unerwünschte Seiten gehen beim surfen auf

Alen2525 · 01.05.2014, 11:14

Hallo,bitte um eure Mitthilfe:
Bei surfen mit google gehen dauernd seiten oder werbung auf ,das nervt ohne ende weiss nicht wie ich den Mist wieder loskriege...eventuell über Malware oder wie?

danke im voraus
Alen

M-K-D-B · 01.05.2014, 13:27

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 4 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Alen2525 · 01.05.2014, 13:58

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-05-2014
Ran by Lenn (administrator) on LENN-PC on 01-05-2014 14:55:08
Running from C:\Users\Lenn\Downloads
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe
() C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\Monitor.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
() C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Lavasoft) C:\ProgramData\Search Protection\SearchProtection.exe
(Tobit.Software) C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung Electronics) C:\Program Files\Samsung\Kies\KiesAirMessage.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe
(Dropbox, Inc.) C:\Users\Lenn\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\OneClick.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TUDefragBackend32.exe
(Farbar) C:\Users\Lenn\Downloads\FRST (1).exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7862816 2009-10-28] (Realtek Semiconductor)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\wlangui.exe [1904640 2009-05-07] (AVM Berlin)
HKLM\...\Run: [NokiaMusic FastStart] => C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe [2192672 2010-03-04] (Nokia)
HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737360 2014-04-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [295072 2012-12-19] (RealNetworks, Inc.)
HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKLM\...\Run: [DivXUpdate] => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [559696 2013-09-27] (Lavasoft)
HKLM\...\Run: [Search Protection] => C:\ProgramData\Search Protection\SearchProtection.exe [949512 2014-02-17] (Lavasoft)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [Google Update] => C:\Users\Lenn\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-03] (Google Inc.)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [RfxSrvTray] => C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe [578560 2013-05-22] (Samsung Electronics)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [GoogleChromeAutoLaunch_C125459A4FAAD383F7DA0EEF6D2C6FBD] => C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-14] (Samsung)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2288928 2014-02-11] (IObit)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\MountPoints2: {0fb2b32c-32bf-11df-bdf4-00306735e0bd} - H:\pushinst.exe
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000\...\MountPoints2: {b304c832-351b-11df-ba6a-001a4f9dcdd4} - F:\NokiaPCIA_Autorun.exe
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Google Update] => C:\Users\Lenn\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-03] (Google Inc.)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [RfxSrvTray] => C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe [578560 2013-05-22] (Samsung Electronics)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GoogleChromeAutoLaunch_C125459A4FAAD383F7DA0EEF6D2C6FBD] => C:\Users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPDLR.exe] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-14] (Samsung)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2288928 2014-02-11] (IObit)
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0fb2b32c-32bf-11df-bdf4-00306735e0bd} - H:\pushinst.exe
HKU\S-1-5-21-3972869702-3957550254-3659153023-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {b304c832-351b-11df-ba6a-001a4f9dcdd4} - F:\NokiaPCIA_Autorun.exe
Startup: C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lenn\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - .lnk
ShortcutTarget: Tintenwarnungen überwachen - .lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x70B330D949CACB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {2E0E1FD5-B8E3-4D03-B223-0AC28770E591} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-04-29&hsimp=yhs-lavasoft&ent=ch&q={searchTerms}
SearchScopes: HKCU - {7DCA3330-EE88-4C16-8FB4-95EEF6EE1AD4} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&origin=searchplugin
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit)
BHO: WEB.DE Konfiguration - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO: CBAbzockschutz.InitToolbarBHO - {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll ()
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll ()
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Winsock: Catalog9 01 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 02 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 03 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 04 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 05 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 06 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 17 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Winsock: Catalog9 18 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\Lenn\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lenn\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lenn\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-01-20]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\ []

Chrome:
=======
CHR HomePage: hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-04-29&ent=hp&u=63C3EBA5067B6FF760C1D3535FD88A10
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: securesearch
CHR DefaultSearchProvider: SecureSearch
CHR DefaultSearchURL: hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-04-29&hsimp=yhs-lavasoft&ent=ch&q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (HQVid8.1b) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm [2014-04-02]
CHR Extension: (AdBlock) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-03-17]
CHR Extension: (RealDownloader) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2012-12-19]
CHR Extension: (MediaPlayerplus) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-04-08]
CHR Extension: (DVDVideoSoft) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-09]
CHR Extension: (Google Wallet) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-01-20]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-02-09]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [368640 2009-05-07] (AVM Berlin)
R2 CDMA Device Service; C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe [63488 2011-08-02] ()
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [387616 2009-08-10] ()
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2151200 2013-12-03] (IObit)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [503080 2010-05-04] (Nero AG)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [178720 2009-08-10] ()
R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1740600 2013-09-09] (TuneUp Software)
S2 vosr; C:\Users\Lenn\AppData\Roaming\VOPackage\VOsrv.exe [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-12-20] (AVM Berlin)
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-05-22] ()
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-12-20] (AVM GmbH)
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-03-10] (Initio Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation)
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-05-01 14:54 - 2014-05-01 14:54 - 01050624 _____ (Farbar) C:\Users\Lenn\Downloads\FRST (1).exe
2014-05-01 11:53 - 2014-05-01 11:54 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-01 11:46 - 2014-05-01 11:46 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-01 11:35 - 2014-05-01 11:35 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-05-01 11:32 - 2014-05-01 14:04 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 11:31 - 2014-05-01 11:55 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-01 11:31 - 2014-05-01 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-01 11:31 - 2014-05-01 11:55 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-01 11:31 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-01 11:31 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-01 11:30 - 2014-05-01 11:30 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.0.1000.exe
2014-05-01 11:22 - 2014-05-01 11:39 - 00054692 _____ () C:\Users\Lenn\Downloads\Addition.txt
2014-05-01 11:20 - 2014-05-01 14:55 - 00027460 _____ () C:\Users\Lenn\Downloads\FRST.txt
2014-05-01 11:19 - 2014-05-01 14:55 - 00000000 ____D () C:\FRST
2014-05-01 11:19 - 2014-05-01 11:19 - 01050624 _____ (Farbar) C:\Users\Lenn\Downloads\FRST.exe
2014-04-29 18:54 - 2014-04-29 18:54 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\LavasoftStatistics
2014-04-29 18:52 - 2014-04-29 18:52 - 00000061 _____ () C:\prefs.js
2014-04-29 18:52 - 2014-04-29 18:52 - 00000000 ____D () C:\ProgramData\Search Protection
2014-04-29 18:51 - 2014-05-01 10:42 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-04-29 18:51 - 2014-04-29 18:52 - 00000000 ____D () C:\Users\Lenn\AppData\Local\adawarebp
2014-04-29 18:51 - 2014-04-29 18:51 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\SecureSearch
2014-04-29 18:51 - 2014-04-29 18:51 - 00000000 ____D () C:\Program Files\Toolbar Cleaner
2014-04-29 18:51 - 2014-04-29 18:51 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-29 18:48 - 2014-04-29 18:48 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Lavasoft
2014-04-29 18:47 - 2014-04-29 18:47 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-29 18:46 - 2014-04-29 18:46 - 01727624 _____ () C:\Users\Lenn\Downloads\Adaware_Installer_11.1.5354.exe
2014-04-29 16:56 - 2014-05-01 10:41 - 00000112 _____ () C:\Windows\setupact.log
2014-04-29 16:56 - 2014-04-29 16:56 - 00001240 _____ () C:\Windows\PFRO.log
2014-04-29 16:56 - 2014-04-29 16:56 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-29 13:49 - 2014-04-29 13:49 - 00001190 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-04-29 13:48 - 2014-04-29 14:02 - 00002155 _____ () C:\Users\Public\Desktop\Advanced SystemCare 7.lnk
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\ProductData
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 7
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\IObit
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\Program Files\IObit
2014-04-29 13:47 - 2014-04-29 13:49 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\IObit
2014-04-29 13:47 - 2014-04-29 13:47 - 41807824 _____ (IObit ) C:\Users\Lenn\Downloads\advanced-72systemcare-setup.exe
2014-04-28 19:34 - 2014-04-02 11:18 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\system32\secman.dll
2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec
2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\Program Files\MyFree Codec
2014-04-28 19:30 - 2014-01-23 05:21 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-04-28 19:30 - 2014-01-23 05:21 - 00088576 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2014-04-19 18:20 - 2014-05-01 14:24 - 00000366 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_Lenn.job
2014-04-19 18:20 - 2014-05-01 10:43 - 00000372 _____ () C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Lenn.job
2014-04-19 18:20 - 2014-04-29 18:25 - 00000362 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_Lenn.job
2014-04-14 19:42 - 2014-04-14 19:42 - 00709352 _____ ( ) C:\Users\Lenn\Downloads\COMPUTER_BILD-Download-Manager_fuer_adwcleaner (1).exe
2014-04-09 15:34 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 15:34 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 15:34 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 15:34 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 15:34 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 15:34 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 15:34 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 15:34 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 19:09 - 2014-04-14 19:44 - 00000000 ____D () C:\AdwCleaner
2014-04-08 19:08 - 2014-04-14 19:42 - 01426178 _____ () C:\Users\Lenn\Downloads\adwcleaner.exe
2014-04-08 19:08 - 2014-04-08 19:08 - 00709352 _____ ( ) C:\Users\Lenn\Downloads\COMPUTER_BILD-Download-Manager_fuer_adwcleaner.exe
2014-04-05 19:42 - 2014-04-08 17:55 - 00001087 _____ () C:\Users\Lenn\Desktop\Continue VuuPC Installation.lnk
2014-04-05 18:44 - 2014-04-05 18:47 - 00000000 ____D () C:\Users\Lenn\Desktop\Miete C Kombi RA GA 1993
2014-04-02 19:40 - 2014-05-01 14:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-02 19:40 - 2014-04-02 19:40 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-04-02 19:39 - 2014-05-01 13:39 - 00001510 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-5.job
2014-04-02 19:38 - 2014-05-01 13:39 - 00001430 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-5.job
2014-04-02 19:38 - 2014-05-01 13:39 - 00001420 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-2.job
2014-04-02 19:38 - 2014-05-01 13:38 - 00002186 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-4.job
2014-04-02 19:38 - 2014-05-01 13:38 - 00001446 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-1.job
2014-04-02 19:38 - 2014-05-01 13:38 - 00001340 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-2.job
2014-04-02 19:38 - 2014-04-02 19:37 - 01176896 _____ (AnyProtect.com) C:\Users\Lenn\AppData\Local\nss7D41.tmp
2014-04-02 19:37 - 2014-05-01 13:38 - 00001354 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-1.job
2014-04-02 19:37 - 2014-05-01 13:37 - 00002352 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-4.job
2014-04-02 19:36 - 2014-05-01 13:38 - 00000000 ____D () C:\Program Files\MediaPlayerplus
2014-04-02 19:36 - 2014-05-01 13:37 - 00003108 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-3.job
2014-04-02 19:36 - 2014-05-01 13:37 - 00000000 ____D () C:\Program Files\HQVid8.1b
2014-04-02 19:36 - 2014-05-01 13:36 - 00002752 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-3.job
2014-04-02 19:35 - 2014-04-05 20:00 - 00000444 __RSH () C:\ProgramData\ntuser.pol
2014-04-02 19:34 - 2014-04-02 19:34 - 00442272 _____ () C:\Users\Lenn\Downloads\Setup.exe
2014-04-02 18:00 - 2014-04-02 18:00 - 00120832 _____ () C:\Users\Lenn\Downloads\PEP_März2014_Heidelberg (3).xls
2014-04-02 15:34 - 2014-04-02 15:34 - 00119808 _____ () C:\Users\Lenn\Downloads\PEP_April2014_Heidelberg (2).xls

==================== One Month Modified Files and Folders =======

2014-05-01 14:55 - 2014-05-01 11:20 - 00027460 _____ () C:\Users\Lenn\Downloads\FRST.txt
2014-05-01 14:55 - 2014-05-01 11:19 - 00000000 ____D () C:\FRST
2014-05-01 14:54 - 2014-05-01 14:54 - 01050624 _____ (Farbar) C:\Users\Lenn\Downloads\FRST (1).exe
2014-05-01 14:27 - 2010-08-03 21:52 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-01 14:25 - 2014-04-02 19:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-01 14:24 - 2014-04-19 18:20 - 00000366 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_Lenn.job
2014-05-01 14:11 - 2011-11-03 12:29 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3972869702-3957550254-3659153023-1000UA.job
2014-05-01 14:04 - 2014-05-01 11:32 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 13:39 - 2014-04-02 19:39 - 00001510 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-5.job
2014-05-01 13:39 - 2014-04-02 19:38 - 00001430 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-5.job
2014-05-01 13:39 - 2014-04-02 19:38 - 00001420 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-2.job
2014-05-01 13:38 - 2014-04-02 19:38 - 00002186 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-4.job
2014-05-01 13:38 - 2014-04-02 19:38 - 00001446 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-1.job
2014-05-01 13:38 - 2014-04-02 19:38 - 00001340 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-2.job
2014-05-01 13:38 - 2014-04-02 19:37 - 00001354 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-1.job
2014-05-01 13:38 - 2014-04-02 19:36 - 00000000 ____D () C:\Program Files\MediaPlayerplus
2014-05-01 13:37 - 2014-04-02 19:37 - 00002352 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-4.job
2014-05-01 13:37 - 2014-04-02 19:36 - 00003108 _____ () C:\Windows\Tasks\392ffcae-1e06-4ff7-a595-a4182423a160-3.job
2014-05-01 13:37 - 2014-04-02 19:36 - 00000000 ____D () C:\Program Files\HQVid8.1b
2014-05-01 13:36 - 2014-04-02 19:36 - 00002752 _____ () C:\Windows\Tasks\97fc677a-1181-48c0-a419-9dbd03a94900-3.job
2014-05-01 12:35 - 2010-03-18 20:45 - 01951954 _____ () C:\Windows\WindowsUpdate.log
2014-05-01 11:55 - 2014-05-01 11:31 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-01 11:55 - 2014-05-01 11:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-01 11:55 - 2014-05-01 11:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-01 11:54 - 2014-05-01 11:53 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-01 11:46 - 2014-05-01 11:46 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-01 11:39 - 2014-05-01 11:22 - 00054692 _____ () C:\Users\Lenn\Downloads\Addition.txt
2014-05-01 11:35 - 2014-05-01 11:35 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-05-01 11:31 - 2012-07-28 15:07 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Malwarebytes
2014-05-01 11:31 - 2012-07-28 15:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-01 11:30 - 2014-05-01 11:30 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Lenn\Downloads\mbam-setup-2.0.0.1000.exe
2014-05-01 11:22 - 2009-07-14 06:34 - 00014192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-01 11:22 - 2009-07-14 06:34 - 00014192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-01 11:19 - 2014-05-01 11:19 - 01050624 _____ (Farbar) C:\Users\Lenn\Downloads\FRST.exe
2014-05-01 11:18 - 2010-03-18 21:52 - 00002354 _____ () C:\Users\Lenn\Desktop\Google Chrome.lnk
2014-05-01 10:43 - 2014-04-19 18:20 - 00000372 _____ () C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Lenn.job
2014-05-01 10:43 - 2011-09-16 13:21 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Dropbox
2014-05-01 10:42 - 2014-04-29 18:51 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-01 10:42 - 2011-09-16 13:26 - 00000000 ___RD () C:\Users\Lenn\Dropbox
2014-05-01 10:41 - 2014-04-29 16:56 - 00000112 _____ () C:\Windows\setupact.log
2014-05-01 10:41 - 2010-08-03 21:52 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-01 10:41 - 2010-03-18 21:35 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-01 10:41 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-29 19:10 - 2011-11-03 12:29 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3972869702-3957550254-3659153023-1000Core.job
2014-04-29 18:54 - 2014-04-29 18:54 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\LavasoftStatistics
2014-04-29 18:52 - 2014-04-29 18:52 - 00000061 _____ () C:\prefs.js
2014-04-29 18:52 - 2014-04-29 18:52 - 00000000 ____D () C:\ProgramData\Search Protection
2014-04-29 18:52 - 2014-04-29 18:51 - 00000000 ____D () C:\Users\Lenn\AppData\Local\adawarebp
2014-04-29 18:51 - 2014-04-29 18:51 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\SecureSearch
2014-04-29 18:51 - 2014-04-29 18:51 - 00000000 ____D () C:\Program Files\Toolbar Cleaner
2014-04-29 18:51 - 2014-04-29 18:51 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-29 18:48 - 2014-04-29 18:48 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Lavasoft
2014-04-29 18:47 - 2014-04-29 18:47 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-29 18:46 - 2014-04-29 18:46 - 01727624 _____ () C:\Users\Lenn\Downloads\Adaware_Installer_11.1.5354.exe
2014-04-29 18:25 - 2014-04-19 18:20 - 00000362 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_Lenn.job
2014-04-29 16:56 - 2014-04-29 16:56 - 00001240 _____ () C:\Windows\PFRO.log
2014-04-29 16:56 - 2014-04-29 16:56 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-29 16:56 - 2009-10-14 05:07 - 00000000 ____D () C:\Windows\Panther
2014-04-29 14:02 - 2014-04-29 13:48 - 00002155 _____ () C:\Users\Public\Desktop\Advanced SystemCare 7.lnk
2014-04-29 14:02 - 2011-09-16 13:24 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-29 14:02 - 2011-08-29 22:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GmoteServer
2014-04-29 14:02 - 2010-09-23 18:36 - 00690688 ___SH () C:\Users\Lenn\Desktop\Thumbs.db
2014-04-29 14:02 - 2010-03-22 14:03 - 00000000 ____D () C:\Windows\Minidump
2014-04-29 13:56 - 2010-03-19 15:05 - 00000000 ____D () C:\Program Files\PDFCreator
2014-04-29 13:49 - 2014-04-29 13:49 - 00001190 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-04-29 13:49 - 2014-04-29 13:47 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\IObit
2014-04-29 13:49 - 2011-11-09 17:07 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Apple Computer
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\ProductData
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 7
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\IObit
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-04-29 13:48 - 2014-04-29 13:48 - 00000000 ____D () C:\Program Files\IObit
2014-04-29 13:47 - 2014-04-29 13:47 - 41807824 _____ (IObit ) C:\Users\Lenn\Downloads\advanced-72systemcare-setup.exe
2014-04-29 10:59 - 2012-10-23 22:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-04-29 10:59 - 2012-10-23 22:23 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-04-28 20:01 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-04-28 19:42 - 2011-09-22 21:34 - 00000000 ____D () C:\Users\Lenn\Documents\samsung
2014-04-28 19:35 - 2014-01-29 19:53 - 00001919 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2014-04-28 19:35 - 2011-01-26 16:53 - 00000000 ____D () C:\Users\Lenn\AppData\Local\Downloaded Installations
2014-04-28 19:34 - 2011-09-22 21:30 - 00000000 ____D () C:\Program Files\Samsung
2014-04-28 19:32 - 2011-09-22 21:39 - 00000000 ____D () C:\Users\Lenn\Documents\SelfMV
2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec
2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\Program Files\MyFree Codec
2014-04-28 19:31 - 2014-01-29 19:46 - 00001952 _____ () C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2014-04-14 19:44 - 2014-04-08 19:09 - 00000000 ____D () C:\AdwCleaner
2014-04-14 19:42 - 2014-04-14 19:42 - 00709352 _____ ( ) C:\Users\Lenn\Downloads\COMPUTER_BILD-Download-Manager_fuer_adwcleaner (1).exe
2014-04-14 19:42 - 2014-04-08 19:08 - 01426178 _____ () C:\Users\Lenn\Downloads\adwcleaner.exe
2014-04-11 19:56 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-04-11 18:46 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-09 21:18 - 2010-03-19 14:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 21:17 - 2013-08-15 20:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 21:14 - 2009-10-14 04:21 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 19:12 - 2012-11-13 12:53 - 00001048 _____ () C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WEB.DE.lnk
2014-04-08 19:12 - 2011-07-17 19:51 - 00001120 _____ () C:\Users\Lenn\Desktop\Internet Explorer.lnk
2014-04-08 19:12 - 2010-03-18 21:52 - 00000000 ____D () C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-08 19:12 - 2010-03-18 20:50 - 00001150 _____ () C:\Users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-04-08 19:11 - 2010-11-21 18:37 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-04-08 19:08 - 2014-04-08 19:08 - 00709352 _____ ( ) C:\Users\Lenn\Downloads\COMPUTER_BILD-Download-Manager_fuer_adwcleaner.exe
2014-04-08 17:55 - 2014-04-05 19:42 - 00001087 _____ () C:\Users\Lenn\Desktop\Continue VuuPC Installation.lnk
2014-04-05 20:00 - 2014-04-02 19:35 - 00000444 __RSH () C:\ProgramData\ntuser.pol
2014-04-05 19:37 - 2010-03-18 20:50 - 00000000 ____D () C:\Users\Lenn
2014-04-05 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\wfp
2014-04-05 19:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2014-04-05 19:35 - 2010-03-19 07:28 - 00000000 ____D () C:\ProgramData\Real
2014-04-05 19:35 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\registration
2014-04-05 18:47 - 2014-04-05 18:44 - 00000000 ____D () C:\Users\Lenn\Desktop\Miete C Kombi RA GA 1993
2014-04-03 09:51 - 2014-05-01 11:31 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-05-01 11:31 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2012-07-28 15:07 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 19:40 - 2014-04-02 19:40 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-04-02 19:40 - 2011-05-13 14:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-04-02 19:37 - 2014-04-02 19:38 - 01176896 _____ (AnyProtect.com) C:\Users\Lenn\AppData\Local\nss7D41.tmp
2014-04-02 19:35 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-04-02 19:34 - 2014-04-02 19:34 - 00442272 _____ () C:\Users\Lenn\Downloads\Setup.exe
2014-04-02 18:00 - 2014-04-02 18:00 - 00120832 _____ () C:\Users\Lenn\Downloads\PEP_März2014_Heidelberg (3).xls
2014-04-02 15:34 - 2014-04-02 15:34 - 00119808 _____ () C:\Users\Lenn\Downloads\PEP_April2014_Heidelberg (2).xls
2014-04-02 11:18 - 2014-04-28 19:34 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\system32\secman.dll

Files to move or delete:
====================
C:\ProgramData\zak_lo0i7g.pad

Some content of TEMP:
====================
C:\Users\Lenn\AppData\Local\Temp\2ef10256-c309-4d2f-98b7-9f78a902e800.exe
C:\Users\Lenn\AppData\Local\Temp\avgnt.exe
C:\Users\Lenn\AppData\Local\Temp\Execute2App.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-04-29 11:33

hier bitte...

M-K-D-B · 01.05.2014, 16:22

Servus,

Zitat:

Running from C:\Users\Lenn\Downloads

Bitte alle Tools auf dem Desktop abspeichern und von dort starten, nicht vom Downloadordner!

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Alen2525 · 01.05.2014, 17:21

Hallo,habe Combofix runtergeladen.Es kommt nach dem öffnen aber immer eine meldung das Kombofix nicht unbenannt werden kann.Und das Programm schliesst scih dann?

icrosoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.2815.1544 [GMT 2:00]
ausgeführt von:: c:\users\Lenn\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files\driver
c:\programdata\zak_lo0i7g.pad
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0\24
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0\28
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\background.html
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\chromeCoreFilesIndex.txt
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\crossriderManifest.json
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\manifest.xml
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins.json
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\1.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\102.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\103.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\104.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\119.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\13.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\14.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\17.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\177.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\179.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\180.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\182.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\183.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\19.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\191.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\207.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\21.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\22.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\223.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\231.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\232.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\242.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\246.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\28.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\4.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\47.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\64.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\72.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\78.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\80.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\91.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\93.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\plugins\97.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\userCode\background.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\extensionData\userCode\extension.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\icons\actions\1.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\icons\icon128.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\icons\icon16.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\icons\icon48.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\api\chrome.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\api\cookie.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\api\message.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\api\monitor.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\api\pageAction.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\api\pageActionBG.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\background.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\app_api.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\bg_app_api.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\consts.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\cookie_store.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\crossriderAPI.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\delegate.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\events.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\extensionDataStore.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\installer.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\logFile.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\logging.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\onBGDocumentLoad.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\popupResource\newPopup.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\popupResource\popup.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\reports.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\storageWrapper.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\updateManager.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\util.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\lib\xhr.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\main.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\js\platformVersion.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\manifest.json
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.34_0\popup.html
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\background.html
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\chromeCoreFilesIndex.txt
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\crossriderManifest.json
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\manifest.xml
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins.json
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\1.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\102.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\103.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\104.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\13.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\14.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\155.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\17.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\177.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\182.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\183.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\184.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\19.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\190.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\191.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\195.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\207.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\21.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\211.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\22.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\220.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\233.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\242.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\246.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\28.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\4.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\47.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\64.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\7.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\72.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\78.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\80.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\9.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\91.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\93.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\97.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\userCode\background.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\userCode\extension.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\icons\actions\1.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\icons\icon128.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\icons\icon16.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\icons\icon48.png
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\api\chrome.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\api\cookie.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\api\message.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\api\monitor.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\api\pageAction.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\api\pageActionBG.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\background.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\app_api.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\bg_app_api.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\consts.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\cookie_store.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\crossriderAPI.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\delegate.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\events.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\extensionDataStore.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\installer.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\logFile.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\logging.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\onBGDocumentLoad.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\popupResource\newPopup.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\popupResource\popup.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\reports.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\storageWrapper.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\updateManager.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\util.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\lib\xhr.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\main.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\js\platformVersion.js
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\manifest.json
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\popup.html
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\000214.ldb
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\000222.ldb
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\000229.log
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\CURRENT
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\LOCK
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\LOG
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\LOG.old
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\MANIFEST-000227
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000138.ldb
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000146.ldb
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000155.ldb
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000162.log
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\CURRENT
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\LOCK
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\LOG
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\LOG.old
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\MANIFEST-000160
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0.localstorage-journal
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0.localstorage
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0.localstorage-journal
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0.localstorage
c:\users\Lenn\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Lenn\AppData\Local\nss7D41.tmp
c:\users\Lenn\AppData\Roaming\AcroIEHelpe.txt
c:\users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - .lnk
c:\users\Lenn\AppData\Roaming\srvblck5.tmp
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-04-01 bis 2014-05-01 ))))))))))))))))))))))))))))))
.
.
2014-05-01 16:13 . 2014-05-01 16:13 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-05-01 16:13 . 2014-05-01 16:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-01 16:05 . 2014-05-01 16:05 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D82E2C1B-E2E8-4133-9142-4EAAC7EBF2B0}\offreg.dll
2014-05-01 14:27 . 2014-05-01 14:27 -------- d-----w- c:\programdata\UUdb
2014-05-01 09:32 . 2014-05-01 15:40 107736 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-01 09:31 . 2014-05-01 09:55 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2014-05-01 09:31 . 2014-04-03 07:51 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-01 09:31 . 2014-04-03 07:51 73432 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-01 09:19 . 2014-05-01 12:55 -------- d-----w- C:\FRST
2014-04-29 16:52 . 2014-04-29 16:52 -------- d-----w- c:\programdata\Search Protection
2014-04-29 16:52 . 2014-04-29 16:52 61 ----a-w- C:\prefs.js
2014-04-29 16:51 . 2014-04-29 16:52 -------- d-----w- c:\users\Lenn\AppData\Local\adawarebp
2014-04-29 16:51 . 2014-05-01 08:42 -------- d-----w- c:\programdata\Ad-Aware Browsing Protection
2014-04-29 16:51 . 2014-04-29 16:51 -------- d-----w- c:\program files\Toolbar Cleaner
2014-04-29 16:51 . 2014-04-29 16:51 -------- d-----w- c:\users\Lenn\AppData\Roaming\SecureSearch
2014-04-29 16:51 . 2014-04-29 16:51 -------- d-----w- c:\program files\Lavasoft
2014-04-29 16:48 . 2014-04-29 16:48 -------- d-----w- c:\users\Lenn\AppData\Roaming\Lavasoft
2014-04-29 16:47 . 2014-04-29 16:47 -------- d-----w- c:\programdata\Lavasoft
2014-04-29 11:48 . 2014-04-29 11:48 -------- d-----w- c:\programdata\ProductData
2014-04-29 11:48 . 2014-04-29 11:48 -------- d-----w- c:\programdata\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-04-29 11:48 . 2014-04-29 11:48 -------- d-----w- c:\programdata\IObit
2014-04-29 11:48 . 2014-04-29 11:48 -------- d-----w- c:\program files\IObit
2014-04-29 11:47 . 2014-04-29 11:49 -------- d-----w- c:\users\Lenn\AppData\Roaming\IObit
2014-04-29 09:05 . 2014-04-17 03:32 8050496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D82E2C1B-E2E8-4133-9142-4EAAC7EBF2B0}\mpengine.dll
2014-04-28 17:34 . 2014-04-02 09:18 144664 ----a-w- c:\windows\system32\secman.dll
2014-04-28 17:31 . 2014-04-28 17:31 -------- d-----w- c:\program files\MyFree Codec
2014-04-28 17:30 . 2014-01-23 03:21 88576 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2014-04-28 17:30 . 2014-01-23 03:21 184192 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2014-04-09 13:34 . 2014-02-04 02:07 149440 ----a-w- c:\windows\system32\drivers\storport.sys
2014-04-09 13:34 . 2014-02-04 02:07 234432 ----a-w- c:\windows\system32\drivers\msiscsi.sys
2014-04-09 13:34 . 2014-02-04 02:07 27072 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2014-04-09 13:34 . 2014-02-04 02:00 2048 ----a-w- c:\windows\system32\iologmsg.dll
2014-04-09 13:34 . 2014-01-24 02:18 1212352 ----a-w- c:\windows\system32\drivers\ntfs.sys
2014-04-09 13:34 . 2014-03-31 00:13 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-04-08 17:09 . 2014-04-14 17:44 -------- d-----w- C:\AdwCleaner
2014-04-02 17:44 . 2014-04-05 17:36 -------- d-----w- c:\program files\Uninstaller
2014-04-02 17:40 . 2014-04-02 17:40 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-02 17:36 . 2014-05-01 11:38 -------- d-----w- c:\program files\MediaPlayerplus
2014-04-02 17:36 . 2014-05-01 11:37 -------- d-----w- c:\program files\HQVid8.1b
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-29 08:59 . 2012-10-23 20:23 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-04-29 08:59 . 2012-10-23 20:23 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-04-03 07:50 . 2012-07-28 13:07 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-04-02 17:40 . 2011-05-13 12:00 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-31 07:35 . 2009-10-14 02:21 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-03-01 04:10 . 2014-03-15 11:54 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-01 03:52 . 2014-03-15 11:54 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-03-01 03:51 . 2014-03-15 11:54 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-01 03:38 . 2014-03-15 11:54 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-01 03:38 . 2014-03-15 11:54 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-01 03:37 . 2014-03-15 11:54 553472 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-01 03:31 . 2014-03-15 11:54 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-01 03:14 . 2014-03-15 11:54 4244480 ----a-w- c:\windows\system32\jscript9.dll
2014-03-01 03:00 . 2014-03-15 11:54 1964032 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-01 02:32 . 2014-03-15 11:54 1820160 ----a-w- c:\windows\system32\wininet.dll
2014-02-18 09:51 . 2014-02-18 09:51 49940480 ----a-w- c:\program files\GUT30D0.tmp
2014-02-07 01:07 . 2014-03-15 11:53 2349056 ----a-w- c:\windows\system32\win32k.sys
2014-02-04 02:04 . 2014-03-15 11:53 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-15 11:54 509440 ----a-w- c:\windows\system32\qedit.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2014-04-29 11:48 752960 ----a-w- c:\program files\IObit\IObit Uninstaller\UninstallExplorer32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
2014-03-19 18:23 116248 ----a-w- c:\program files\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll" [2014-03-19 116248]
.
[HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RfxSrvTray"="c:\program files\Tobit Radio.fx\Client\rfx-tray.exe" [2013-02-07 1838872]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"KiesAirMessage"="c:\program files\Samsung\Kies\KiesAirMessage.exe" [2013-05-22 578560]
"GoogleChromeAutoLaunch_C125459A4FAAD383F7DA0EEF6D2C6FBD"="c:\users\Lenn\AppData\Local\Google\Chrome\Application\chrome.exe" [2014-04-24 841032]
"HP Deskjet 3520 series (NET)"="c:\program files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 1837672]
"KiesPDLR.exe"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2014-02-14 845120]
"Advanced SystemCare 7"="c:\program files\IObit\Advanced SystemCare 7\ASCTray.exe" [2014-02-11 2288928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-28 7862816]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"AVMWlanClient"="c:\program files\avmwlanstick\wlangui.exe" [2009-05-07 1904640]
"NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe" [2010-03-04 2192672]
"ContentTransferWMDetector.exe"="c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe" [2009-11-19 583016]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-04-29 737360]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2012-12-19 295072]
"DivXMediaServer"="c:\program files\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2012-11-30 1263512]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2014-02-14 311616]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"MailCheck IE Broker"="c:\program files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe" [2013-10-16 1766464]
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2013-09-27 559696]
"Search Protection"="c:\programdata\Search Protection\SearchProtection.exe" [2014-02-17 949512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MailCheck IE Update"="c:\programdata\1&1 Mail & Media GmbH\MailCheck IE\Update\nss75F3.tmp\WEB.DE_MailCheck_IE_Update_2.5.1.0.exe" [2014-05-01 3095928]
.
c:\users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lenn\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN29R1G10005SY;CONNECTION=NW;MONITOR=1; [2009-7-14 44544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Photo Loader resident.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Photo Loader resident.lnk
backup=c:\windows\pss\Photo Loader resident.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Lenn^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
path=c:\users\Lenn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
backup=c:\windows\pss\Microsoft Office Groove.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-11-21 16:57 959904 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2012-11-30 02:06 1263512 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 17:36 30040 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfxsrvtray]
2013-02-07 16:38 1838872 ----a-w- c:\program files\Tobit Radio.fx\Client\rfx-tray.exe
.
R2 LiveUpdateSvc;LiveUpdate;c:\program files\IObit\LiveUpdate\LiveUpdate.exe [2013-12-03 2151200]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R2 vosr;Service Component of VO;c:\users\Lenn\AppData\Roaming\VOPackage\VOsrv.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2007-12-19 4352]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2014-01-23 88576]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2013-05-22 37344]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-01 108032]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 25112]
R3 netr28u;RT2870-USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2014-01-23 184192]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-01 37352]
S2 AdvancedSystemCareService7;Advanced SystemCare Service 7;c:\program files\IObit\Advanced SystemCare 7\ASCService.exe [2014-01-14 881952]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-04-29 430160]
S2 CDMA Device Service;CDMA Device Service;c:\program files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe [2011-08-02 63488]
S2 MBAMScheduler;MBAMScheduler;c:\program files\ Malwarebytes Anti-Malware \mbamscheduler.exe [2014-04-03 1809720]
S2 MBAMService;MBAMService;c:\program files\ Malwarebytes Anti-Malware \mbamservice.exe [2014-04-03 857912]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Radio.fx;Radio.fx Server;c:\program files\Tobit Radio.fx\Server\rfx-server.exe [2013-06-03 3999512]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [2012-11-29 38608]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [2013-09-09 1740600]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2007-12-19 265088]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-04-03 23256]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-05-01 107736]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-04-03 51416]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [2013-08-21 12320]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMPROTECTOR
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MBAMWEBACCESSCONTROL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-02 17:40]
.
2014-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-03 19:52]
.
2014-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-03 19:52]
.
2014-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3972869702-3957550254-3659153023-1000Core.job
- c:\users\Lenn\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-03 10:29]
.
2014-05-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3972869702-3957550254-3659153023-1000UA.job
- c:\users\Lenn\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-03 10:29]
.
2014-05-01 c:\windows\Tasks\ReclaimerUpdateFiles_Lenn.job
- c:\users\Lenn\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.90\agent\rnupgagent.exe [2014-04-19 13:18]
.
2014-04-29 c:\windows\Tasks\ReclaimerUpdateXML_Lenn.job
- c:\users\Lenn\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.90\agent\rnupgagent.exe [2014-04-19 13:18]
.
2014-05-01 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Lenn.job
- c:\users\Lenn\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.90\agent\rnupgagent.exe [2014-04-19 13:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube Download - c:\program files\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to Mp3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll
TCP: DhcpNameServer = 192.168.178.1
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\program files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-NokiaOviSuite2 - c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
AddRemove-Free Video Converter - c:\program files\Free Video Converter\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-05-01 18:16:45
ComboFix-quarantined-files.txt 2014-05-01 16:16
.
Vor Suchlauf: 18 Verzeichnis(se), 347.969.970.176 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 347.829.678.080 Bytes frei
.
- - End Of File - - 3641E30B4A577B364DFAACD13AAECE54
A36C5E4F47E84449FF07ED3517B43A31

sorry 'codetex'ist mir nicht geläufig....

M-K-D-B · 01.05.2014, 18:25

Zitat:

Zitat von Alen2525

sorry 'codetex'ist mir nicht geläufig....

Bitte lesen

Wie wärs, wenn du die Tools auf den Desktop verschiebst, bevor du sie startest?
Meinst du, du bekommst das hin?

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/

Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen können.
Starte die zoek.exe mit einem Doppelklick.
Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und sollte nicht 1:1 auf andere Computer übernommen werden.
Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
Code:
ATTFilter
```
FFdefaults;
CHRdefaults;
iedefaults;
emptyclsid;
autoclean;
         
```
Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
Wenn das Tool fertig ist, wird sich eine Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)

Schritt 4
Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus.
Setze dazu einen Haken bei Addition.txt rechts unten und klicke auf Scan.
Es werden zwei Logdateien erzeugt. Poste mir diese.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von Zoek,
die beiden neuen Logdateien von FRST.

unerwünschte Seiten gehen beim surfen auf

Plagegeister aller Art und deren Bekämpfung: unerwünschte Seiten gehen beim surfen auf