 2012-12-03 21:46 - 00000000 ____D () C:\Users\Franziska\AppData\Local\AVG Secure Search
2014-03-22 19:42 - 2014-03-22 19:42 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-03-22 19:42 - 2014-02-08 23:54 - 00000000 ____D () C:\Program Files (x86)\AVG Secure Search
2014-03-22 19:41 - 2012-12-03 21:46 - 00049952 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-03-18 17:01 - 2013-08-14 20:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 17:00 - 2012-12-06 23:20 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-13 04:19 - 2009-07-14 06:45 - 00366064 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 19:10 - 2012-12-09 21:34 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 19:10 - 2012-12-09 21:34 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 19:10 - 2012-12-09 21:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-11 18:46 - 2014-03-03 17:12 - 00000000 ____D () C:\Users\Public\Documents\VR-NetWorld

Some content of TEMP:
====================
C:\Users\Franziska\AppData\Local\Temp\BackupSetup.exe
C:\Users\Franziska\AppData\Local\Temp\oi_{8266D3AD-EC8F-402C-9588-1B8BC14DB0DD}.exe
C:\Users\Franziska\AppData\Local\Temp\rootsupd.exe
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite27879.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite30337.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite31807.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite45054.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite53709.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite81596.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite82327.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite88480.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite91011.dll
C:\Users\Franziska\AppData\Local\Temp\System.Data.SQLite91827.dll
C:\Users\Franziska\AppData\Local\Temp\TW_autoskip.exe
C:\Users\Franziska\AppData\Local\Temp\wmfdist.exe
C:\Users\Franziska\AppData\Local\Temp\wvc1dmo.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-09 09:47

==================== End Of Log ============================

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-09 19:39:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 SAMSUNG_HD103SI rev.1AQ10001 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\FRANZI~1\AppData\Local\Temp\pxtdruob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031f9000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800031f902f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\AVG Secure Search\vprot.exe[4168] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000077e41465 2 bytes [E4, 77]
.text C:\Program Files (x86)\AVG Secure Search\vprot.exe[4168] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 0000000077e414bb 2 bytes [E4, 77]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe[3172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077e41465 2 bytes [E4, 77]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe[3172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077e414bb 2 bytes [E4, 77]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE[6028] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 00000000768b6143 5 bytes JMP 000000015f2944c3
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE[6028] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 0000000076823e59 5 bytes JMP 000000015f035685
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE[6028] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 0000000076823eae 5 bytes JMP 000000015f037fde
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE[6028] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 0000000076824731 5 bytes JMP 000000015f0380e0
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE[6028] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 0000000076825dee 5 bytes JMP 000000015f04b87d
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE[2924] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 00000000768b6143 5 bytes JMP 000000015f2944c3
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE[2924] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 0000000076823e59 5 bytes JMP 000000015f035685
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE[2924] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 0000000076823eae 5 bytes JMP 000000015f037fde
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE[2924] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 0000000076824731 5 bytes JMP 000000015f0380e0
.text C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE[2924] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 0000000076825dee 5 bytes JMP 000000015f04b87d

---- Threads - GMER 2.1 ----

Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2356:1924] 000007fef79e4094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2356:2412] 000007fef79e4094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2356:3076] 000007fef5cac680
---- Processes - GMER 2.1 ----

Library C:\Users\Franziska\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Franziska\AppData\Roaming\Dropbox\bin\Dropbox.exe [4860](2014-01-03 00:45:04) 0000000004070000
Library C:\Users\Franziska\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Franziska\AppData\Roaming\Dropbox\bin\Dropbox.exe [4860](2013-10-18 23:55:02) 0000000067db0000
Library C:\Users\Franziska\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Franziska\AppData\Roaming\Dropbox\bin\Dropbox.exe [4860] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000067320000

---- EOF - GMER 2.1 ----


Ich hoffe, ich habe eure Anleitung richtig befolgt und bin dankbar für jede Hilfe.