Hallo zusammen,

folgende Problemstellung stellt sich seit einigen dar:

Zunächst fiel mir auf, dass , egal nach welchen Suchbegriffen ich in Google suche, an den ersten Positionen eigenartige webseiten angezeigt werden die nichts mit dem gesuchten Begriff zu tun haben wie z.b. "Holen Media Player"; "Sexy Russian Women"; "Ihr Video wird infiziert"; "Computer aktualisieren".

Desweiteren wird, egal auf welche Webseite ich gehe, vermehrt Werbung angzeigt, die vorher, so denke ich, vom Plugin "Adblock" entfernt wurden.

Ein dritter Punkt ist erst heute aufgetreten: Und zwar werde ich beim Internet browsen manchmal auf Werbeseiten umgeleitet.

Ich habe im folgenden die defogger, FRST, Addition, und GEMR logs hinzugefügt.

Vielen Dank schon einmal im voraus

defogger log:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:17 on 26/04/2014 (Michael)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-



FRST log:
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 03
Ran by Michael (administrator) on ACER-NB on 26-04-2014 16:20:55
Running from C:\Users\Michael\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Validity Sensors, Inc.) C:\Windows\system32\vfsFPService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Windows\PLFSetI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16334880 2009-07-28] (NVIDIA Corporation)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1115728 2009-12-15] (Dritek System Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\Run: [Google Update] => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-10-06] (Google Inc.)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_12_0_0_77_Plugin.exe [841096 2014-04-01] (Adobe Systems Incorporated)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\MountPoints2: {d426f84b-f7b1-11df-a8e5-806e6f6e6963} - E:\Setup.exe
AppInit_DLLs: C:\PROGRA~2\GSSUPP~1\ASSIST~2.DLL => C:\Program Files (x86)\GS Supporter\Assistant_x64.dll [4210176 2014-04-18] ()
Lsa: [Notification Packages] 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2C816601A588CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
SearchScopes: HKCU - {043C5167-00BB-4324-AF7E-62013FAEDACF} URL = hxxp://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {043C5167-00BB-4324-AF7E-62013FAEDACF} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.1: Web Search
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://startsear.ch/?aff=1&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e
FF Keyword.URL: hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\searchplugins\startsear.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: savee neT - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\Extensions\eaioyaie@rmdruj.org [2014-04-18]

Chrome: 
=======
CHR HomePage: hxxp://web.de/
CHR StartupUrls: "https://www.google.de/", "hxxp://web.de/", "hxxp://www.facebook.de/", "https://banking.postbank.de/rai/login", "https://bankingportal.sparkasse-rhein-neckar-nord.de/portal/portal/StartenIPSTANDARD?IID=67050505&AID=IPSTANDARD&IFLBSERVERID=IF@@023@@IF", "https://studium-intern.vwa-rhein-neckar.de/prog/studenten.php"
CHR Plugin: (Shockwave Flash) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (vShare.tv plug-in) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (ProxTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-05-13]
CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhklmhadmpdfcgimodhdapodbllnjjll [2013-05-14]
CHR Extension: (YouTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-06]
CHR Extension: (Google-Suche) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-06]
CHR Extension: (AdBlock) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-10-06]
CHR Extension: (savee neT) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcginkipodakflbicngjnhdojonbhggg [2014-04-18]
CHR Extension: (Google Wallet) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-04-26]
CHR Extension: (Google Mail) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-06]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2012-10-06]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - D:\Profil\SkypePortable\App\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-04-15]

==================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S2 SkypeUpdate; D:\Profil\SkypePortable\App\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
R2 vfsFPService; C:\Windows\system32\vfsFPService.exe [721712 2009-06-03] (Validity Sensors, Inc.)
R2 vfsFPService; C:\Windows\SysWOW64\vfsFPService.exe [599344 2009-06-03] (Validity Sensors, Inc.)
S2 e9f32388; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gssupp~1\AssistantSvc.dll",service

==================== Drivers (Whitelisted) ====================

R2 6077757b; C:\Windows\system32\drivers\regi.sys [14112 2007-04-17] (InterVideo)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S2 int15; \??\C:\Windows\SysWOW64\drivers\int15_64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-26 16:20 - 2014-04-26 16:21 - 00014707 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 16:20 - 2014-04-26 16:20 - 00000000 ____D () C:\FRST
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000476 _____ () C:\Users\Michael\Desktop\defogger_disable.log
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-22 07:33 - 2014-04-26 15:53 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 07:32 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 07:32 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 07:14 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-22 07:14 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-22 07:14 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-22 07:14 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-22 07:14 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-22 07:14 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-22 07:14 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-22 07:14 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-22 07:14 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-22 07:14 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-22 07:14 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-22 07:14 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-22 07:14 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-22 07:14 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 13:50 - 2014-04-18 13:52 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-26 15:50 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-18 13:20 - 2014-04-22 07:46 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\SuperbApp
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:19 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\InstallMate
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-09 07:34 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 07:34 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 07:34 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 07:34 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 07:34 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 07:33 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 07:33 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 07:33 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 07:33 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-03 07:08 - 2014-04-18 14:51 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

==================== One Month Modified Files and Folders =======

2014-04-26 16:21 - 2014-04-26 16:20 - 00014707 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 16:20 - 2014-04-26 16:20 - 00000000 ____D () C:\FRST
2014-04-26 16:20 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-26 16:20 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:19 - 2012-04-04 07:29 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000476 _____ () C:\Users\Michael\Desktop\defogger_disable.log
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:17 - 2010-11-24 12:09 - 00000000 ____D () C:\Users\Michael
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:56 - 2013-02-06 12:07 - 01565304 _____ () C:\Windows\WindowsUpdate.log
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-26 15:53 - 2014-04-22 07:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-26 15:50 - 2014-04-18 13:20 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-26 15:50 - 2013-10-08 19:27 - 00014239 _____ () C:\Windows\setupact.log
2014-04-26 15:50 - 2011-05-21 09:34 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-26 15:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-25 06:51 - 2014-01-22 08:08 - 00000000 ____D () C:\Users\Michael\Desktop\VWA
2014-04-25 06:37 - 2012-10-06 14:51 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA.job
2014-04-25 06:36 - 2011-05-21 09:34 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-24 19:22 - 2010-11-24 13:55 - 00697522 _____ () C:\Windows\system32\perfh007.dat
2014-04-24 19:22 - 2010-11-24 13:55 - 00149458 _____ () C:\Windows\system32\perfc007.dat
2014-04-24 19:22 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-22 07:46 - 2014-04-18 13:20 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-22 07:46 - 2013-12-15 13:06 - 00130250 _____ () C:\Windows\PFRO.log
2014-04-22 07:46 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-04-22 07:36 - 2012-10-06 14:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core.job
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 07:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 14:51 - 2014-04-03 07:08 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-18 13:52 - 2014-04-18 13:50 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\SuperbApp
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:20 - 2014-04-18 13:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-04-18 13:20 - 2011-05-21 09:34 - 00000000 ____D () C:\Users\Michael\AppData\Local\Google
2014-04-15 18:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-15 07:05 - 2012-09-29 08:35 - 00000000 ____D () C:\Users\Michael\Desktop\Arbeitssuche
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-10 07:52 - 2010-11-25 12:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:51 - 2013-08-24 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:49 - 2010-11-24 12:54 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 19:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-05 20:00 - 2011-02-17 22:26 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Skype
2014-04-05 19:31 - 2011-05-21 09:34 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-05 19:31 - 2011-05-21 09:34 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-04 07:31 - 2012-10-06 14:51 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA
2014-04-04 07:31 - 2012-10-06 14:51 - 00003710 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core
2014-04-03 09:51 - 2014-04-22 07:32 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 07:32 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 07:32 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 07:25 - 2011-01-28 08:39 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-04-03 07:25 - 2011-01-28 08:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-03 07:25 - 2011-01-28 08:38 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 07:25 - 2010-11-24 14:10 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-03 07:23 - 2010-11-24 16:08 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Media Player Classic
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-01 19:19 - 2011-05-23 06:55 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-01 18:42 - 2009-07-14 06:45 - 00340040 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 13:18

==================== End Of Log ============================
         

--- --- ---

Addition log:FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-04-2014 03
Ran by Michael at 2014-04-26 16:21:38
Running from C:\Users\Michael\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
Acer Crystal Eye Webcam (HKLM-x32\...\{7760D94E-B1B5-40A0-9AA0-ABF942108755}) (Version: 5.2.10.2 - Suyin Optronics Corp)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.615 - Adobe Systems, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.00 - Piriform)
DivX-Setup (HKLM-x32\...\DivX Setup.divx.com) (Version: 2.5.0.8 - DivX, LLC)
ElsterFormular (HKLM-x32\...\ElsterFormular 13.1.1.8531p) (Version: 13.2.0.8623 - Landesfinanzdirektion Thüringen)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
GS Supporter 1.80 (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e9f32388}) (Version:  - Certified Publisher) <==== ATTENTION
HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät (HKLM\...\{8F4884F1-488D-4738-8F71-65A378BB484C}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Officejet 6500 E710a-f Hilfe (HKLM-x32\...\{037CD593-D760-4A00-B030-7BBAFA1123FE}) (Version: 140.0.2.2 - Hewlett Packard)
HP Officejet 6500 E710n-z - Grundlegende Software für das Gerät (HKLM\...\{56F91CE8-0168-4619-8FEC-13F5087E40F8}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.210 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.02 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 26.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.5 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5983 - Realtek Semiconductor Corp.)
Room Arranger (HKLM-x32\...\Room Arranger) (Version: 7.2.4 - Jan Adamec)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.11072_11 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.11072_11 - Samsung Electronics Co., Ltd.) Hidden
Skype Toolbars (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.3.7280 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Studie zur Verbesserung von HP Officejet 6500 E710a-f Produkten (HKLM\...\{8DB5B8FE-3F8A-4D9F-911C-F85473400859}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
Subtitle Edit 3.3.12 (HKLM-x32\...\SubtitleEdit_is1) (Version: 3.3.12.2367 - Nikse)
TweakNow PerfectFrame (HKLM-x32\...\TweakNow PerfectFrame_is1) (Version: 1.0.0 - TweakNow.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Validity Sensors software (HKLM\...\{F65B8208-5221-43D9-AA12-DDEA64EC4AF6}) (Version: 2.8.120 - Validity Sensors, Inc.)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0 - DivX, Inc) Hidden
WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
Wireshark 1.10.2 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.10.2 - The Wireshark developer community, hxxp://www.wireshark.org)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {3012B88B-6351-4C1A-B25A-A84F9DCA0F86} - System32\Tasks\SN.Booster-S-1532781606 => c:\programdata\superbapp\sn.booster\SN.Booster.exe
Task: {43881501-8B48-47C9-A60E-A3AE9D76FA7E} - System32\Tasks\{72F26113-5719-478C-BEA9-7C85E3A42D1B} => Chrome.exe hxxp://ui.skype.com/ui/0/6.0.0.126/de/abandoninstall?page=tsProgressBar
Task: {6340BC67-29C8-4023-9524-3F6F238C5076} - System32\Tasks\HPCustParticipation HP Officejet 6500 E710a-f => C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {68DA9137-C525-48EB-9D2E-FC579D7D8EAA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-05-21] (Google Inc.)
Task: {7D73876F-588F-4867-B7F0-54E0B2383414} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-06] (Google Inc.)
Task: {AB092BD7-246D-4BF0-84BF-3CA273D01D03} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-06] (Google Inc.)
Task: {ABE5A3BE-08C3-4CA5-B45D-4EAB4D25452B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-01] (Adobe Systems Incorporated)
Task: {E478E9BA-D2E4-453A-8E48-AE203A362DE1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-05-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core.job => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA.job => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SN.Booster-S-1532781606.job => c:\programdata\superbapp\sn.booster\SN.Booster.exe

==================== Loaded Modules (whitelisted) =============

2010-11-24 15:56 - 2010-03-15 12:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2010-11-24 16:05 - 2009-11-20 16:34 - 00200704 _____ () C:\Windows\PLFSetI.exe
2014-04-09 07:43 - 2014-04-02 03:57 - 00065352 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-09 07:43 - 2014-04-02 03:57 - 00674632 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-09 07:43 - 2014-04-02 03:57 - 00093000 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\libegl.dll
2014-04-09 07:43 - 2014-04-02 03:57 - 04081480 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-09 07:43 - 2014-04-02 03:58 - 00390472 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-09 07:43 - 2014-04-02 03:57 - 01647432 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 01102848 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMSWrap.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00641536 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ContentDirectoryPresenter.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00105472 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMCDP.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00093696 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\FolderCDP.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00077312 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MetadataFramework.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00520234 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\sqlite3.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00450560 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MoodExtractor.dll
2010-12-16 13:09 - 2010-12-16 13:09 - 05717504 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMImgExtractor.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00028672 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AutoChaptering.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00147456 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexpat.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00012800 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoThumb.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 04671488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avcodec-52.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00070656 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avutil-50.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00686080 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avformat-52.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00152064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\swscale-0.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00028160 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AudioExtractor.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00063488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ID3Driver.dll
2010-12-16 13:09 - 2010-12-16 13:09 - 00366592 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\tag.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00289792 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libThumbnail.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00022528 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RichInfoDriver.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00018432 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoExtractor.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ThumbnailMaker.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00132608 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoMetadataDriver.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00289792 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libKeyFrame.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\SECMetaDriver.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ImageExtractor.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00023040 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\photoDriver.dll
2010-12-15 14:13 - 2010-12-15 14:13 - 00399826 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexif-12.dll.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00013824 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\TextExtractor.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00031232 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\Autobackup.dll
2011-07-13 15:43 - 2011-07-13 15:43 - 00054784 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RosettaAllShare.dll
2011-02-01 12:01 - 2011-02-01 12:01 - 00044032 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\us.dll
2014-04-09 07:43 - 2014-04-02 03:58 - 13691720 _____ () C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AllShareAgent => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Google Update => "C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============

Name: int15
Description: int15
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: int15
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: regi
Description: regi
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: regi
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/26/2014 04:00:15 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (04/25/2014 06:42:58 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (04/24/2014 08:00:21 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (04/22/2014 07:18:03 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (04/21/2014 09:39:52 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (04/20/2014 01:34:22 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (04/18/2014 04:51:12 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 90080108

Error: (04/18/2014 03:23:58 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 90080108

Error: (04/18/2014 01:24:23 PM) (Source: Application Hang) (User: )
Description: Programm SndVol.exe, Version 6.1.7601.17514 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e70

Startzeit: 01cf5af8a8388365

Endzeit: 16

Anwendungspfad: C:\Windows\system32\SndVol.exe

Berichts-ID: f6a0dade-c6eb-11e3-a9a6-00a0d1abe24e

Error: (04/18/2014 01:21:05 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005


System errors:
=============
Error: (04/26/2014 03:51:48 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (04/26/2014 03:51:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "regi" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/26/2014 03:51:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "int15" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/26/2014 03:51:16 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst GS Supporter erreicht.

Error: (04/26/2014 06:44:17 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (04/26/2014 06:43:41 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "regi" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/26/2014 06:43:41 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "int15" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/26/2014 06:43:41 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst GS Supporter erreicht.

Error: (04/25/2014 07:53:56 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (04/25/2014 07:53:27 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT AUTHORITY)
Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-04-19 21:45:24.113
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:21:47.565
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:21:24.863
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:19:49.528
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:19:17.723
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:18:23.385
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:17:47.797
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:16:51.536
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:05:42.260
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-19 20:04:26.115
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 58%
Total physical RAM: 3068.96 MB
Available physical RAM: 1271.21 MB
Total Pagefile: 6136.11 MB
Available Pagefile: 3871.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Windows7_64Bit) (Fixed) (Total:97.56 GB) (Free:20.05 GB) NTFS
Drive d: (Daten) (Fixed) (Total:200.43 GB) (Free:76.29 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 1241BD78)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=200 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---


GMER log:
GMER Logfile:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-26 16:37:57
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVT-22ZCT0 rev.11.01A11 298,09GB
Running: jtzt595v.exe; Driver: C:\Users\Michael\AppData\Local\Temp\kgldrpoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                               fffff80003204000 45 bytes [00, 00, 11, 00, 4D, 6D, 43, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                               fffff8000320402f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- Threads - GMER 2.1 ----

Thread    C:\Windows\system32\svchost.exe [956:4748]                                                       000007fef7e35124
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5064:4132]                                   000007fefb432a7c
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5064:4220]                                   000007fef0cf4830
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5064:4476]                                   000007fef7e35124

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269d2dc53                      
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269d2dc53@f8db7feee028         0xD3 0x5E 0xD3 0xB1 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269d2dc53 (not active ControlSet)  
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269d2dc53@f8db7feee028             0xD3 0x5E 0xD3 0xB1 ...

---- EOF - GMER 2.1 ----
         

--- --- ---

Beste Grüße

Mraz

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Ich bedanke mich für deine Geduld

Hallo Mraz und


Ich werde dir bei der Bereinigung des Computers helfen.

• Arbeite meine Anleitungen nacheinander ab.
• Poste deine Logs in Code-Tags: [code]Hier der Inhalt des Logs[/code]
• Bedenke, dass wir in unserer Freizeit tätig sind. Bekommst du von mir innerhalb von 2 Tagen keine Antwort, schreibe mir eine PM.

Das ist nur Adware.

Schritt 1

Klicke bitte auf den Windowsbutton in der Taskleiste und dort auf "Systemsteuerung". Wenn du dort bist, gehe auf "Programme deinstallieren" unter "Programme". Hier kannst du nun folgende Programm deinstallieren.

• GS Supporter 1.80

Schritt 2

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 4


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 5

Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Besteht noch ein Problem?

zu Schritt 1:

Deinstallieren nicht möglich, da folgende Windows Meldung erschien:
'RunDLL'
"Problem beim Starten von C:\Progra~2\GSSUPP~1\ASSIST~1.DLL"
"Das angegebene Modul wurde nicht gefunden"

Das liegt glaube ich daran, dass ich vor 3 Tagen die DLL bereits in Quarantäne geschoben habe. Sorry hatte nicht dran gedacht das hier mitzuteilen.

zu Schritt 2:

log:AdwCleaner Logfile:

# AdwCleaner v3.203 - Report created 26/04/2014 at 18:11:17
# Updated 26/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Michael - ACER-NB
# Running from : C:\Users\Michael\Desktop\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\searchplugins\Startsear.xml
Folder Found : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcginkipodakflbicngjnhdojonbhggg
Folder Found : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\Extensions\eaioyaie@rmdruj.org
Folder Found C:\ProgramData\SuperbApp
Folder Found C:\Users\Michael\AppData\Local\Ilivid Player
Folder Found C:\Users\Michael\AppData\Local\PackageAware
Folder Found C:\Users\Michael\AppData\Local\Temp\OCS
Folder Found C:\Users\Michael\AppData\Local\torch

***** [ Shortcuts ] *****


***** [ Registry ] *****

Data Found : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\GSSUPP~1\ASSIST~2.DLL
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKCU\Software\OCS
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\StartSearch
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Found : [x64] HKCU\Software\OCS
Key Found : [x64] HKCU\Software\Softonic
Key Found : [x64] HKCU\Software\StartSearch
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e9f32388}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{043C5167-00BB-4324-AF7E-62013FAEDACF}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v26.0 (de)

[ File : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\prefs.js ]

Line Found : user_pref("browser.search.defaultengine", "Web Search");
Line Found : user_pref("browser.search.defaultenginename", "Web Search");
Line Found : user_pref("browser.search.order.1", "Web Search");
Line Found : user_pref("browser.search.selectedEngine", "Web Search");
Line Found : user_pref("browser.startup.homepage", "hxxp://startsear.ch/?aff=1&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e");
Line Found : user_pref("extensions.enabledItems", "vshare@toolbar:1.0.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");
Line Found : user_pref("extensions.ipI.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"immediate-support.com\")>-1||url.indexOf(\"txtlnk[...]
Line Found : user_pref("extensions.vshare@toolbar.update.enabled", false);
Line Found : user_pref("keyword.URL", "hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q=");
Line Found : user_pref("vshare.install.date", "1306108800000");
Line Found : user_pref("vshare.install.finished", "1.0.0");
Line Found : user_pref("vshare.install.guid", "{6b9ae30b-f7ff-42d9-9d6f-f9d217c91a35}");
Line Found : user_pref("vshare.install.laststatreq", "1378857600000");
Line Found : user_pref("vshare.install.overlayVersion", 1);

-\\ Google Chrome v

[ File : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found [Search Provider] : hxxp://sportbild.bild.de/kddb/cms/websearchsport.do?query={searchTerms}
Found [Search Provider] : hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=67ece904-f29e-4f74-9c90-9548490193ea&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=25/03/2013&type=hp1000
Found [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=198DD594-F414-429E-B9E0-FF20852B3334&apn_ptnrs=U3&apn_sauid=4C93A9F7-19F6-45A6-9889-D6B664109AAE&apn_dtid=OSJ000YYDE&q={searchTerms}
Found [Extension] : lcginkipodakflbicngjnhdojonbhggg

*************************

AdwCleaner[R0].txt - [6100 octets] - [26/04/2014 18:11:17]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6160 octets] ##########
         

--- --- ---
AdwCleaner Logfile:

# AdwCleaner v3.203 - Report created 26/04/2014 at 18:16:59
# Updated 26/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Michael - ACER-NB
# Running from : C:\Users\Michael\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\SuperbApp
Folder Deleted : C:\Users\Michael\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Michael\AppData\Local\PackageAware
Folder Deleted : C:\Users\Michael\AppData\Local\torch
Folder Deleted : C:\Users\Michael\AppData\Local\Temp\OCS
Folder Deleted : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\Extensions\eaioyaie@rmdruj.org
Folder Deleted : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcginkipodakflbicngjnhdojonbhggg
File Deleted : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\searchplugins\Startsear.xml

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e9f32388}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vso-media-player_RASMANCS
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{043C5167-00BB-4324-AF7E-62013FAEDACF}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\StartSearch
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}
Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\GSSUPP~1\ASSIST~2.DLL

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v26.0 (de)

[ File : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default\prefs.js ]

Line Deleted : user_pref("browser.search.defaultengine", "Web Search");
Line Deleted : user_pref("browser.search.defaultenginename", "Web Search");
Line Deleted : user_pref("browser.search.order.1", "Web Search");
Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
Line Deleted : user_pref("browser.startup.homepage", "hxxp://startsear.ch/?aff=1&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e");
Line Deleted : user_pref("extensions.enabledItems", "vshare@toolbar:1.0.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");
Line Deleted : user_pref("extensions.ipI.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"immediate-support.com\")>-1||url.indexOf(\"txtlnk[...]
Line Deleted : user_pref("extensions.vshare@toolbar.update.enabled", false);
Line Deleted : user_pref("keyword.URL", "hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q=");
Line Deleted : user_pref("vshare.install.date", "1306108800000");
Line Deleted : user_pref("vshare.install.finished", "1.0.0");
Line Deleted : user_pref("vshare.install.guid", "{6b9ae30b-f7ff-42d9-9d6f-f9d217c91a35}");
Line Deleted : user_pref("vshare.install.laststatreq", "1378857600000");
Line Deleted : user_pref("vshare.install.overlayVersion", 1);

-\\ Google Chrome v

[ File : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://sportbild.bild.de/kddb/cms/websearchsport.do?query={searchTerms}
Deleted [Search Provider] : hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=67ece904-f29e-4f74-9c90-9548490193ea&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=25/03/2013&type=hp1000
Deleted [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=198DD594-F414-429E-B9E0-FF20852B3334&apn_ptnrs=U3&apn_sauid=4C93A9F7-19F6-45A6-9889-D6B664109AAE&apn_dtid=OSJ000YYDE&q={searchTerms}
Deleted [Extension] : lcginkipodakflbicngjnhdojonbhggg

*************************

AdwCleaner[R0].txt - [6272 octets] - [26/04/2014 18:11:17]
AdwCleaner[S0].txt - [6011 octets] - [26/04/2014 18:16:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6071 octets] ##########
         

--- --- ---


zu Schritt 3:

Bisherige Logs:

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 22.04.2014
Suchlauf-Zeit: 07:45:17
Logdatei: Anti-Malware 22.42014 7.45.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.04.22.01
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 264283
Verstrichene Zeit: 11 Min, 32 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 1
PUP.Optional.MultiPlug.A, C:\ProgramData\SuperbApp\SN.Booster\SN.Booster.exe, 3012, Löschen bei Neustart, [8acf83aab9c282b42adbc568768b8a76]

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 4
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\S-1532781606, In Quarantäne, [8acf83aab9c282b42adbc568768b8a76],
PUP.Optional.VShareRedir, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}, In Quarantäne, [3524e746e99223135a34a684758d09f7],
PUP.Optional.VShareRedir, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}, In Quarantäne, [4f0acb62cead3afc3d508b9f867c0af6],
PUP.Optional.Softonic.A, HKU\S-1-5-21-2016581021-1669485978-4134510817-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [1d3c4de04d2e142275d7422c5aa8af51],

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 2
Trojan.SProtector, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, c:\progra~2\gssupp~1\assist~1.dll, Gut: (), Schlecht: (c:\progra~2\gssupp~1\assist~1.dll),Ersetzt,[4118c865403b7fb7deec064fd52c847c]
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, c:\progra~2\gssupp~1\assist~1.dll, Gut: (), Schlecht: (c:\progra~2\gssupp~1\assist~1.dll),Ersetzt,[1742b67790eb7bbb85ab26490df5748c]

Ordner: 0
(No malicious items detected)

Dateien: 7
Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Löschen bei Neustart, [4118c865403b7fb7deec064fd52c847c],
Trojan.SProtector, C:\Program Files (x86)\GS Supporter\AssistantSvc.dll, Löschen bei Neustart, [9fbad459ee8d47ef8a4192c3f0110cf4],
PUP.Optional.MultiPlug.A, C:\ProgramData\SuperbApp\SN.Booster\SN.Booster.exe, Löschen bei Neustart, [8acf83aab9c282b42adbc568768b8a76],
PUP.Optional.InstalleRex, C:\$Recycle.Bin\S-1-5-21-2016581021-1669485978-4134510817-1000\$RGXTOQO.exe, In Quarantäne, [1f3aee3fd9a2c96d75616109f1102ed2],
PUP.Optional.Softonic, C:\Users\Michael\Downloads\SoftonicDownloader_fuer_vso-media-player.exe, In Quarantäne, [481147e663183afc2da98d729c6431cf],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\GS Supporter\Assistant.dll, Löschen bei Neustart, [1742b67790eb7bbb85ab26490df5748c],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\GS Supporter\AssistantSvc.dll, Löschen bei Neustart, [3d1c7eaf9be0a3938da4b9b60df5de22],

Physische Sektoren: 0
(No malicious items detected)


(end)

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software


Protection, 22.04.2014 07:33:07, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 22.04.2014 07:33:07, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 22.04.2014 07:33:07, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Update, 22.04.2014 07:33:10, SYSTEM, ACER-NB, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1,
Update, 22.04.2014 07:33:13, SYSTEM, ACER-NB, Manual, Malware Database, 2014.3.4.9, 2014.4.22.1,
Protection, 22.04.2014 07:33:15, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 22.04.2014 07:33:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 22.04.2014 07:33:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 22.04.2014 07:33:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 22.04.2014 07:33:52, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 22.04.2014 07:33:52, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 22.04.2014 07:33:53, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Detection, 22.04.2014 07:36:02, SYSTEM, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [1c3dea43cab105319832163f3ac71ee2]
Protection, 22.04.2014 07:36:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:36:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Detection, 22.04.2014 07:36:05, Michael, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [37225fce017a76c0f0da1d3853ae8080]
Protection, 22.04.2014 07:36:05, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:36:05, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Detection, 22.04.2014 07:36:45, Michael, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [37225fce017a76c0f0da1d3853ae8080]
Protection, 22.04.2014 07:36:45, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:36:45, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Detection, 22.04.2014 07:37:02, SYSTEM, ACER-NB, Protection, Malware Protection, File, Trojan.SProtector, C:\Program Files (x86)\GS Supporter\Assistant.dll, Quarantine, [37225fce017a76c0f0da1d3853ae8080]
Protection, 22.04.2014 07:37:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Error, 22.04.2014 07:37:02, SYSTEM, ACER-NB, Protection, DeleteFile, 5, Failed, C:\Program Files (x86)\GS Supporter\Assistant.dll,
Protection, 22.04.2014 07:47:45, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 22.04.2014 07:47:45, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 22.04.2014 07:47:45, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 22.04.2014 07:48:08, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,

(end)

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software


Protection, 25.04.2014 06:27:50, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 25.04.2014 06:27:50, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 25.04.2014 06:27:50, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 25.04.2014 06:30:27, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Update, 25.04.2014 06:56:05, SYSTEM, ACER-NB, Scheduler, Malware Database, 2014.4.24.7, 2014.4.25.1,
Protection, 25.04.2014 06:56:08, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 25.04.2014 06:56:08, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 25.04.2014 06:56:09, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 25.04.2014 06:56:34, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 25.04.2014 06:56:34, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 25.04.2014 06:56:35, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 25.04.2014 19:53:37, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 25.04.2014 19:53:37, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 25.04.2014 19:53:37, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 25.04.2014 19:56:06, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,

(end)

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software


Protection, 26.04.2014 06:43:53, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 06:43:53, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 06:43:53, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 06:45:27, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Update, 26.04.2014 06:55:56, SYSTEM, ACER-NB, Scheduler, Malware Database, 2014.4.25.1, 2014.4.25.11,
Protection, 26.04.2014 06:55:59, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 26.04.2014 06:55:59, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 06:55:59, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 06:56:04, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 26.04.2014 06:56:04, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 06:56:04, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 26.04.2014 15:51:28, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 15:51:28, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 15:51:28, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 15:52:52, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 26.04.2014 16:25:48, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 16:25:49, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 16:25:49, SYSTEM, ACER-NB, Protection, Malware Protection, Stopping,
Protection, 26.04.2014 16:26:02, SYSTEM, ACER-NB, Protection, Malware Protection, Stopped,
Protection, 26.04.2014 18:05:24, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 18:05:24, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 18:05:24, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 18:05:25, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Protection, 26.04.2014 18:10:56, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 18:10:56, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 18:10:56, SYSTEM, ACER-NB, Protection, Malware Protection, Stopping,
Protection, 26.04.2014 18:10:57, SYSTEM, ACER-NB, Protection, Malware Protection, Stopped,
Protection, 26.04.2014 18:19:16, SYSTEM, ACER-NB, Protection, Malware Protection, Starting,
Protection, 26.04.2014 18:19:16, SYSTEM, ACER-NB, Protection, Malware Protection, Started,
Protection, 26.04.2014 18:19:16, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 18:20:29, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,
Update, 26.04.2014 18:25:24, SYSTEM, ACER-NB, Manual, Malware Database, 2014.4.25.11, 2014.4.26.3,
Protection, 26.04.2014 18:25:28, SYSTEM, ACER-NB, Protection, Refresh, Starting,
Protection, 26.04.2014 18:25:28, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopping,
Protection, 26.04.2014 18:25:28, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Stopped,
Protection, 26.04.2014 18:25:34, SYSTEM, ACER-NB, Protection, Refresh, Success,
Protection, 26.04.2014 18:25:34, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Starting,
Protection, 26.04.2014 18:25:35, SYSTEM, ACER-NB, Protection, Malicious Website Protection, Started,

(end)

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 26.04.2014
Suchlauf-Zeit: 18:36:14
Logdatei: Antimalware 26.4.2014 18.40.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.04.26.03
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 266769
Verstrichene Zeit: 10 Min, 46 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

zu Schritt 4:

C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQ92UVFN\agup[1].exe Win32/TrojanDownloader.Agent.AFD Trojaner Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQ92UVFN\j[1].exe Variante von Win32/AdWare.MultiPlug.R Anwendung Gesäubert durch Löschen - in Quarantäne kopiert


zu Schritt 5:
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 03
Ran by Michael (administrator) on ACER-NB on 26-04-2014 19:57:58
Running from C:\Users\Michael\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Validity Sensors, Inc.) C:\Windows\system32\vfsFPService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
() C:\Windows\PLFSetI.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16334880 2009-07-28] (NVIDIA Corporation)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1115728 2009-12-15] (Dritek System Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\Run: [Google Update] => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-10-06] (Google Inc.)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\MountPoints2: {d426f84b-f7b1-11df-a8e5-806e6f6e6963} - E:\Setup.exe
Lsa: [Notification Packages] 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2C816601A588CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR HomePage: hxxp://web.de/
CHR StartupUrls: "https://www.google.de/", "hxxp://web.de/", "hxxp://www.facebook.de/", "https://banking.postbank.de/rai/login", "https://bankingportal.sparkasse-rhein-neckar-nord.de/portal/portal/StartenIPSTANDARD?IID=67050505&AID=IPSTANDARD&IFLBSERVERID=IF@@023@@IF", "https://studium-intern.vwa-rhein-neckar.de/prog/studenten.php"
CHR Plugin: (Shockwave Flash) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (vShare.tv plug-in) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (ProxTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-05-13]
CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhklmhadmpdfcgimodhdapodbllnjjll [2013-05-14]
CHR Extension: (YouTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-06]
CHR Extension: (Google-Suche) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-06]
CHR Extension: (AdBlock) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-10-06]
CHR Extension: (Google Wallet) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-04-26]
CHR Extension: (Google Mail) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-06]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2012-10-06]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - D:\Profil\SkypePortable\App\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-04-15]

==================== Services (Whitelisted) =================

S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S2 SkypeUpdate; D:\Profil\SkypePortable\App\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
R2 vfsFPService; C:\Windows\system32\vfsFPService.exe [721712 2009-06-03] (Validity Sensors, Inc.)
R2 vfsFPService; C:\Windows\SysWOW64\vfsFPService.exe [599344 2009-06-03] (Validity Sensors, Inc.)
S2 e9f32388; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gssupp~1\AssistantSvc.dll",service

==================== Drivers (Whitelisted) ====================

R2 6077757b; C:\Windows\system32\drivers\regi.sys [14112 2007-04-17] (InterVideo)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S2 int15; \??\C:\Windows\SysWOW64\drivers\int15_64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-26 18:49 - 2014-04-26 18:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieUserList
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieSiteList
2014-04-26 18:42 - 2014-04-26 18:42 - 00003787 _____ () C:\Users\Michael\Desktop\antimalware 26.4.2014.txt
2014-04-26 18:42 - 2014-04-26 18:42 - 00001174 _____ () C:\Users\Michael\Desktop\Antimalware 26.4.2014 18.40.txt
2014-04-26 18:41 - 2014-04-26 18:41 - 00001530 _____ () C:\Users\Michael\Desktop\Antimalware 25.4.2014.txt
2014-04-26 18:39 - 2014-04-26 18:40 - 00003532 _____ () C:\Users\Michael\Desktop\Antimalware 22.4.2014.txt
2014-04-26 18:38 - 2014-04-26 18:38 - 00003415 _____ () C:\Users\Michael\Desktop\Anti-Malware 22.42014 7.45.txt
2014-04-26 18:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-26 18:11 - 2014-04-26 18:17 - 00000000 ____D () C:\AdwCleaner
2014-04-26 18:04 - 2014-04-26 18:04 - 01330861 _____ () C:\Users\Michael\Desktop\adwcleaner.exe
2014-04-26 16:37 - 2014-04-26 16:37 - 00001753 _____ () C:\Users\Michael\Desktop\GMER.log
2014-04-26 16:29 - 2014-04-26 18:43 - 00000540 _____ () C:\Users\Michael\Desktop\Neues Textdokument.txt
2014-04-26 16:22 - 2014-04-26 16:23 - 00380416 _____ () C:\Users\Michael\Desktop\jtzt595v.exe
2014-04-26 16:21 - 2014-04-26 16:22 - 00029100 _____ () C:\Users\Michael\Desktop\Addition.txt
2014-04-26 16:20 - 2014-04-26 19:57 - 00012716 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 16:20 - 2014-04-26 19:57 - 00000000 ____D () C:\FRST
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000476 _____ () C:\Users\Michael\Desktop\defogger_disable.log
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-22 07:33 - 2014-04-26 18:25 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 07:32 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 07:32 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 07:14 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-22 07:14 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-22 07:14 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-22 07:14 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-22 07:14 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-22 07:14 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-22 07:14 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-22 07:14 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-22 07:14 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-22 07:14 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-22 07:14 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-22 07:14 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-22 07:14 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-22 07:14 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 13:50 - 2014-04-18 13:52 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-26 18:19 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-18 13:20 - 2014-04-22 07:46 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:19 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\InstallMate
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-09 07:34 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 07:34 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 07:34 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 07:34 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 07:34 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 07:33 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 07:33 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 07:33 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 07:33 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-03 07:08 - 2014-04-18 14:51 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

==================== One Month Modified Files and Folders =======

2014-04-26 19:58 - 2014-04-26 16:20 - 00012716 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 19:57 - 2014-04-26 16:20 - 00000000 ____D () C:\FRST
2014-04-26 19:36 - 2012-10-06 14:51 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA.job
2014-04-26 19:36 - 2011-05-21 09:34 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-26 19:36 - 2011-05-21 09:34 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-26 19:26 - 2013-02-06 12:07 - 01583240 _____ () C:\Windows\WindowsUpdate.log
2014-04-26 19:19 - 2012-04-04 07:29 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-26 18:49 - 2014-04-26 18:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieUserList
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieSiteList
2014-04-26 18:43 - 2014-04-26 16:29 - 00000540 _____ () C:\Users\Michael\Desktop\Neues Textdokument.txt
2014-04-26 18:42 - 2014-04-26 18:42 - 00003787 _____ () C:\Users\Michael\Desktop\antimalware 26.4.2014.txt
2014-04-26 18:42 - 2014-04-26 18:42 - 00001174 _____ () C:\Users\Michael\Desktop\Antimalware 26.4.2014 18.40.txt
2014-04-26 18:41 - 2014-04-26 18:41 - 00001530 _____ () C:\Users\Michael\Desktop\Antimalware 25.4.2014.txt
2014-04-26 18:40 - 2014-04-26 18:39 - 00003532 _____ () C:\Users\Michael\Desktop\Antimalware 22.4.2014.txt
2014-04-26 18:38 - 2014-04-26 18:38 - 00003415 _____ () C:\Users\Michael\Desktop\Anti-Malware 22.42014 7.45.txt
2014-04-26 18:25 - 2014-04-22 07:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-26 18:24 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-26 18:24 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-26 18:23 - 2010-11-24 13:55 - 00697522 _____ () C:\Windows\system32\perfh007.dat
2014-04-26 18:23 - 2010-11-24 13:55 - 00149458 _____ () C:\Windows\system32\perfc007.dat
2014-04-26 18:23 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-26 18:19 - 2014-04-18 13:20 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-26 18:18 - 2013-10-08 19:27 - 00014295 _____ () C:\Windows\setupact.log
2014-04-26 18:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-26 18:17 - 2014-04-26 18:11 - 00000000 ____D () C:\AdwCleaner
2014-04-26 18:04 - 2014-04-26 18:04 - 01330861 _____ () C:\Users\Michael\Desktop\adwcleaner.exe
2014-04-26 16:37 - 2014-04-26 16:37 - 00001753 _____ () C:\Users\Michael\Desktop\GMER.log
2014-04-26 16:23 - 2014-04-26 16:22 - 00380416 _____ () C:\Users\Michael\Desktop\jtzt595v.exe
2014-04-26 16:22 - 2014-04-26 16:21 - 00029100 _____ () C:\Users\Michael\Desktop\Addition.txt
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000476 _____ () C:\Users\Michael\Desktop\defogger_disable.log
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:17 - 2010-11-24 12:09 - 00000000 ____D () C:\Users\Michael
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-25 06:51 - 2014-01-22 08:08 - 00000000 ____D () C:\Users\Michael\Desktop\VWA
2014-04-22 07:46 - 2014-04-18 13:20 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-22 07:46 - 2013-12-15 13:06 - 00130250 _____ () C:\Windows\PFRO.log
2014-04-22 07:46 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-04-22 07:36 - 2012-10-06 14:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core.job
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 07:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 14:51 - 2014-04-03 07:08 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-18 13:52 - 2014-04-18 13:50 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:20 - 2014-04-18 13:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-04-18 13:20 - 2011-05-21 09:34 - 00000000 ____D () C:\Users\Michael\AppData\Local\Google
2014-04-15 18:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-15 07:05 - 2012-09-29 08:35 - 00000000 ____D () C:\Users\Michael\Desktop\Arbeitssuche
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-10 07:52 - 2010-11-25 12:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:51 - 2013-08-24 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:49 - 2010-11-24 12:54 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 19:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-05 20:00 - 2011-02-17 22:26 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Skype
2014-04-05 19:31 - 2011-05-21 09:34 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-05 19:31 - 2011-05-21 09:34 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-04 07:31 - 2012-10-06 14:51 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA
2014-04-04 07:31 - 2012-10-06 14:51 - 00003710 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core
2014-04-03 09:51 - 2014-04-22 07:32 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 07:32 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 07:32 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 07:25 - 2011-01-28 08:39 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-04-03 07:25 - 2011-01-28 08:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-03 07:25 - 2011-01-28 08:38 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 07:25 - 2010-11-24 14:10 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-03 07:23 - 2010-11-24 16:08 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Media Player Classic
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-01 19:19 - 2011-05-23 06:55 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-01 18:42 - 2009-07-14 06:45 - 00340040 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

Some content of TEMP:
====================
C:\Users\Michael\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 13:18

==================== End Of Log ============================
         

--- --- ---

Ist noch etwas zu tun? Vielen Dank für die Hilfe.

Grüße

Noch ein paar Reste.

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKLM-x32\...\Run: [] => [X]
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
S2 e9f32388; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gssupp~1\AssistantSvc.dll",service
2014-04-18 13:20 - 2014-04-26 18:19 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-18 13:20 - 2014-04-22 07:46 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:20 - 2014-04-18 13:19 - 00000000 ____D () C:\ProgramData\InstallMate
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2

Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

zu Schritt 1:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-04-2014 03
Ran by Michael at 2014-04-27 06:36:47 Run:1
Running from C:\Users\Michael\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=6c9f5900-12d3-11e1-aed1-00a0d1abe24e&q={searchTerms}
S2 e9f32388; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gssupp~1\AssistantSvc.dll",service
2014-04-18 13:20 - 2014-04-26 18:19 - 00000452 ____H () C:\Windows\Tasks\SN.Booster-S-1532781606.job
2014-04-18 13:20 - 2014-04-22 07:46 - 00000000 ____D () C:\Program Files (x86)\GS Supporter
2014-04-18 13:20 - 2014-04-18 13:20 - 00002698 _____ () C:\Windows\System32\Tasks\SN.Booster-S-1532781606
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\ProgramData\420b3fdb446f2a60
2014-04-18 13:20 - 2014-04-18 13:19 - 00000000 ____D () C:\ProgramData\InstallMate
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
e9f32388 => Service deleted successfully.
C:\Windows\Tasks\SN.Booster-S-1532781606.job => Moved successfully.
C:\Program Files (x86)\GS Supporter => Moved successfully.
C:\Windows\System32\Tasks\SN.Booster-S-1532781606 => Moved successfully.
C:\ProgramData\420b3fdb446f2a60 => Moved successfully.
C:\ProgramData\InstallMate => Moved successfully.

==== End of Fixlog ====


zu Schritt 2:
FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 03
Ran by Michael (administrator) on ACER-NB on 27-04-2014 06:38:37
Running from C:\Users\Michael\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Validity Sensors, Inc.) C:\Windows\system32\vfsFPService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Windows\PLFSetI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16334880 2009-07-28] (NVIDIA Corporation)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1115728 2009-12-15] (Dritek System Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\Run: [Google Update] => C:\Users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-10-06] (Google Inc.)
HKU\S-1-5-21-2016581021-1669485978-4134510817-1000\...\MountPoints2: {d426f84b-f7b1-11df-a8e5-806e6f6e6963} - E:\Setup.exe
Lsa: [Notification Packages] 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2C816601A588CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\z9qqojfl.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Michael\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR HomePage: hxxp://web.de/
CHR StartupUrls: "https://www.google.de/", "hxxp://web.de/", "hxxp://www.facebook.de/", "https://banking.postbank.de/rai/login", "https://bankingportal.sparkasse-rhein-neckar-nord.de/portal/portal/StartenIPSTANDARD?IID=67050505&AID=IPSTANDARD&IFLBSERVERID=IF@@023@@IF", "https://studium-intern.vwa-rhein-neckar.de/prog/studenten.php"
CHR Plugin: (Shockwave Flash) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Michael\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (vShare.tv plug-in) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (ProxTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-05-13]
CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhklmhadmpdfcgimodhdapodbllnjjll [2013-05-14]
CHR Extension: (YouTube) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-06]
CHR Extension: (Google-Suche) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-06]
CHR Extension: (AdBlock) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-10-06]
CHR Extension: (Google Wallet) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-04-26]
CHR Extension: (Google Mail) - C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-06]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2012-10-06]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - D:\Profil\SkypePortable\App\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-04-15]

==================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S2 SkypeUpdate; D:\Profil\SkypePortable\App\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
R2 vfsFPService; C:\Windows\system32\vfsFPService.exe [721712 2009-06-03] (Validity Sensors, Inc.)
R2 vfsFPService; C:\Windows\SysWOW64\vfsFPService.exe [599344 2009-06-03] (Validity Sensors, Inc.)

==================== Drivers (Whitelisted) ====================

R2 6077757b; C:\Windows\system32\drivers\regi.sys [14112 2007-04-17] (InterVideo)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S2 int15; \??\C:\Windows\SysWOW64\drivers\int15_64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-27 06:33 - 2014-04-27 06:34 - 00000000 ____D () C:\Users\Michael\Desktop\Log
2014-04-27 06:26 - 2014-04-27 06:26 - 00000856 _____ () C:\Windows\PFRO.log
2014-04-27 06:26 - 2014-04-27 06:26 - 00000056 _____ () C:\Windows\setupact.log
2014-04-27 06:26 - 2014-04-27 06:26 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-26 20:57 - 2014-04-26 20:57 - 00072700 _____ () C:\Users\Michael\Documents\cc_20140426_205658.reg
2014-04-26 20:54 - 2014-04-26 20:54 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-26 20:54 - 2014-04-26 20:54 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-26 20:42 - 2014-04-26 20:42 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieUserList
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieSiteList
2014-04-26 18:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-26 18:11 - 2014-04-26 18:17 - 00000000 ____D () C:\AdwCleaner
2014-04-26 18:04 - 2014-04-26 18:04 - 01330861 _____ () C:\Users\Michael\Desktop\adwcleaner.exe
2014-04-26 16:22 - 2014-04-26 16:23 - 00380416 _____ () C:\Users\Michael\Desktop\jtzt595v.exe
2014-04-26 16:21 - 2014-04-26 16:22 - 00029100 _____ () C:\Users\Michael\Desktop\Addition.txt
2014-04-26 16:20 - 2014-04-27 06:38 - 00012954 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-26 16:20 - 2014-04-27 06:38 - 00000000 ____D () C:\FRST
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-22 07:33 - 2014-04-27 06:27 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 07:32 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 07:32 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 07:14 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-22 07:14 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-22 07:14 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-22 07:14 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-22 07:14 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-22 07:14 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-22 07:14 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-22 07:14 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-22 07:14 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-22 07:14 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-22 07:14 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-22 07:14 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-22 07:14 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-22 07:14 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-22 07:14 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-22 07:14 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-22 07:14 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-22 07:14 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-22 07:14 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-22 07:14 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-22 07:14 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-22 07:14 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-22 07:14 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-22 07:14 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-22 07:14 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-22 07:14 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-22 07:14 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-22 07:14 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-22 07:14 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-22 07:14 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-22 07:14 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 13:50 - 2014-04-18 13:52 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-09 07:34 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 07:34 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 07:34 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 07:34 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 07:34 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 07:34 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 07:34 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 07:33 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 07:33 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 07:33 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 07:33 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-03 07:08 - 2014-04-18 14:51 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

==================== One Month Modified Files and Folders =======

2014-04-27 06:38 - 2014-04-26 16:20 - 00012954 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-04-27 06:38 - 2014-04-26 16:20 - 00000000 ____D () C:\FRST
2014-04-27 06:36 - 2012-10-06 14:51 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA.job
2014-04-27 06:36 - 2011-05-21 09:34 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-27 06:34 - 2014-04-27 06:33 - 00000000 ____D () C:\Users\Michael\Desktop\Log
2014-04-27 06:32 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-27 06:32 - 2009-07-14 06:45 - 00014016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-27 06:27 - 2014-04-22 07:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-27 06:26 - 2014-04-27 06:26 - 00000856 _____ () C:\Windows\PFRO.log
2014-04-27 06:26 - 2014-04-27 06:26 - 00000056 _____ () C:\Windows\setupact.log
2014-04-27 06:26 - 2014-04-27 06:26 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-27 06:26 - 2011-05-21 09:34 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-27 06:26 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-26 21:15 - 2013-02-06 12:07 - 01611012 _____ () C:\Windows\WindowsUpdate.log
2014-04-26 20:57 - 2014-04-26 20:57 - 00072700 _____ () C:\Users\Michael\Documents\cc_20140426_205658.reg
2014-04-26 20:56 - 2010-11-24 17:47 - 00000000 ____D () C:\Users\Michael\Tracing
2014-04-26 20:56 - 2010-11-24 16:08 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Media Player Classic
2014-04-26 20:55 - 2011-01-04 10:37 - 00000000 ____D () C:\Windows\Minidump
2014-04-26 20:55 - 2010-11-24 21:00 - 00000000 ____D () C:\Windows\Panther
2014-04-26 20:54 - 2014-04-26 20:54 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-26 20:54 - 2014-04-26 20:54 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-26 20:45 - 2013-05-19 08:37 - 00000000 ____D () C:\Users\Michael\Documents\Room Arranger
2014-04-26 20:44 - 2011-10-16 16:04 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-26 20:43 - 2011-10-16 16:04 - 00000000 ____D () C:\ProgramData\HP
2014-04-26 20:42 - 2014-04-26 20:42 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-26 20:19 - 2012-04-04 07:29 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieUserList
2014-04-26 18:48 - 2014-04-26 18:48 - 00000000 __SHD () C:\Users\Michael\AppData\Local\EmieSiteList
2014-04-26 18:23 - 2010-11-24 13:55 - 00697522 _____ () C:\Windows\system32\perfh007.dat
2014-04-26 18:23 - 2010-11-24 13:55 - 00149458 _____ () C:\Windows\system32\perfc007.dat
2014-04-26 18:23 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-26 18:17 - 2014-04-26 18:11 - 00000000 ____D () C:\AdwCleaner
2014-04-26 18:04 - 2014-04-26 18:04 - 01330861 _____ () C:\Users\Michael\Desktop\adwcleaner.exe
2014-04-26 16:23 - 2014-04-26 16:22 - 00380416 _____ () C:\Users\Michael\Desktop\jtzt595v.exe
2014-04-26 16:22 - 2014-04-26 16:21 - 00029100 _____ () C:\Users\Michael\Desktop\Addition.txt
2014-04-26 16:19 - 2014-04-26 16:19 - 02061824 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-04-26 16:18 - 2014-04-26 16:18 - 00000000 ____D () C:\Users\Michael\Desktop\Backup 2642014
2014-04-26 16:17 - 2014-04-26 16:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-04-26 16:17 - 2010-11-24 12:09 - 00000000 ____D () C:\Users\Michael
2014-04-26 16:16 - 2014-04-26 16:16 - 00050477 _____ () C:\Users\Michael\Desktop\Defogger.exe
2014-04-26 15:54 - 2014-04-26 15:54 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-04-25 06:51 - 2014-01-22 08:08 - 00000000 ____D () C:\Users\Michael\Desktop\VWA
2014-04-22 07:46 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-04-22 07:36 - 2012-10-06 14:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core.job
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-22 07:32 - 2014-04-22 07:32 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 07:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-22 06:58 - 2014-04-22 06:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-04-18 14:51 - 2014-04-03 07:08 - 00000000 ____D () C:\Users\Michael\Desktop\Season 3
2014-04-18 13:52 - 2014-04-18 13:50 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
2014-04-18 13:50 - 2014-04-18 13:50 - 00000000 ____D () C:\Program Files (x86)\Subtitle Edit
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Guest
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-04-18 13:20 - 2014-04-18 13:20 - 00000000 ____D () C:\Users\Administrator
2014-04-18 13:20 - 2011-05-21 09:34 - 00000000 ____D () C:\Users\Michael\AppData\Local\Google
2014-04-15 18:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-15 07:05 - 2012-09-29 08:35 - 00000000 ____D () C:\Users\Michael\Desktop\Arbeitssuche
2014-04-15 07:03 - 2014-04-15 07:03 - 00000000 ____D () C:\Users\Michael\Desktop\Konrad
2014-04-10 07:52 - 2010-11-25 12:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 07:51 - 2013-08-24 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 07:49 - 2010-11-24 12:54 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 19:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-05 20:00 - 2011-02-17 22:26 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Skype
2014-04-05 19:31 - 2011-05-21 09:34 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-05 19:31 - 2011-05-21 09:34 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-04 07:31 - 2012-10-06 14:51 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000UA
2014-04-04 07:31 - 2012-10-06 14:51 - 00003710 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2016581021-1669485978-4134510817-1000Core
2014-04-03 09:51 - 2014-04-22 07:32 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 07:32 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 07:32 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 07:25 - 2011-01-28 08:39 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-04-03 07:25 - 2011-01-28 08:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-03 07:25 - 2011-01-28 08:38 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 07:25 - 2010-11-24 14:10 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-01 19:19 - 2014-04-01 19:19 - 17879432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-01 19:19 - 2012-04-04 07:29 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-01 19:19 - 2011-05-23 06:55 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-01 18:42 - 2009-07-14 06:45 - 00340040 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-01 18:40 - 2012-05-14 07:34 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

Some content of TEMP:
====================
C:\Users\Michael\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 13:18

==================== End Of Log ============================
         

--- --- ---

--- --- ---
noch was zu tun? Soll ich eigentlich am Ende irgend eins der von dir genannten Programme zum "Schutz" behalten?

noch was zu tun?

Nur noch die letzen Schritte zum aufräumen.

Soll ich eigentlich am Ende irgend eins der von dir genannten Programme zum "Schutz" behalten?

Du kannst MBAM oder ESET behalten um regelmäßig mal zu scanen.

Updates

Klicke nun auf den Windowsbutton in der Taskleiste und dort auf "Systemsteuerung". Wenn du dort bist, gehe auf "Programme deinstallieren" unter "Programme". Deinstalliere hier alle alten Java-Versionen.

Falls du Java brauchst kannst du es wieder herunter laden:

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version (Java 7 Update 51) herunter laden.
• Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.

Wenn du zufrieden bist, kannst du mir hier gerne danken.

Ich sehe in deinen Logs nichts gefährliches mehr.

Cleanup

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

• Öffne die TFC.exe.
  Vista und Win 7 User mit Rechtsklick "als Administrator starten".
• Schließe alle anderen Programme.
• Drücke auf den Button Start.
• Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Tipps

Welches Antiviren-Programm soll ich nehmen?

Es gibt kein Antiviren-Programm, dass alle Schädlinge findet und du kannst dich nicht 100%-ig auf das Programm verlassen. Es hängt immer noch von deinem Verhalten ab. Mit dem richtigen Verhalten schützt du dich am besten davor, dass du überhaupt infiziert wirst.

• Klicke nicht auf alles blinkende oder das dich auffordert etwas herunterzuladen.
• Lasse die Finger weg von illegalen Programmen. Sie sind der Hauptgrund für infizierte Computer.
• Öffne Email-Anhänge nur von bekannten Absendern.
• Halte Java, Adobe Flash Player und andere Programme immer aktuell.

Nutze immer nur ein Antiviren Programm, da mehrere sich gegenseitig blockieren werden und es somit mehr schadet, als es nutzt. Falls du mehr als einen installiert hast, entscheide dich für einen von denen und deinstalliere die anderen. Halte außerdem dein Antiviren-Programm immer aktuell, denn durch eine veraltete Datenbank kann das Programm die neuen Infektionen nicht finden.

• Als gutes und kostenloses Antivieren Programm empfehle ich dir avast! free antivirus.
• Alternativ kannst du auch Microsoft Security Essentials nutzen.
• Wenn es auch etwas kosten darf, empfehle ich dir Emsisoft Anti-Malware.

Zusätzlich zu deinem Antiviren-Programm kannst du kannst auch regelmäßig einen On-Demand Scanner laufen lassen um dir eine zweite Meinung zu holen. Ein On-Demand Scanner läuft im Gegensatz zu einem normalem Antiviren-Programm nicht ständig mit sondern nur wenn du ihm sagst, dass er das System scannen soll.

• Malwarebytes Anti-Malware
• ESET Online Scanner
  Falls ESET Bedrohungen findet, erstelle hier einen neuen Thread und Poste uns das Log von ESET.

Was sollte ich vor dem Runterladen beachten?

• Lade dir Programme direkt vom Hersteller runter. Bei Programmen aus einer anderen Quelle wie Softonic und anderen Seiten die dir einen Downloader anbieten, werden unerwünschte Toolbars und anderer Müll mit installiert. Führe außerdem immer eine benutzerdefinierte Installation durch und entferne die Haken optionalen Programmen.
• Lass die Finger von Registry-Cleanern. Sie versprechen dir eine große Beschleunigung deines Systems obwohl das entfernen von verwaisten Registry-Schlüsseln nur wenig Perfomancegewinng bringt, wenn überhaupt etwas. Falls das Programm aber mal etwas wichtiges löscht, kannst du damit die Registry zerstören. Zerstörst du die Registry, zerstörst du Windows!

Sonstige Tipps

• Halte dein System und die Programme darauf immer aktuell. Alte Software enthält Sicherheitslücken, die dein System angreifbar machen.
• Nutze mehrere Passwörter. Falls jemand das Passwort eines Accounts von dir herausfindet hätte er Zugriff auf alle anderen Accounts.
• Öffne keine Emails von dir unbekannten Absendern. Diese Emails sind meistens Spammails die dich unter anderem auch dazu bringen wollen bestimmt Seiten zu besuchen oder Dateien bzw. Anhänge herunterzuladen.
• Achte auf die Dateiendung. In den Anhängen von Spammails wird gerne der Trick genutzt, ausführbare Dateien als harmlose Datei darzustellen, in dem sie eine Datei z.B. Rechnung.pdf.exe nennen. (Dateiendungen anzeigen lassen)
• Deaktiviere die Autorun Funktion. Damit kann Malware sich automatisch von einem USB-Stick starten, wenn man einen infizierten USB-Stick einsteckt hat. (Autorun deaktivieren)

Wenn du das Trojaner-Board unterstützten willst, kannst du gerne Spenden.
Ich wünsche dir noch eine schöne Zeit.

Hallo nocheinmal,

ein Tage war ruhe und nun heute heute hat MBAM alarm geschlagen mit folgendem log:

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 29.04.2014
Suchlauf-Zeit: 06:35:24
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.04.29.01
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 264200
Verstrichene Zeit: 19 Min, 6 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 1
PUP.Optional.SNBoost.A, HKLM\SOFTWARE\WOW6432NODE\SN.Booster, , [db3abd73b3c83df91efa007241c148b8],

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

Ich habe den Fund in die Quarantäne geschoben. Ist es was ernstes?

Nein, ist nichts ernstes. Nur Reste die MBAM davor noch nicht gelöscht hat.