Deal-Finder und Java Update

Damimo · 10.05.2014, 15:09

Hallo zusammen,

seit einigen Tage bekomme ich eine Flut von Deal-Findern sobald ich ein neues Fenster öffne (egal ob IE oder Chrome, den ich als Standardbrowser verwende). Diese sind sowohl auf den innerhalb der geöffneten Seite sichtbar als auch sich auch neue (kleine) Fenster darüber öffnen und die Sicht auf die eigentliche Seite verdecken (Otto, .....)

Es öffnet sich auch ständig ein Java-Update Fenster, welches verlangt, das Update durchzuführen

Jetzt war ich schon ein wenig zu schnell und hab mir Malewarbytes - AntiMaleware heruntergeladen und bereits einen Suchlauf gestartet. Das Programm hat mir eine unendliche Lange Liste angezeigt, die ich der Anweisung nach in die Quaratäne verschoben habe. Das Problem bleibt jedoch weiterhin bestehen.

Ich hoffe, ich habe das Problem verständlich geschildert und es kann mir jemand helfen, dieses zu lösen

Ach ja, hätte ich fast vergessen, Betriebssystem ist Win7 (32bit).

Danke schon mal

Michael

Machiavelli · 10.05.2014, 16:00

Hallo und willkommen an Board, Damimo

Mein Name ist Machiavelli und werde bei Deinem Malware Problemen behilflich sein. Falls Du Dich im abgesicherten Modus befindest, würde ich Dir raten, alle Anweisungen von mir auszudrucken, um besseren Überblick auf die Gesamtsituation zu bekommen. Ich bin hier im Malwareteam und daher ist es mir möglich, kompetente Hilfe zu geben.

Damit eine Bereinigung ermöglicht werden kann, musst Du ein paar Regeln/Tipps beachten:

Malware zu entfernen ist normalerweise recht schwierig
Heutige Malware kann sich sehr gut verstecken, so kann es sein, dass es bestimmte Tools nicht sehen. Eine Neuinstallation ist daher oft das klügere.
Bitte folge meinen Anweisung bis in das kleinste Detail
Falls Du was falsches machst, wie z.B. irgendwas fixt, was nicht durch mich genehmigt wurde, kann der PC dadurch beschädigt werden. Daher folge meinen Anweisungen ganz genau
Bleibe mit mir in Kontakt, bis Deine Probleme vollständig gelöst sind
Themen, in welchen innerhalb von 4 Tagen keine Antwort gepostet wird, werden geschlossen.
Bitte lasse keine anderen Tools laufen, während ich bereinige
Wenn Du Tools wie z.B. Malwarebytes etc. ohne meines Wissens laufen lässt, kann es unter Umständen Ergebnisse verfälschen.
Ließ meine Posts vollständig durch
Falls nicht, kann das zu schwerwiegenden Problemen (z.B. PC bootet nicht mehr) führen oder der Prozess der Malwareentfernung wird länger

Zitat:

Jetzt war ich schon ein wenig zu schnell und hab mir Malewarbytes - AntiMaleware heruntergeladen und bereits einen Suchlauf gestartet. Das Programm hat mir eine unendliche Lange Liste angezeigt, die ich der Anweisung nach in die Quaratäne verschoben habe. Das Problem bleibt jedoch weiterhin bestehen.

Kannst Du mir bitte das dazugehörige Logfile posten?

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop.

Starte bitte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Standard-Ausgabe
Scanne alle User anhaken
Stelle alle Unterpunkte ein, wie auf folgenden Bild zu sehen:
Kopiere nun den Inhalt aus der folgenden Codebox in die Textbox von OTL:

Code:

ATTFilter

 netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
mpsvc.dll  
winsock.*
rpcss.dll
/md5stop
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT

Schließe alle Programme. (Wichtig)
Klicke auf den Scan Button.
Poste die Logfiles OTL.txt und Extras.txt in Deine nächste Antwort

Damimo · 11.05.2014, 11:48

Code:

ATTFilter

OTL logfile created on: 11.05.2014 12:09:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\DM\Downloads
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17041)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 42,63% Memory free
3,73 Gb Paging File | 2,19 Gb Available in Paging File | 58,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,89 Gb Total Space | 262,47 Gb Free Space | 88,11% Space Free | Partition Type: NTFS
Drive E: | 465,65 Gb Total Space | 423,05 Gb Free Space | 90,85% Space Free | Partition Type: FAT32
 
Computer Name: DM-PC | User Name: DM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014.05.11 11:59:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DM\Downloads\OTL.exe
PRC - [2014.04.24 02:33:15 | 000,841,032 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2014.04.03 09:49:12 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
PRC - [2014.04.03 09:49:12 | 000,857,912 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
PRC - [2014.04.03 09:49:06 | 006,963,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
PRC - [2014.02.03 14:23:00 | 000,777,744 | ---- | M] (Research In Motion) -- C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe
PRC - [2014.02.03 14:22:58 | 000,929,296 | ---- | M] (Research In Motion) -- C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe
PRC - [2014.01.22 11:03:30 | 001,309,696 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research in Motion\Tunnel Manager\tunmgr.exe
PRC - [2014.01.22 11:02:14 | 004,484,608 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
PRC - [2014.01.22 10:55:34 | 000,389,632 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe
PRC - [2014.01.21 14:41:16 | 000,585,728 | ---- | M] (BlackBerry Limited) -- C:\Program Files\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe
PRC - [2014.01.21 14:33:44 | 000,443,408 | ---- | M] (BlackBerry Limited) -- C:\Program Files\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2014.01.16 02:40:24 | 000,277,920 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
PRC - [2014.01.10 11:27:52 | 000,663,056 | ---- | M] () -- C:\Program Files\Common Files\Research in Motion\nginx\nginx.exe
PRC - [2013.12.21 08:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.08.02 02:52:57 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2013.03.21 15:19:46 | 001,341,664 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2013.03.21 15:19:40 | 005,078,504 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2012.11.23 04:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.06.07 12:57:23 | 000,618,496 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe
PRC - [2008.09.16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014.04.24 02:33:13 | 000,390,472 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppgooglenaclpluginchrome.dll
MOD - [2014.04.24 02:33:12 | 013,692,232 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll
MOD - [2014.04.24 02:33:10 | 004,081,480 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll
MOD - [2014.04.24 02:33:05 | 000,674,632 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
MOD - [2014.04.24 02:33:04 | 000,093,000 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\libegl.dll
MOD - [2014.04.24 02:33:03 | 001,647,432 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll
MOD - [2014.04.24 02:33:01 | 000,065,352 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
MOD - [2014.04.09 09:56:51 | 000,260,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481#\1ab52f8951c2ab97592ec25830dd5165\WindowsFormsIntegration.ni.dll
MOD - [2014.04.09 09:56:25 | 001,091,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\0bedc417d3c5dcb1c9a5f15dd733c556\System.ServiceModel.Web.ni.dll
MOD - [2014.04.09 09:56:19 | 019,693,056 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\24bf0c88c0465485f4b842df043b3f45\System.ServiceModel.ni.dll
MOD - [2014.04.09 09:55:59 | 002,997,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\1e5e19d119e04b93da3d45153abd60fd\System.IdentityModel.ni.dll
MOD - [2014.04.09 09:55:22 | 000,190,976 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\75b6a68103e1b76063d9f69b8275ae61\UIAutomationTypes.ni.dll
MOD - [2014.04.09 09:55:19 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\47e7fc401facd4a5d3f2237f16948f36\PresentationFramework-SystemXml.ni.dll
MOD - [2014.04.09 09:55:18 | 000,025,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a6349c#\c6ab75afe61e2065e65a2faa795abff9\PresentationFramework-SystemCore.ni.dll
MOD - [2014.04.08 20:52:40 | 001,889,792 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\3fe705796c6a41d4889d9001d1c56af8\System.Xaml.ni.dll
MOD - [2014.04.08 20:52:40 | 000,660,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\2053b0e14f1e64a5c5d6d1c4d01485a2\System.Transactions.ni.dll
MOD - [2014.04.08 20:52:37 | 018,813,440 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\a4b45c44490c75bc2fb22780e7ef087d\PresentationFramework.ni.dll
MOD - [2014.04.08 20:52:30 | 012,894,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f4f6ee0df2aa4189bf36e6335cb92761\System.Windows.Forms.ni.dll
MOD - [2014.04.08 20:52:26 | 011,025,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a74542efbeb46445949a39026c501132\PresentationCore.ni.dll
MOD - [2014.04.08 20:52:24 | 001,644,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\5cd2aee5e7c07227c694d89219688ab3\System.Drawing.ni.dll
MOD - [2014.04.08 20:52:23 | 000,806,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\34b53ecafa1d7ccc7ca961d722b5d983\System.ServiceModel.Internals.ni.dll
MOD - [2014.04.08 20:52:23 | 000,122,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\78652b7fa68ee058bff6a118c657f565\SMDiagnostics.ni.dll
MOD - [2014.04.08 20:52:22 | 002,825,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\f6d7bb59f318c130d68816a89335d05e\System.Runtime.Serialization.ni.dll
MOD - [2014.04.08 20:52:19 | 003,950,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\acf97bfe2a931d4a47253b26b7218991\WindowsBase.ni.dll
MOD - [2014.04.08 20:52:18 | 000,470,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\75f8bc4cf08030c4a53b6d5e0ae20046\PresentationFramework.Aero.ni.dll
MOD - [2014.04.08 20:52:15 | 007,662,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\bada32953bb6b16a53d653eae23d78dc\System.Xml.ni.dll
MOD - [2014.04.08 20:52:14 | 006,990,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\dce99d8de14d8a015313db98c72552ee\System.Core.ni.dll
MOD - [2014.04.08 20:52:10 | 010,060,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ff26cc03e6d57d8abd13b990332e67c6\System.ni.dll
MOD - [2014.04.08 20:52:10 | 000,976,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\bbc48ec4245e502ae19b0601d3799c9e\System.Configuration.ni.dll
MOD - [2014.04.08 20:52:04 | 016,953,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\ce5f61c5754789df97be8dc991c47d07\mscorlib.ni.dll
MOD - [2014.01.10 11:27:52 | 000,663,056 | ---- | M] () -- C:\Program Files\Common Files\Research in Motion\nginx\nginx.exe
MOD - [2010.06.07 12:57:23 | 000,618,496 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe
 
 
========== Services (SafeList) ==========
 
SRV - [2014.04.05 14:24:19 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2014.04.03 09:49:12 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe -- (MBAMScheduler)
SRV - [2014.04.03 09:49:12 | 000,857,912 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe -- (MBAMService)
SRV - [2014.03.06 09:38:10 | 000,108,032 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV - [2014.01.22 11:03:30 | 001,309,696 | ---- | M] (Research In Motion Limited) [Auto | Running] -- C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe -- (RIM Tunnel Service)
SRV - [2014.01.22 10:55:34 | 000,389,632 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe -- (RIM MDNS)
SRV - [2014.01.21 14:41:16 | 000,585,728 | ---- | M] (BlackBerry Limited) [On_Demand | Running] -- C:\Program Files\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe -- (BlackBerry Device Manager)
SRV - [2014.01.16 02:39:44 | 000,235,696 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe -- (McComponentHostService)
SRV - [2013.12.21 08:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013.03.21 15:19:46 | 001,341,664 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2008.09.16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | Auto | Stopped] -- C:\Windows\system32\Drivers\DgiVecp.sys -- (DgiVecp)
DRV - [2014.05.11 11:53:11 | 000,107,736 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV - [2014.04.03 09:51:14 | 000,051,416 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mwac.sys -- (MBAMWebAccessControl)
DRV - [2014.04.03 09:50:56 | 000,023,256 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2014.01.22 10:43:14 | 000,014,336 | ---- | M] (Research in Motion Limited) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimvndis6.sys -- (rimvndis)
DRV - [2013.02.14 12:21:04 | 000,171,680 | ---- | M] (ESET) [File_System | System | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2013.02.14 12:21:04 | 000,047,568 | ---- | M] (ESET) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\epfwwfp.sys -- (epfwwfp)
DRV - [2013.02.12 05:32:45 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb80236.sys -- (usbrndis6)
DRV - [2013.01.10 09:25:22 | 000,150,080 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfw.sys -- (epfw)
DRV - [2013.01.10 09:25:20 | 000,122,240 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2013.01.10 09:25:20 | 000,046,056 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\EpfwLWF.sys -- (EpfwLWF)
DRV - [2011.02.10 11:31:34 | 000,261,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1k6232.sys -- (e1kexpress)
DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 23:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010.02.03 14:36:36 | 000,232,960 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud)
DRV - [2009.09.17 11:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI)
DRV - [2009.07.14 01:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2009.07.14 00:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.02.23 13:08:26 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1399449178&from=tugs&uid=WDCXWD3200AAJS-07M0A0_WD-WCAV2X90457304573&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 22 B7 D6 50 C1 50 CF 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFB20D05F-5999-41D5-8F7E-6006C5D181EB&SearchSource=58&CUI=&UM=5&UP=SP4477FD9E-797C-4ABB-9711-355B59E74D12&q={searchTerms}&SSPV=
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014.03.31 14:33:23 | 000,000,000 | ---D | M]
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: save Net = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\filfajimlinihgepbdniccpnkbhamgaa\5.14\
CHR - Extension: Google Wallet = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Google Mail = C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [RIM PeerManager] C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe (Research In Motion Limited)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe (BlackBerry Limited)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe ()
O4 - HKCU..\Run: [BlackBerryLink.exe] C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.exe (Research In Motion)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9D823C65-B6CD-4926-ADF2-E4CA7A5026DB}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014.05.10 14:47:10 | 000,000,000 | ---D | C] -- C:\FRST
[2014.05.10 13:32:33 | 000,107,736 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys
[2014.05.10 13:31:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
[2014.05.10 13:31:39 | 000,073,432 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamchameleon.sys
[2014.05.10 13:31:39 | 000,051,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mwac.sys
[2014.05.10 13:31:39 | 000,023,256 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2014.05.10 13:31:38 | 000,000,000 | ---D | C] -- C:\Program Files\ Malwarebytes Anti-Malware 
[2014.05.10 13:31:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014.05.07 09:54:09 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Roaming\SupTab
[2014.05.07 09:54:07 | 000,000,000 | ---D | C] -- C:\Program Files\SupTab
[2014.05.07 09:53:57 | 000,000,000 | ---D | C] -- C:\ProgramData\WPM
[2014.05.06 13:23:42 | 000,000,000 | ---D | C] -- C:\ProgramData\AppReady Software
[2014.05.05 08:57:01 | 000,000,000 | ---D | C] -- C:\ProgramData\saave net
[2014.05.05 08:57:00 | 000,000,000 | ---D | C] -- C:\Program Files\saave net
[2014.05.05 08:56:46 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Local\Torch
[2014.05.05 08:56:46 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Local\Comodo
[2014.05.05 08:56:46 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Local\Chromatic Browser
[2014.05.05 08:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\a385c8f7db692ada
[2014.05.05 08:54:34 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2014.05.04 09:41:59 | 002,724,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2014.04.29 13:21:55 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Roaming\Windows Live Writer
[2014.04.29 13:21:55 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Local\Windows Live Writer
[2014.04.29 13:14:19 | 000,000,000 | -HSD | C] -- C:\Users\DM\AppData\Local\EmieUserList
[2014.04.29 13:14:19 | 000,000,000 | -HSD | C] -- C:\Users\DM\AppData\Local\EmieSiteList
[2014.04.28 09:45:01 | 000,000,000 | --SD | C] -- C:\Windows\System32\CompatTel
[2014.04.28 09:28:30 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2014.04.28 09:28:27 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2014.04.28 09:28:27 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieetwcollectorres.dll
[2014.04.28 09:28:26 | 000,524,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2014.04.28 09:28:26 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2014.04.28 09:28:26 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2014.04.28 09:28:25 | 000,367,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2014.04.28 09:28:25 | 000,244,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2014.04.28 09:28:24 | 000,646,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsSpellCheckingFacility.exe
[2014.04.28 09:28:24 | 000,592,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9diag.dll
[2014.04.28 09:28:24 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2014.04.28 09:28:24 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2014.04.28 09:28:24 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieetwcollector.exe
[2014.04.28 09:28:24 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2014.04.28 09:28:24 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieetwproxystub.dll
[2014.04.28 09:28:24 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2014.04.28 09:28:24 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\JavaScriptCollectionAgent.dll
[2014.04.28 09:28:18 | 001,967,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2014.04.28 09:28:16 | 004,254,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2014.04.27 19:41:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2014.04.27 19:40:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2014.04.27 19:40:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2014.04.27 19:40:52 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2014.04.27 19:40:45 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2014.04.27 19:40:45 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2014.04.27 19:40:45 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2014.04.27 19:40:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014.04.27 19:40:25 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2014.04.27 18:53:27 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aepdu.dll
[2014.04.27 18:53:27 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aeinv.dll
[2014.04.27 18:26:31 | 000,000,000 | ---D | C] -- C:\Users\DM\Documents\Eigene Webs
[2014.04.27 18:22:22 | 000,000,000 | ---D | C] -- C:\Users\DM\Tracing
[2014.04.27 18:20:00 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2014.04.27 18:17:34 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll
[2014.04.27 18:17:34 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll
[2014.04.27 18:17:34 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll
[2014.04.27 18:17:33 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll
[2014.04.27 18:17:07 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll
[2014.04.27 18:16:43 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll
[2014.04.27 18:16:21 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SkyDrive
[2014.04.27 18:16:18 | 000,000,000 | R--D | C] -- C:\Users\DM\SkyDrive
[2014.04.27 18:15:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2014.04.27 18:15:08 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Local\Windows Live
[2014.04.27 18:15:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2014.04.16 10:54:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetObjects
[2014.04.16 10:53:30 | 001,056,768 | ---- | C] (Blue Sky Software Corporation.) -- C:\Windows\System32\ROBOEX32.DLL
[2014.04.16 10:53:30 | 000,049,152 | ---- | C] (Blue Sky Software Corporation.) -- C:\Windows\System32\INETWH32.DLL
[2014.04.16 10:53:25 | 000,000,000 | ---D | C] -- C:\Program Files\NetObjects
[2014.04.16 10:50:21 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[2014.04.16 10:46:40 | 000,000,000 | ---D | C] -- C:\Users\DM\Desktop\NetObjects
[2014.04.15 09:35:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\MRT
[2014.04.14 09:29:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2014.04.14 09:29:04 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2014.04.13 11:23:49 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Roaming\TuneUp Software
[2014.04.13 11:22:23 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2014.04.13 11:22:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
[2014.04.13 11:22:16 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2014.04.13 11:14:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2014.04.13 11:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
[2014.04.13 11:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2014.04.13 11:12:40 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Roaming\DVDVideoSoft
[2014.04.13 11:12:39 | 000,000,000 | ---D | C] -- C:\Users\DM\AppData\Local\Programs
[2014.04.11 19:39:21 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2014.04.11 19:39:17 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014.05.11 11:59:40 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.05.11 11:59:40 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.05.11 11:58:21 | 000,698,688 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2014.05.11 11:58:21 | 000,653,526 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2014.05.11 11:58:21 | 000,148,828 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2014.05.11 11:58:21 | 000,121,398 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2014.05.11 11:53:15 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014.05.11 11:53:11 | 000,107,736 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys
[2014.05.11 11:52:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.05.11 11:52:27 | 1503,055,872 | -HS- | M] () -- C:\hiberfil.sys
[2014.05.10 15:39:01 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014.05.10 13:31:43 | 000,001,027 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2014.05.08 10:13:55 | 000,002,088 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014.05.05 08:53:53 | 000,000,020 | ---- | M] () -- C:\Windows\¬ôœ
[2014.04.29 14:34:22 | 002,724,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2014.04.27 19:40:40 | 000,094,632 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2014.04.27 19:40:35 | 000,264,616 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2014.04.27 19:40:35 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2014.04.27 19:40:34 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2014.04.27 18:19:36 | 000,000,020 | ---- | M] () -- C:\Windows\8ôt
[2014.04.16 10:54:04 | 000,002,129 | ---- | M] () -- C:\Users\Public\Desktop\NetObjects Fusion Essentials.lnk
[2014.04.14 09:29:13 | 000,001,979 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2014.04.14 09:29:11 | 000,001,979 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2014.04.14 04:11:39 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\aepdu.dll
[2014.04.14 04:07:19 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\aeinv.dll
[2014.04.13 11:14:21 | 000,002,239 | ---- | M] () -- C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014.05.10 13:31:43 | 000,001,027 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2014.05.05 08:53:52 | 000,000,020 | ---- | C] () -- C:\Windows\¬ôœ
[2014.04.27 18:19:35 | 000,000,020 | ---- | C] () -- C:\Windows\8ôt
[2014.04.16 10:54:04 | 000,002,129 | ---- | C] () -- C:\Users\Public\Desktop\NetObjects Fusion Essentials.lnk
[2014.04.13 11:14:21 | 000,002,239 | ---- | C] () -- C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
[2014.04.11 19:39:17 | 000,001,979 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2014.04.11 19:39:17 | 000,001,979 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2014.04.05 13:55:01 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2014.04.05 13:30:25 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2014.03.13 11:11:05 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2014.03.13 11:11:04 | 000,870,560 | ---- | C] () -- C:\Windows\System32\igkrng575.bin
[2014.03.13 11:11:04 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2014.03.13 11:10:53 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin
[2014.03.13 11:10:53 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2014.03.13 11:10:48 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin
[2014.03.13 11:10:43 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 03:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Custom Scans ==========
 
========== Base Services ==========
SRV - [2009.07.14 03:14:53 | 000,062,464 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\aelupsvc.dll -- (AeLookupSvc)
SRV - [2013.02.27 06:49:16 | 000,047,104 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\appinfo.dll -- (Appinfo)
SRV - [2009.07.14 03:14:11 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\alg.exe -- (ALG)
SRV - [2010.11.20 23:29:08 | 000,585,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\qmgr.dll -- (BITS)
SRV - [2010.11.20 23:29:12 | 000,494,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\BFE.DLL -- (BFE)
SRV - [2013.09.25 02:49:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\lsass.exe -- (KeyIso)
SRV - [2009.07.14 03:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\es.dll -- (EventSystem)
SRV - [2012.07.04 23:14:34 | 000,102,912 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\browser.dll -- (Browser)
SRV - [2013.07.09 06:46:31 | 000,140,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\cryptsvc.dll -- (CryptSvc)
SRV - [2010.11.20 23:29:12 | 000,376,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\rpcss.dll -- (DcomLaunch)
SRV - [2010.11.20 23:29:12 | 000,254,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
SRV - [2011.03.03 07:38:01 | 000,132,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dnsrslvr.dll -- (Dnscache)
SRV - [2009.07.14 03:15:13 | 000,098,304 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\eapsvc.dll -- (EapHost)
SRV - [2009.07.14 03:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\hidserv.dll -- (hidserv)
SRV - [2009.07.14 03:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)
SRV - [2010.11.20 23:29:07 | 000,350,208 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\IPSECSVC.DLL -- (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV - [2009.07.14 03:16:15 | 000,313,856 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\swprv.dll -- (swprv)
SRV - [2009.07.14 03:15:41 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\mmcss.dll -- (MMCSS)
SRV - [2009.07.14 03:16:03 | 000,280,576 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\netman.dll -- (Netman)
SRV - [2009.07.14 03:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\netprofm.dll -- (netprofm)
SRV - [2012.10.03 18:42:26 | 000,242,176 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\nlasvc.dll -- (NlaSvc)
SRV - [2009.07.14 03:16:11 | 000,019,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\nsisvc.dll -- (nsi)
SRV - [2011.05.24 12:44:59 | 000,293,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpnpmgr.dll -- (PlugPlay)
SRV - [2012.02.11 07:37:49 | 000,317,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\spoolsv.exe -- (Spooler)
SRV - [2013.09.25 02:49:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\lsass.exe -- (ProtectedStorage)
No service found with a name of EMDMgmt
SRV - [2009.07.14 03:16:12 | 000,090,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\rasauto.dll -- (RasAuto)
SRV - [2010.11.20 23:29:24 | 000,286,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\rasmans.dll -- (RasMan)
SRV - [2010.11.20 23:29:12 | 000,376,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\rpcss.dll -- (RpcSs)
SRV - [2009.07.14 03:16:13 | 000,021,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\seclogon.dll -- (seclogon)
SRV - [2013.09.25 02:49:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\lsass.exe -- (SamSs)
SRV - [2009.07.14 03:16:20 | 000,073,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wscsvc.dll -- (wscsvc)
SRV - [2010.11.20 23:29:07 | 000,168,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\srvsvc.dll -- (LanmanServer)
SRV - [2010.11.20 23:29:12 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\shsvcs.dll -- (ShellHWDetection)
No service found with a name of slsvc
SRV - [2010.11.20 23:29:21 | 000,750,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\schedsvc.dll -- (Schedule)
SRV - [2010.11.20 23:29:07 | 000,242,176 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\tapisrv.dll -- (TapiSrv)
SRV - [2009.07.14 03:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
SRV - [2012.05.01 06:44:12 | 000,164,352 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\profsvc.dll -- (ProfSvc)
SRV - [2010.11.20 23:29:12 | 001,025,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\VSSVC.exe -- (VSS)
SRV - [2010.11.20 23:29:07 | 000,473,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\audiosrv.dll -- (Audiosrv)
SRV - [2010.11.20 23:29:07 | 000,473,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\audiosrv.dll -- (AudioEndpointBuilder)
SRV - [2010.11.20 23:29:49 | 000,125,952 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\sdrsvc.dll -- (SDRSVC)
SRV - [2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2010.11.20 23:29:11 | 001,086,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wevtsvc.dll -- (eventlog)
SRV - [2010.11.20 23:29:06 | 000,566,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\MPSSVC.dll -- (MpsSvc)
SRV - [2010.11.20 23:29:41 | 000,463,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wiaservc.dll -- (StiSvc)
SRV - [2010.11.20 23:29:20 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\msiexec.exe -- (msiserver)
SRV - [2009.07.14 03:16:19 | 000,168,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wbem\WMIsvc.dll -- (Winmgmt)
SRV - [2012.06.03 00:19:17 | 001,933,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wuaueng.dll -- (wuauserv)
SRV - [2010.11.20 23:29:20 | 000,214,016 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\dot3svc.dll -- (dot3svc)
SRV - [2009.07.14 03:16:19 | 000,829,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wlansvc.dll -- (Wlansvc)
SRV - [2010.11.20 23:29:07 | 000,084,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wkssvc.dll -- (LanmanWorkstation)
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2010.11.20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
 
< MD5 for: MPSVC.DLL  >
[2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) MD5=082CF481F659FAE0DE51AD060881EB47 -- C:\Program Files\Windows Defender\MpSvc.dll
[2013.05.27 06:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) MD5=082CF481F659FAE0DE51AD060881EB47 -- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.18170_none_597f1ba5b6a5991f\MpSvc.dll
[2013.05.27 06:29:30 | 000,680,960 | ---- | M] (Microsoft Corporation) MD5=0A4C23D8D5B7A376C6C51EC72F3CB8AA -- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.22341_none_5a2a2a64cfa9fb94\MpSvc.dll
[2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) MD5=3FAE8F94296001C32EAB62CD7D82E0FD -- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_59c41ab5b67131d0\MpSvc.dll
 
< MD5 for: QMGR.DLL  >
[2010.11.20 23:29:08 | 000,585,728 | ---- | M] (Microsoft Corporation) MD5=E585445D5021971FAE10393F0F1C3961 -- C:\Windows\System32\qmgr.dll
[2010.11.20 23:29:08 | 000,585,728 | ---- | M] (Microsoft Corporation) MD5=E585445D5021971FAE10393F0F1C3961 -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.1.7601.17514_none_25982ed857b42497\qmgr.dll
 
< MD5 for: RPCSS.DLL  >
[2010.11.20 23:29:12 | 000,376,832 | ---- | M] (Microsoft Corporation) MD5=7660F01D3B38ACA1747E397D21D790AF -- C:\Windows\System32\rpcss.dll
[2010.11.20 23:29:12 | 000,376,832 | ---- | M] (Microsoft Corporation) MD5=7660F01D3B38ACA1747E397D21D790AF -- C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll
 
< MD5 for: SERVICES  >
[2009.06.10 23:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\System32\drivers\etc\services
[2009.06.10 23:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_045b589158ae90da\services
 
< MD5 for: SERVICES.ASFX  >
[2013.12.21 08:04:32 | 000,002,675 | ---- | M] () MD5=F9E81A4C2C84268EE7437424514D0D8D -- C:\Program Files\Adobe\Reader 11.0\Reader\Locale\de_DE\Services\Services.asfx
 
< MD5 for: SERVICES.ASFX22  >
[2012.09.23 20:43:44 | 000,002,677 | R--- | M] () MD5=22FEEF662B7E813F8547E1446EBC706B -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\services.asfx22
 
< MD5 for: SERVICES.CFG  >
[2012.09.23 20:43:36 | 000,603,848 | R--- | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\services.cfg
[2013.12.21 08:04:16 | 000,559,392 | ---- | M] () MD5=F9FBA73F44366AB3514BD1985707F178 -- C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg
 
< MD5 for: SERVICES.CNF  >
[2014.04.27 18:26:31 | 000,000,003 | ---- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 -- C:\Users\DM\Documents\Eigene Webs\_vti_pvt\services.cnf
 
< MD5 for: SERVICES.EXE  >
[2009.07.14 03:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\System32\services.exe
[2009.07.14 03:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
 
< MD5 for: SERVICES.EXE.MUI  >
[2010.11.21 02:45:43 | 000,019,456 | ---- | M] (Microsoft Corporation) MD5=5BB3A4AC670D245257DBA6C397DF2EEB -- C:\Windows\System32\de-DE\services.exe.mui
[2010.11.21 02:45:43 | 000,019,456 | ---- | M] (Microsoft Corporation) MD5=5BB3A4AC670D245257DBA6C397DF2EEB -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c0e2c741986ab76d\services.exe.mui
 
< MD5 for: SERVICES.HTML  >
[2009.05.16 08:56:28 | 000,003,445 | ---- | M] () MD5=8D52F5D2A85A7D9927EB08D4E899585E -- C:\Program Files\NetObjects\NetObjects Fusion Essentials\NetObjects System\Fsi\SiteWizard\Templates\html\services.html
[2009.05.16 08:51:58 | 000,003,910 | ---- | M] () MD5=D4273FA51A13FC214B9BE55607BF6513 -- C:\Program Files\NetObjects\NetObjects Fusion Essentials\NetObjects System\Fsi\InitService\Services.html
 
< MD5 for: SERVICES.LNK  >
[2009.07.14 06:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009.07.14 06:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
 
< MD5 for: SERVICES.MOF  >
[2009.06.10 23:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\System32\wbem\services.mof
[2009.06.10 23:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.mof
 
< MD5 for: SERVICES.MSC  >
[2009.06.10 23:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\services.msc
[2009.06.10 23:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc
[2010.11.21 02:45:42 | 000,092,744 | ---- | M] () MD5=7FC1BD72E9D0E622638C4620E33FAD47 -- C:\Windows\System32\de-DE\services.msc
[2010.11.21 02:45:42 | 000,092,744 | ---- | M] () MD5=7FC1BD72E9D0E622638C4620E33FAD47 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fb24972d6ed45160\services.msc
 
< MD5 for: SERVICES.PTXML  >
[2009.07.13 22:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\System32\wdi\perftrack\Services.ptxml
[2009.07.13 22:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\Services.ptxml
 
< MD5 for: SERVICES.TXT  >
[2009.05.16 08:51:58 | 000,000,507 | ---- | M] () MD5=F3F922CA43527B08501D6EC023922527 -- C:\Program Files\NetObjects\NetObjects Fusion Essentials\NetObjects System\Fsi\InitService\services.txt
 
< MD5 for: SVCHOST.EXE  >
[2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\System32\svchost.exe
[2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2014.04.03 09:49:02 | 000,742,200 | ---- | M] (MalwareBytes) MD5=96820649733BFB2B0499C371904B7B40 -- C:\Program Files\ Malwarebytes Anti-Malware \Chameleon\Windows\svchost.exe
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2014.04.03 09:49:02 | 000,742,200 | ---- | M] (MalwareBytes) MD5=96820649733BFB2B0499C371904B7B40 -- C:\Program Files\ Malwarebytes Anti-Malware \Chameleon\Windows\winlogon.exe
 
< MD5 for: WINSOCK.DLL  >
[2009.07.13 23:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\System32\WINSOCK.DLL
[2009.07.13 23:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7601.17514_none_0014e305d0cff0a7\WINSOCK.DLL
 
< dir "%systemdrive%\*" /S /A:L /C >
 Datentr„ger in Laufwerk C: ist Windows
 Volumeseriennummer: F6E7-19C5
 Verzeichnis von C:\
14.07.2009  06:53    <VERBINDUNG>   Documents and Settings [C:\Users]
05.04.2014  13:16    <VERBINDUNG>   Dokumente und Einstellungen [C:\Users]
05.04.2014  13:16    <VERBINDUNG>   Programme [C:\Program Files]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Program Files
05.04.2014  13:16    <VERBINDUNG>   Gemeinsame Dateien [C:\Program Files\Common Files]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Program Files\Windows NT
05.04.2014  13:16    <VERBINDUNG>   Zubeh”r [C:\Program Files\Windows NT\Accessories]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\ProgramData
05.04.2014  13:16    <VERBINDUNG>   Anwendungsdaten [C:\ProgramData]
14.07.2009  06:53    <VERBINDUNG>   Application Data [C:\ProgramData]
14.07.2009  06:53    <VERBINDUNG>   Desktop [C:\Users\Public\Desktop]
14.07.2009  06:53    <VERBINDUNG>   Documents [C:\Users\Public\Documents]
05.04.2014  13:16    <VERBINDUNG>   Dokumente [C:\Users\Public\Documents]
05.04.2014  13:16    <VERBINDUNG>   Favoriten [C:\Users\Public\Favorites]
14.07.2009  06:53    <VERBINDUNG>   Favorites [C:\Users\Public\Favorites]
14.07.2009  06:53    <VERBINDUNG>   Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
05.04.2014  13:16    <VERBINDUNG>   Startmen [C:\ProgramData\Microsoft\Windows\Start Menu]
14.07.2009  06:53    <VERBINDUNG>   Templates [C:\ProgramData\Microsoft\Windows\Templates]
05.04.2014  13:16    <VERBINDUNG>   Vorlagen [C:\ProgramData\Microsoft\Windows\Templates]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\ProgramData\Microsoft\Windows\Start Menu
05.04.2014  13:16    <VERBINDUNG>   Programme [C:\ProgramData\Microsoft\Windows\Start Menu\Programs]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users
14.07.2009  06:53    <SYMLINKD>     All Users [C:\ProgramData]
14.07.2009  06:53    <VERBINDUNG>   Default User [C:\Users\Default]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\All Users
05.04.2014  13:16    <VERBINDUNG>   Anwendungsdaten [C:\ProgramData]
14.07.2009  06:53    <VERBINDUNG>   Application Data [C:\ProgramData]
14.07.2009  06:53    <VERBINDUNG>   Desktop [C:\Users\Public\Desktop]
14.07.2009  06:53    <VERBINDUNG>   Documents [C:\Users\Public\Documents]
05.04.2014  13:16    <VERBINDUNG>   Dokumente [C:\Users\Public\Documents]
05.04.2014  13:16    <VERBINDUNG>   Favoriten [C:\Users\Public\Favorites]
14.07.2009  06:53    <VERBINDUNG>   Favorites [C:\Users\Public\Favorites]
14.07.2009  06:53    <VERBINDUNG>   Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
05.04.2014  13:16    <VERBINDUNG>   Startmen [C:\ProgramData\Microsoft\Windows\Start Menu]
14.07.2009  06:53    <VERBINDUNG>   Templates [C:\ProgramData\Microsoft\Windows\Templates]
05.04.2014  13:16    <VERBINDUNG>   Vorlagen [C:\ProgramData\Microsoft\Windows\Templates]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\All Users\Microsoft\Windows\Start Menu
05.04.2014  13:16    <VERBINDUNG>   Programme [C:\ProgramData\Microsoft\Windows\Start Menu\Programs]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\Default
05.04.2014  13:16    <VERBINDUNG>   Anwendungsdaten [C:\Users\Default\AppData\Roaming]
14.07.2009  06:53    <VERBINDUNG>   Application Data [C:\Users\Default\AppData\Roaming]
14.07.2009  06:53    <VERBINDUNG>   Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
05.04.2014  13:16    <VERBINDUNG>   Druckumgebung [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
05.04.2014  13:16    <VERBINDUNG>   Eigene Dateien [C:\Users\Default\Documents]
14.07.2009  06:53    <VERBINDUNG>   Local Settings [C:\Users\Default\AppData\Local]
05.04.2014  13:16    <VERBINDUNG>   Lokale Einstellungen [C:\Users\Default\AppData\Local]
14.07.2009  06:53    <VERBINDUNG>   My Documents [C:\Users\Default\Documents]
14.07.2009  06:53    <VERBINDUNG>   NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
05.04.2014  13:16    <VERBINDUNG>   Netzwerkumgebung [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
14.07.2009  06:53    <VERBINDUNG>   PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
14.07.2009  06:53    <VERBINDUNG>   Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
14.07.2009  06:53    <VERBINDUNG>   SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
14.07.2009  06:53    <VERBINDUNG>   Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
05.04.2014  13:16    <VERBINDUNG>   Startmen [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
14.07.2009  06:53    <VERBINDUNG>   Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
05.04.2014  13:16    <VERBINDUNG>   Vorlagen [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\Default\AppData\Local
05.04.2014  13:16    <VERBINDUNG>   Anwendungsdaten [C:\Users\Default\AppData\Local]
14.07.2009  06:53    <VERBINDUNG>   Application Data [C:\Users\Default\AppData\Local]
14.07.2009  06:53    <VERBINDUNG>   History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
14.07.2009  06:53    <VERBINDUNG>   Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
05.04.2014  13:16    <VERBINDUNG>   Verlauf [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu
05.04.2014  13:16    <VERBINDUNG>   Programme [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\Default\Documents
05.04.2014  13:16    <VERBINDUNG>   Eigene Bilder [C:\Users\Default\Pictures]
05.04.2014  13:16    <VERBINDUNG>   Eigene Musik [C:\Users\Default\Music]
05.04.2014  13:16    <VERBINDUNG>   Eigene Videos [C:\Users\Default\Videos]
14.07.2009  06:53    <VERBINDUNG>   My Music [C:\Users\Default\Music]
14.07.2009  06:53    <VERBINDUNG>   My Pictures [C:\Users\Default\Pictures]
14.07.2009  06:53    <VERBINDUNG>   My Videos [C:\Users\Default\Videos]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\DM
05.04.2014  13:18    <VERBINDUNG>   Anwendungsdaten [C:\Users\DM\AppData\Roaming]
05.04.2014  13:18    <VERBINDUNG>   Cookies [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Cookies]
05.04.2014  13:18    <VERBINDUNG>   Druckumgebung [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
05.04.2014  13:18    <VERBINDUNG>   Eigene Dateien [C:\Users\DM\Documents]
05.04.2014  13:18    <VERBINDUNG>   Lokale Einstellungen [C:\Users\DM\AppData\Local]
05.04.2014  13:18    <VERBINDUNG>   Netzwerkumgebung [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
05.04.2014  13:18    <VERBINDUNG>   Recent [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Recent]
05.04.2014  13:18    <VERBINDUNG>   SendTo [C:\Users\DM\AppData\Roaming\Microsoft\Windows\SendTo]
05.04.2014  13:18    <VERBINDUNG>   Startmen [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Start Menu]
05.04.2014  13:18    <VERBINDUNG>   Vorlagen [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Templates]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\DM\AppData\Local
05.04.2014  13:18    <VERBINDUNG>   Anwendungsdaten [C:\Users\DM\AppData\Local]
05.04.2014  13:18    <VERBINDUNG>   Temporary Internet Files [C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files]
05.04.2014  13:18    <VERBINDUNG>   Verlauf [C:\Users\DM\AppData\Local\Microsoft\Windows\History]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\DM\AppData\Roaming\Microsoft\Windows\Start Menu
05.04.2014  13:18    <VERBINDUNG>   Programme [C:\Users\DM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\DM\Documents
05.04.2014  13:18    <VERBINDUNG>   Eigene Bilder [C:\Users\DM\Pictures]
05.04.2014  13:18    <VERBINDUNG>   Eigene Musik [C:\Users\DM\Music]
05.04.2014  13:18    <VERBINDUNG>   Eigene Videos [C:\Users\DM\Videos]
               0 Datei(en),              0 Bytes
 Verzeichnis von C:\Users\Public\Documents
05.04.2014  13:16    <VERBINDUNG>   Eigene Bilder [C:\Users\Public\Pictures]
05.04.2014  13:16    <VERBINDUNG>   Eigene Musik [C:\Users\Public\Music]
05.04.2014  13:16    <VERBINDUNG>   Eigene Videos [C:\Users\Public\Videos]
14.07.2009  06:53    <VERBINDUNG>   My Music [C:\Users\Public\Music]
14.07.2009  06:53    <VERBINDUNG>   My Pictures [C:\Users\Public\Pictures]
14.07.2009  06:53    <VERBINDUNG>   My Videos [C:\Users\Public\Videos]
               0 Datei(en),              0 Bytes
     Anzahl der angezeigten Dateien:
               0 Datei(en),              0 Bytes
              83 Verzeichnis(se), 281.825.554.432 Bytes frei

< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 11.05.2014 12:09:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\DM\Downloads
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17041)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 42,63% Memory free
3,73 Gb Paging File | 2,19 Gb Available in Paging File | 58,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,89 Gb Total Space | 262,47 Gb Free Space | 88,11% Space Free | Partition Type: NTFS
Drive E: | 465,65 Gb Total Space | 423,05 Gb Free Space | 90,85% Space Free | Partition Type: FAT32
 
Computer Name: DM-PC | User Name: DM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{076D8E48-C459-4AD5-B27A-43CE20554E66}" = rport=138 | protocol=17 | dir=out | app=system | 
"{07C2ACE8-79B5-4CCF-B7B1-1A2CB1804B91}" = rport=137 | protocol=17 | dir=out | app=system | 
"{11E62383-32D5-45A1-8E18-DC177834037E}" = lport=445 | protocol=6 | dir=in | app=system | 
"{1863DF62-5788-4222-B2D9-9E29758FBCC8}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{31FBEA97-74FD-42E3-B9B3-F8ED2C835FB7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4B878DEB-95DA-47B0-B335-A87F897568D7}" = rport=139 | protocol=6 | dir=out | app=system | 
"{4E904EF8-89D6-4A3E-B22D-91AE6B68662F}" = lport=137 | protocol=17 | dir=in | app=system | 
"{6B802D20-7F77-4722-8209-BB37DF41841B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6BDAE670-2290-4B41-B05C-AC4376EE68DD}" = rport=445 | protocol=6 | dir=out | app=system | 
"{898EC7E0-31B8-415A-A625-543B0763EE01}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9A72DE6F-13F8-468F-91E1-5037100C8325}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A36098E8-6F58-4696-B9F0-0A4E98C34313}" = lport=138 | protocol=17 | dir=in | app=system | 
"{AC08F674-EDC8-44FB-98C6-C1E3424FC1AB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B7D4F4C1-48D8-482C-8AB7-D1697B88D224}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{B9DBA19C-2E14-4E71-A532-CF98E895D19D}" = lport=139 | protocol=6 | dir=in | app=system | 
"{BBC33130-1081-4EFA-BC5F-2D9E51012C24}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C251229C-C839-42B6-B61A-498A342C140C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{C2B22A68-8968-463E-85C5-0BFF53033DF7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{C93A7A43-0CE7-471C-8BD3-0662D0C59AF7}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{D9061C8E-E594-4970-B029-C408B7D74BA1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D95C05B5-2E96-4F1E-B466-EC57244DEA48}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{DA624E6E-17AE-4802-A556-9C79B609AAC4}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{EA752527-223B-4695-B9FF-E232B4C8B67F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A383EBB-E867-404D-9FA0-76A2882F422D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0F39F785-D097-447F-8F84-391840ADBED3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{23C52E13-A0BB-44A3-BDF8-391D74E5F17B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{348CD7DC-13FB-4183-812E-0270E5C805C9}" = protocol=6 | dir=out | app=system | 
"{3D983D71-0D76-44A2-812B-9BB20C3BFC27}" = protocol=6 | dir=in | svc=* | app=c:\program files\common files\research in motion\tunnel manager\tunmgr.exe | 
"{43F768E9-1EBD-4F55-AE7D-E42647C48B5B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4A56C1D0-3719-4882-94EB-A8B4E4E919B5}" = protocol=6 | dir=in | app=c:\program files\common files\research in motion\nginx\nginx.exe | 
"{518C708E-6E22-4170-ACE9-D969FDD479E2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5D29FBEF-B3F0-4E7E-869C-47833F1FA58C}" = protocol=6 | dir=in | app=c:\program files\common files\research in motion\tunnel manager\peermanager.exe | 
"{6656C481-9BA0-4A1E-911B-19CE91CC4591}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6F1B14D0-69AF-4A0D-8CE1-098D37FD10C3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{75D020FA-4941-4EEF-9064-F86DDF83D551}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{7973B43D-02B6-4829-B65E-97640961DFE4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{82D6FE1E-883F-4141-89DB-ACD24F39A3A7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{876E19EB-C0B1-4220-88BA-13CC58E1F82F}" = protocol=58 | dir=in | app=system | 
"{9EFE9D0D-E58D-481D-BED5-DD404E8D527B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{A34821DB-DA17-4E32-AF50-A17FBE12633A}" = protocol=17 | dir=in | svc=* | app=c:\program files\common files\research in motion\tunnel manager\tunmgr.exe | 
"{A4DA76E9-4DF3-4BA2-AF7D-C7499CF92760}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{AF086F23-13D0-49A7-9ED7-D39C16CD7752}" = protocol=6 | dir=in | svc=* | app=c:\program files\common files\research in motion\tunnel manager\mdnsresponder.exe | 
"{B469FF21-EEAB-44EB-A3DB-635A3F3DA0ED}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{B7C17AD6-7881-4A92-92A0-A845DFE3F262}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{C16F835E-DFC7-4927-90F1-8E5B2C024BE0}" = protocol=17 | dir=in | svc=* | app=c:\program files\common files\research in motion\tunnel manager\mdnsresponder.exe | 
"{DB1EEDD9-C80C-4B45-B6A6-15B0DF6A9DA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{E3CAE184-9432-40C3-9119-38A18A1AAED7}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{093AA1A8-C32E-4998-8C2E-204DF024B114}" = ESET Smart Security
"{26A24AE4-039D-4CA4-87B4-2F83217055FF}" = Java 7 Update 55
"{4903D172-DCCB-392F-93A3-34CA9D47FE3D}" = Microsoft .NET Framework 4.5.1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5.1 (Deutsch)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{9E871D09-064D-3BC9-963B-3AB8ABE1273D}" = Microsoft .NET Framework 4.5.1 (DEU)
"{A603F0D2-6642-423F-8A8E-462EB0A124C1}" = BlackBerry Link
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.06) - Deutsch
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"BlackBerry_10_Desktop" = BlackBerry Link
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.32.327
"Google Chrome" = Google Chrome
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware Version 2.0.1.1004
"McAfee Security Scan" = McAfee Security Scan Plus
"NetObjects Fusion Essentials" = NetObjects Fusion Essentials
"Samsung ML-191x 252x Series" = Wartung Samsung ML-191x 252x Series
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 07.05.2014 05:41:57 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8080
 
Error - 07.05.2014 05:41:58 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 07.05.2014 05:41:58 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9079
 
Error - 07.05.2014 05:41:58 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9079
 
Error - 07.05.2014 05:41:59 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 07.05.2014 05:41:59 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10093
 
Error - 07.05.2014 05:41:59 | Computer Name = DM-PC | Source = RIM MDNS | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10093
 
Error - 07.05.2014 11:53:04 | Computer Name = DM-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common
 Files\XCPCSync.OEM\SyncSDK.209.604\XCPCSync.dll".  Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.05.2014 11:53:04 | Computer Name = DM-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common
 Files\XCPCSync.OEM\SyncSDK.209.604\XCPCSync.dll".  Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.05.2014 11:54:06 | Computer Name = DM-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 05.05.2014 03:00:40 | Computer Name = DM-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 05.05.2014 03:06:11 | Computer Name = DM-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 05.05.2014 03:08:51 | Computer Name = DM-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 06.05.2014 05:04:15 | Computer Name = DM-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 06.05.2014 07:43:41 | Computer Name = DM-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 06.05.2014 11:25:54 | Computer Name = DM-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 06.05.2014 11:27:00 | Computer Name = DM-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 06.05.2014 20:56:27 | Computer Name = DM-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 07.05.2014 05:29:23 | Computer Name = DM-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 07.05.2014 10:05:45 | Computer Name = DM-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
 
< End of report >

Hallo Machiavelli,

danke, dass du dich dem Problem annimmst.

so, zunächst einmal die beiden Logfiles. Das Logfile von AntiMale würde ich gerne noch poste, weiß allerdings nicht, wo es zu finden ist bzw. wie ich es erstellen kann

Machiavelli · 11.05.2014, 13:48

Hey,

Zitat:

Das Logfile von AntiMale würde ich gerne noch poste, weiß allerdings nicht, wo es zu finden ist bzw. wie ich es erstellen kann

Lesestoff
MBAM-Funde posten: So gehts...
Manchmal ist es wichtig zu wissen, welche Schadprogramme im Vorfeld ohne Anweisung der Helfer schon gelöscht wurden.
Daher benötige ich den Inhalt der Logdatei, in welcher der Suchlauf protokolliert wurde.

Starte MBAM.
Klicke auf Verlauf.
Klicke auf Anwendungsprotokolle.
Klicke auf das letzte Suchlaufprotokoll mit Funden.
Klicke auf "In Zwischenablage kopieren".
Poste den Inhalt in Code-Tags [CODE] [/CODE] durch Einfügen mit Strg+V als Antwort in Deinen Thread.

Damimo · 13.05.2014, 12:45

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 10.05.2014
Scan Time: 14:41:34
Logfile: 
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.10.03
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: DM

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 245427
Time Elapsed: 5 min, 30 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginService, Quarantined, [28934f00a0dbce689c69c0af41c1f709], 

Files: 1
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginService\PluginService.exe, Quarantined, [28934f00a0dbce689c69c0af41c1f709], 

Physical Sectors: 0
(No malicious items detected)


(end)

Machiavelli · 13.05.2014, 15:55

Hey.

Bitte deinstalliere:

Free YouTube to MP3 Converter version 3.12.32.327

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Bitte poste mir die Inhalte der Logs von Adwarecleaner, MBAM, JRT, ESET und FRST hier in den Thread.

Damimo · 13.05.2014, 20:45

Code:

ATTFilter

# AdwCleaner v3.208 - Bericht erstellt am 13/05/2014 um 20:52:29
# Aktualisiert 11/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : DM - DM-PC
# Gestartet von : C:\Users\DM\Downloads\adwcleaner08.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\saave net
Ordner Gelöscht : C:\Program Files\SupTab
Ordner Gelöscht : C:\Program Files\saave net
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\torch
Ordner Gelöscht : C:\Users\DM\AppData\Local\torch
Ordner Gelöscht : C:\Users\DM\AppData\Roaming\SupTab
Ordner Gelöscht : C:\Users\Gast\AppData\Local\torch
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\torch
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\filfajimlinihgepbdniccpnkbhamgaa
Ordner Gelöscht : C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\filfajimlinihgepbdniccpnkbhamgaa
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\filfajimlinihgepbdniccpnkbhamgaa
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\filfajimlinihgepbdniccpnkbhamgaa

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Google Chrome v34.0.1847.131

[ Datei : C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFB20D05F-5999-41D5-8F7E-6006C5D181EB&SearchSource=58&CUI=&UM=5&UP=SP4477FD9E-797C-4ABB-9711-355B59E74D12&q={searchTerms}&SSPV=
Gelöscht [Search Provider] : hxxp://istart.webssearches.com/web/?type=dspp&ts=1399704193&from=tugs&uid=WDCXWD3200AAJS-07M0A0_WD-WCAV2X90457304573&q={searchTerms}
Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
Gelöscht [Extension] : bopakagnckmlgajfccecajhnimjiiedh
Gelöscht [Extension] : dmgpbjjcdccinnndjdgmegndbmhbgglb
Gelöscht [Extension] : filfajimlinihgepbdniccpnkbhamgaa
Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
Gelöscht [Extension] : pelmeidfhdlhlbjimpabfcbnnojbboma

*************************

AdwCleaner[R0].txt - [3174 octets] - [13/05/2014 20:50:21]
AdwCleaner[S0].txt - [2971 octets] - [13/05/2014 20:52:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3031 octets] ##########

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 13.05.2014
Suchlauf-Zeit: 21:16:45
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.05.13.12
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: DM

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 246884
Verstrichene Zeit: 5 Min, 20 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 4
PUP.Optional.LiveLyrics.A, C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.livelyrics00.live-lyrics.com_0.localstorage, In Quarantäne, [26cae868f883e2541ea7cfaf5ea4a65a], 
PUP.Optional.LiveLyrics.A, C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.livelyrics00.live-lyrics.com_0.localstorage-journal, In Quarantäne, [cb25440cff7c999d08bd91ed09f9cc34], 
PUP.Optional.Superfish.A, C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, In Quarantäne, [01ef6ae63c3f47efba0c6a148979c23e], 
PUP.Optional.Superfish.A, C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, In Quarantäne, [06ea5ff17ffc7db908be9ee0f2105da3], 

Physische Sektoren: 0
(No malicious items detected)


(end)

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by DM on 13.05.2014 at 21:30:18,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.05.2014 at 21:32:38,36
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:11-05-2014 01
Ran by DM (administrator) on DM-PC on 13-05-2014 21:37:30
Running from C:\Users\DM\Downloads
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Adobe Systems Incorporated) C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Apple Inc.) C:\Program Files\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research in Motion\Tunnel Manager\tunmgr.exe
(BlackBerry Limited) C:\Program Files\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(BlackBerry Limited) C:\Program Files\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
() C:\Program Files\Common Files\Research in Motion\nginx\nginx.exe
() C:\Program Files\Common Files\Research in Motion\nginx\nginx.exe
(Research In Motion) C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe
(Research In Motion) C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\DM\Downloads\FRST (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5078504 2013-03-21] (ESET)
HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [618496 2010-06-07] ()
HKLM\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2014-01-21] (BlackBerry Limited)
HKLM\...\Run: [RIM PeerManager] => C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4484608 2014-01-22] (Research In Motion Limited)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\S-1-5-21-3849330234-4089986496-285111758-1001\...\Run: [BlackBerryLink.exe] => C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.exe [1464336 2014-02-03] (Research In Motion)
HKU\S-1-5-21-3849330234-4089986496-285111758-1001\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x22B7D650C150CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-03-31]

Chrome: 
=======
CHR HomePage: 
CHR Extension: (Google Docs) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-05]
CHR Extension: (Google Drive) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-05]
CHR Extension: (YouTube) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-05]
CHR Extension: (Google-Suche) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-05]
CHR Extension: (Google Wallet) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-05]
CHR Extension: (Google Mail) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-05]

========================== Services (Whitelisted) =================

R2 AdobeActiveFileMonitor7.0; C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [169312 2008-09-16] (Adobe Systems Incorporated)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2014-01-21] (BlackBerry Limited)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1341664 2013-03-21] (ESET)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [235696 2014-01-16] (McAfee, Inc.)
R2 RIM MDNS; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2014-01-22] (Apple Inc.)
R2 RIM Tunnel Service; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1309696 2014-01-22] (Research In Motion Limited)

==================== Drivers (Whitelisted) ====================

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [171680 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [122240 2013-01-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [150080 2013-01-10] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [46056 2013-01-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [47568 2013-02-14] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb.sys [68096 2013-12-02] (BlackBerry Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2014-01-22] (Research in Motion Limited)
S3 usbrndis6; C:\Windows\system32\drivers\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-13 21:36 - 2014-05-13 21:36 - 01056256 _____ (Farbar) C:\Users\DM\Downloads\FRST (1).exe
2014-05-13 21:32 - 2014-05-13 21:32 - 00000645 _____ () C:\Users\DM\Desktop\JRT.txt
2014-05-13 21:26 - 2014-05-13 21:26 - 00000000 ____D () C:\Windows\ERUNT
2014-05-13 21:25 - 2014-05-13 21:25 - 01016261 _____ (Thisisu) C:\Users\DM\Downloads\JRT.exe
2014-05-13 21:19 - 2014-05-13 21:19 - 00001928 _____ () C:\Users\DM\Desktop\mbam.txt
2014-05-13 20:50 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-13 20:49 - 2014-05-13 20:52 - 00000000 ____D () C:\AdwCleaner
2014-05-13 20:47 - 2014-05-13 20:48 - 01325827 _____ () C:\Users\DM\Downloads\adwcleaner08.exe
2014-05-11 12:17 - 2014-05-11 12:17 - 00131312 _____ () C:\Users\DM\Downloads\OTL.Txt
2014-05-11 12:17 - 2014-05-11 12:17 - 00031444 _____ () C:\Users\DM\Downloads\Extras.Txt
2014-05-11 12:06 - 2014-05-11 12:06 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (2).exe
2014-05-11 12:04 - 2014-05-11 12:04 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (1).exe
2014-05-11 11:59 - 2014-05-11 11:59 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL.exe
2014-05-10 14:48 - 2014-05-10 14:48 - 00013808 _____ () C:\Users\DM\Downloads\Addition.txt
2014-05-10 14:47 - 2014-05-13 21:37 - 00010063 _____ () C:\Users\DM\Downloads\FRST.txt
2014-05-10 14:47 - 2014-05-13 21:37 - 00000000 ____D () C:\FRST
2014-05-10 14:46 - 2014-05-10 14:46 - 01054720 _____ (Farbar) C:\Users\DM\Downloads\FRST.exe
2014-05-10 13:32 - 2014-05-13 21:29 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-10 13:31 - 2014-05-10 13:31 - 00001027 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-10 13:31 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-10 13:31 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-10 13:31 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-10 13:21 - 2014-05-10 13:30 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\DM\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-06 13:23 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\AppReady Software
2014-05-05 08:56 - 2014-05-05 09:04 - 00000000 ____D () C:\ProgramData\a385c8f7db692ada
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator
2014-05-05 08:54 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\InstallMate
2014-05-05 08:53 - 2014-05-05 08:53 - 00000020 _____ () C:\Windows\¬ôœ
2014-05-04 09:42 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-04 09:41 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 13:21 - 2014-04-29 13:22 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live Writer
2014-04-29 13:21 - 2014-04-29 13:21 - 00000000 ____D () C:\Users\DM\AppData\Roaming\Windows Live Writer
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieUserList
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieSiteList
2014-04-28 09:45 - 2014-04-28 09:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-28 09:28 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-28 09:28 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-28 09:28 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-28 09:28 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-28 09:28 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-28 09:28 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-28 09:28 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-28 09:28 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-28 09:28 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-28 09:28 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-28 09:28 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-28 09:28 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-28 09:28 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-28 09:28 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-28 09:28 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-28 09:28 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-28 09:28 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-28 09:28 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-28 09:28 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-28 09:28 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-28 09:28 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-28 09:28 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-28 09:28 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-28 09:28 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-27 19:41 - 2014-04-27 19:41 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 19:40 - 2014-04-27 19:40 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Sun
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-27 18:54 - 2014-04-27 18:54 - 00921512 _____ (Oracle Corporation) C:\Users\DM\Downloads\chromeinstall-7u55.exe
2014-04-27 18:54 - 2014-04-27 18:54 - 00405504 _____ () C:\Users\DM\Downloads\intel_srldetect_4.5.13.0.msi
2014-04-27 18:53 - 2014-04-14 04:11 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-27 18:53 - 2014-04-14 04:07 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-27 18:26 - 2014-04-27 18:26 - 00000000 ____D () C:\Users\DM\Documents\Eigene Webs
2014-04-27 18:22 - 2014-05-05 08:46 - 00000000 ____D () C:\Users\DM\Tracing
2014-04-27 18:19 - 2014-04-27 18:19 - 00000020 _____ () C:\Windows\8ôt
2014-04-27 18:17 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-04-27 18:17 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-04-27 18:17 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-04-27 18:17 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-04-27 18:17 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ___RD () C:\Users\DM\SkyDrive
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ____D () C:\Program Files\Microsoft SkyDrive
2014-04-27 18:16 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-04-27 18:15 - 2014-05-05 08:57 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2014-04-27 15:54 - 2014-04-27 16:12 - 142602520 _____ (Microsoft Corporation) C:\Users\DM\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-04-16 10:54 - 2014-04-16 10:54 - 00002129 _____ () C:\Users\Public\Desktop\NetObjects Fusion Essentials.lnk
2014-04-16 10:54 - 2014-04-16 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetObjects
2014-04-16 10:53 - 2014-04-16 10:53 - 00000000 ____D () C:\Program Files\NetObjects
2014-04-16 10:53 - 2009-05-16 08:41 - 01056768 _____ (Blue Sky Software Corporation.) C:\Windows\system32\ROBOEX32.DLL
2014-04-16 10:53 - 2009-05-16 08:41 - 00049152 _____ (Blue Sky Software Corporation.) C:\Windows\system32\INETWH32.DLL
2014-04-16 10:50 - 2002-01-31 00:52 - 00328704 _____ (InstallShield Software Corporation ) C:\Windows\IsUn0407.exe
2014-04-16 10:46 - 2014-04-16 10:46 - 00000000 ____D () C:\Users\DM\Desktop\NetObjects
2014-04-15 09:35 - 2014-04-15 09:36 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-15 09:35 - 2014-03-31 03:51 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-04-13 11:23 - 2014-04-13 11:23 - 00000000 ____D () C:\Users\DM\AppData\Roaming\TuneUp Software
2014-04-13 11:22 - 2014-04-14 11:45 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-04-13 11:22 - 2014-04-13 11:22 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-13 11:12 - 2014-05-13 20:44 - 00000000 ____D () C:\Users\DM\AppData\Roaming\DVDVideoSoft
2014-04-13 11:12 - 2014-04-13 11:23 - 34763504 _____ (DVDVideoSoft Ltd. ) C:\Users\DM\Downloads\FreeYouTubeToMP3Converter_3.12.32.327 (1).exe
2014-04-13 10:45 - 2014-04-13 10:59 - 34763504 _____ (DVDVideoSoft Ltd. ) C:\Users\DM\Downloads\FreeYouTubeToMP3Converter_3.12.32.327.exe

==================== One Month Modified Files and Folders =======

2014-05-13 21:37 - 2014-05-10 14:47 - 00010063 _____ () C:\Users\DM\Downloads\FRST.txt
2014-05-13 21:37 - 2014-05-10 14:47 - 00000000 ____D () C:\FRST
2014-05-13 21:36 - 2014-05-13 21:36 - 01056256 _____ (Farbar) C:\Users\DM\Downloads\FRST (1).exe
2014-05-13 21:35 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-13 21:35 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-13 21:34 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-13 21:32 - 2014-05-13 21:32 - 00000645 _____ () C:\Users\DM\Desktop\JRT.txt
2014-05-13 21:29 - 2014-05-10 13:32 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-13 21:29 - 2014-04-05 17:23 - 00001086 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-13 21:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-13 21:28 - 2009-07-14 06:39 - 00043063 _____ () C:\Windows\setupact.log
2014-05-13 21:27 - 2014-03-31 14:32 - 01817421 _____ () C:\Windows\WindowsUpdate.log
2014-05-13 21:26 - 2014-05-13 21:26 - 00000000 ____D () C:\Windows\ERUNT
2014-05-13 21:25 - 2014-05-13 21:25 - 01016261 _____ (Thisisu) C:\Users\DM\Downloads\JRT.exe
2014-05-13 21:19 - 2014-05-13 21:19 - 00001928 _____ () C:\Users\DM\Desktop\mbam.txt
2014-05-13 20:55 - 2010-11-20 23:48 - 00070830 _____ () C:\Windows\PFRO.log
2014-05-13 20:52 - 2014-05-13 20:49 - 00000000 ____D () C:\AdwCleaner
2014-05-13 20:52 - 2014-04-05 17:23 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-13 20:48 - 2014-05-13 20:47 - 01325827 _____ () C:\Users\DM\Downloads\adwcleaner08.exe
2014-05-13 20:44 - 2014-04-13 11:12 - 00000000 ____D () C:\Users\DM\AppData\Roaming\DVDVideoSoft
2014-05-13 13:39 - 2014-04-05 17:23 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-11 12:17 - 2014-05-11 12:17 - 00131312 _____ () C:\Users\DM\Downloads\OTL.Txt
2014-05-11 12:17 - 2014-05-11 12:17 - 00031444 _____ () C:\Users\DM\Downloads\Extras.Txt
2014-05-11 12:06 - 2014-05-11 12:06 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (2).exe
2014-05-11 12:04 - 2014-05-11 12:04 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (1).exe
2014-05-11 11:59 - 2014-05-11 11:59 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL.exe
2014-05-10 14:48 - 2014-05-10 14:48 - 00013808 _____ () C:\Users\DM\Downloads\Addition.txt
2014-05-10 14:46 - 2014-05-10 14:46 - 01054720 _____ (Farbar) C:\Users\DM\Downloads\FRST.exe
2014-05-10 13:31 - 2014-05-10 13:31 - 00001027 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-10 13:30 - 2014-05-10 13:21 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\DM\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-10 08:42 - 2014-04-05 17:23 - 00000000 ____D () C:\Program Files\Google
2014-05-08 13:37 - 2014-04-05 17:23 - 00000000 ____D () C:\Users\DM\AppData\Local\Google
2014-05-08 10:13 - 2014-04-05 17:24 - 00002088 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-08 10:13 - 2014-04-05 13:18 - 00001376 _____ () C:\Users\DM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-06 13:23 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\AppReady Software
2014-05-06 13:23 - 2014-05-05 08:54 - 00000000 ____D () C:\ProgramData\InstallMate
2014-05-05 09:13 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-05 09:04 - 2014-05-05 08:56 - 00000000 ____D () C:\ProgramData\a385c8f7db692ada
2014-05-05 08:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-05-05 08:57 - 2014-04-27 18:15 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator
2014-05-05 08:53 - 2014-05-05 08:53 - 00000020 _____ () C:\Windows\¬ôœ
2014-05-05 08:46 - 2014-04-27 18:22 - 00000000 ____D () C:\Users\DM\Tracing
2014-04-29 14:48 - 2014-05-04 09:42 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 14:34 - 2014-05-04 09:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 13:22 - 2014-04-29 13:21 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live Writer
2014-04-29 13:21 - 2014-04-29 13:21 - 00000000 ____D () C:\Users\DM\AppData\Roaming\Windows Live Writer
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieUserList
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieSiteList
2014-04-28 11:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-04-28 09:53 - 2014-04-09 15:34 - 00000000 ____D () C:\Users\DM\Dani Betz
2014-04-28 09:45 - 2014-04-28 09:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-28 09:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-27 19:41 - 2014-04-27 19:41 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 19:40 - 2014-04-27 19:40 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Sun
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-27 18:54 - 2014-04-27 18:54 - 00921512 _____ (Oracle Corporation) C:\Users\DM\Downloads\chromeinstall-7u55.exe
2014-04-27 18:54 - 2014-04-27 18:54 - 00405504 _____ () C:\Users\DM\Downloads\intel_srldetect_4.5.13.0.msi
2014-04-27 18:26 - 2014-04-27 18:26 - 00000000 ____D () C:\Users\DM\Documents\Eigene Webs
2014-04-27 18:22 - 2014-04-05 13:18 - 00000000 ____D () C:\Users\DM
2014-04-27 18:19 - 2014-04-27 18:19 - 00000020 _____ () C:\Windows\8ôt
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ___RD () C:\Users\DM\SkyDrive
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ____D () C:\Program Files\Microsoft SkyDrive
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2014-04-27 16:12 - 2014-04-27 15:54 - 142602520 _____ (Microsoft Corporation) C:\Users\DM\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-04-16 10:54 - 2014-04-16 10:54 - 00002129 _____ () C:\Users\Public\Desktop\NetObjects Fusion Essentials.lnk
2014-04-16 10:54 - 2014-04-16 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetObjects
2014-04-16 10:53 - 2014-04-16 10:53 - 00000000 ____D () C:\Program Files\NetObjects
2014-04-16 10:46 - 2014-04-16 10:46 - 00000000 ____D () C:\Users\DM\Desktop\NetObjects
2014-04-15 09:36 - 2014-04-15 09:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-14 20:46 - 2014-04-09 16:17 - 00000000 ____D () C:\Users\DM\Michi
2014-04-14 11:45 - 2014-04-13 11:22 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-04-14 09:29 - 2014-04-11 19:39 - 00001979 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-04-14 04:11 - 2014-04-27 18:53 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:07 - 2014-04-27 18:53 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-13 12:49 - 2014-04-05 13:18 - 00000000 ____D () C:\Users\DM\AppData\Local\VirtualStore
2014-04-13 11:23 - 2014-04-13 11:23 - 00000000 ____D () C:\Users\DM\AppData\Roaming\TuneUp Software
2014-04-13 11:23 - 2014-04-13 11:12 - 34763504 _____ (DVDVideoSoft Ltd. ) C:\Users\DM\Downloads\FreeYouTubeToMP3Converter_3.12.32.327 (1).exe
2014-04-13 11:22 - 2014-04-13 11:22 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-04-13 10:59 - 2014-04-13 10:45 - 34763504 _____ (DVDVideoSoft Ltd. ) C:\Users\DM\Downloads\FreeYouTubeToMP3Converter_3.12.32.327.exe

Some content of TEMP:
====================
C:\Users\DM\AppData\Local\Temp\Quarantine.exe
C:\Users\DM\AppData\Local\Temp\Tsu20838877.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-10 11:05

==================== End Of Log ============================

--- --- ---

--- --- ---

Machiavelli · 13.05.2014, 20:59

Hier ist kein Addition Logfile zu finden.

Es sollte sich im Downloads Folder befinden.

Bei Dir:

Zitat:

Running from C:\Users\DM\Downloads

Anweisungen:

Zitat:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

So bitte move die FRST.exe zu Deinen Desktop.

Damimo · 14.05.2014, 10:13

so, nun aber

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:11-05-2014 01
Ran by DM (administrator) on DM-PC on 14-05-2014 11:10:25
Running from C:\Users\DM\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Adobe Systems Incorporated) C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Apple Inc.) C:\Program Files\Common Files\Research in Motion\Tunnel Manager\mDNSResponder.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research in Motion\Tunnel Manager\tunmgr.exe
(BlackBerry Limited) C:\Program Files\Common Files\Research in Motion\USB Drivers\BbDevMgr.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(BlackBerry Limited) C:\Program Files\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Research In Motion) C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe
(Research In Motion) C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe
() C:\Program Files\Common Files\Research in Motion\nginx\nginx.exe
() C:\Program Files\Common Files\Research in Motion\nginx\nginx.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\DM\Desktop\FRST (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5078504 2013-03-21] (ESET)
HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [618496 2010-06-07] ()
HKLM\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2014-01-21] (BlackBerry Limited)
HKLM\...\Run: [RIM PeerManager] => C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4484608 2014-01-22] (Research In Motion Limited)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\S-1-5-21-3849330234-4089986496-285111758-1001\...\Run: [BlackBerryLink.exe] => C:\Program Files\Research In Motion\BlackBerry Link\BlackBerryLink.exe [1464336 2014-02-03] (Research In Motion)
HKU\S-1-5-21-3849330234-4089986496-285111758-1001\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x22B7D650C150CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-03-31]

Chrome: 
=======
CHR HomePage: 
CHR Extension: (Google Docs) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-05]
CHR Extension: (Google Drive) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-05]
CHR Extension: (YouTube) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-05]
CHR Extension: (Google-Suche) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-05]
CHR Extension: (Google Wallet) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-05]
CHR Extension: (Google Mail) - C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-05]

========================== Services (Whitelisted) =================

R2 AdobeActiveFileMonitor7.0; C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [169312 2008-09-16] (Adobe Systems Incorporated)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2014-01-21] (BlackBerry Limited)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1341664 2013-03-21] (ESET)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [235696 2014-01-16] (McAfee, Inc.)
R2 RIM MDNS; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2014-01-22] (Apple Inc.)
R2 RIM Tunnel Service; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1309696 2014-01-22] (Research In Motion Limited)

==================== Drivers (Whitelisted) ====================

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [171680 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [122240 2013-01-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [150080 2013-01-10] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [46056 2013-01-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [47568 2013-02-14] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-14] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb.sys [68096 2013-12-02] (BlackBerry Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2014-01-22] (Research in Motion Limited)
S3 usbrndis6; C:\Windows\system32\drivers\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-14 11:10 - 2014-05-14 11:10 - 00009990 _____ () C:\Users\DM\Desktop\FRST.txt
2014-05-13 21:36 - 2014-05-13 21:36 - 01056256 _____ (Farbar) C:\Users\DM\Desktop\FRST (1).exe
2014-05-13 21:32 - 2014-05-13 21:32 - 00000645 _____ () C:\Users\DM\Desktop\JRT.txt
2014-05-13 21:26 - 2014-05-13 21:26 - 00000000 ____D () C:\Windows\ERUNT
2014-05-13 21:25 - 2014-05-13 21:25 - 01016261 _____ (Thisisu) C:\Users\DM\Downloads\JRT.exe
2014-05-13 21:19 - 2014-05-13 21:19 - 00001928 _____ () C:\Users\DM\Desktop\mbam.txt
2014-05-13 20:50 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-13 20:49 - 2014-05-13 20:52 - 00000000 ____D () C:\AdwCleaner
2014-05-13 20:47 - 2014-05-13 20:48 - 01325827 _____ () C:\Users\DM\Downloads\adwcleaner08.exe
2014-05-11 12:17 - 2014-05-11 12:17 - 00131312 _____ () C:\Users\DM\Downloads\OTL.Txt
2014-05-11 12:17 - 2014-05-11 12:17 - 00031444 _____ () C:\Users\DM\Downloads\Extras.Txt
2014-05-11 12:06 - 2014-05-11 12:06 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (2).exe
2014-05-11 12:04 - 2014-05-11 12:04 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (1).exe
2014-05-11 11:59 - 2014-05-11 11:59 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL.exe
2014-05-10 14:48 - 2014-05-10 14:48 - 00013808 _____ () C:\Users\DM\Downloads\Addition.txt
2014-05-10 14:47 - 2014-05-14 11:10 - 00000000 ____D () C:\FRST
2014-05-10 14:47 - 2014-05-13 21:37 - 00033648 _____ () C:\Users\DM\Downloads\FRST.txt
2014-05-10 14:46 - 2014-05-10 14:46 - 01054720 _____ (Farbar) C:\Users\DM\Downloads\FRST.exe
2014-05-10 13:32 - 2014-05-14 10:57 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-10 13:31 - 2014-05-10 13:31 - 00001027 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-10 13:31 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-10 13:31 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-10 13:31 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-10 13:21 - 2014-05-10 13:30 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\DM\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-06 13:23 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\AppReady Software
2014-05-05 08:56 - 2014-05-05 09:04 - 00000000 ____D () C:\ProgramData\a385c8f7db692ada
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator
2014-05-05 08:54 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\InstallMate
2014-05-05 08:53 - 2014-05-05 08:53 - 00000020 _____ () C:\Windows\¬ôœ
2014-05-04 09:42 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-04 09:41 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 13:21 - 2014-04-29 13:22 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live Writer
2014-04-29 13:21 - 2014-04-29 13:21 - 00000000 ____D () C:\Users\DM\AppData\Roaming\Windows Live Writer
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieUserList
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieSiteList
2014-04-28 09:45 - 2014-04-28 09:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-28 09:28 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-28 09:28 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-28 09:28 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-28 09:28 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-28 09:28 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-28 09:28 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-28 09:28 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-28 09:28 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-28 09:28 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-28 09:28 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-28 09:28 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-28 09:28 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-28 09:28 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-28 09:28 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-28 09:28 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-28 09:28 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-28 09:28 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-28 09:28 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-28 09:28 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-28 09:28 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-28 09:28 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-28 09:28 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-28 09:28 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-28 09:28 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-27 19:41 - 2014-04-27 19:41 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 19:40 - 2014-04-27 19:40 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Sun
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-27 18:54 - 2014-04-27 18:54 - 00921512 _____ (Oracle Corporation) C:\Users\DM\Downloads\chromeinstall-7u55.exe
2014-04-27 18:54 - 2014-04-27 18:54 - 00405504 _____ () C:\Users\DM\Downloads\intel_srldetect_4.5.13.0.msi
2014-04-27 18:53 - 2014-04-14 04:11 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-27 18:53 - 2014-04-14 04:07 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-27 18:26 - 2014-04-27 18:26 - 00000000 ____D () C:\Users\DM\Documents\Eigene Webs
2014-04-27 18:22 - 2014-05-05 08:46 - 00000000 ____D () C:\Users\DM\Tracing
2014-04-27 18:19 - 2014-04-27 18:19 - 00000020 _____ () C:\Windows\8ôt
2014-04-27 18:17 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-04-27 18:17 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-04-27 18:17 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-04-27 18:17 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-04-27 18:17 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ___RD () C:\Users\DM\SkyDrive
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ____D () C:\Program Files\Microsoft SkyDrive
2014-04-27 18:16 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-04-27 18:15 - 2014-05-05 08:57 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2014-04-27 15:54 - 2014-04-27 16:12 - 142602520 _____ (Microsoft Corporation) C:\Users\DM\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-04-16 10:54 - 2014-04-16 10:54 - 00002129 _____ () C:\Users\Public\Desktop\NetObjects Fusion Essentials.lnk
2014-04-16 10:54 - 2014-04-16 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetObjects
2014-04-16 10:53 - 2014-04-16 10:53 - 00000000 ____D () C:\Program Files\NetObjects
2014-04-16 10:53 - 2009-05-16 08:41 - 01056768 _____ (Blue Sky Software Corporation.) C:\Windows\system32\ROBOEX32.DLL
2014-04-16 10:53 - 2009-05-16 08:41 - 00049152 _____ (Blue Sky Software Corporation.) C:\Windows\system32\INETWH32.DLL
2014-04-16 10:50 - 2002-01-31 00:52 - 00328704 _____ (InstallShield Software Corporation ) C:\Windows\IsUn0407.exe
2014-04-16 10:46 - 2014-04-16 10:46 - 00000000 ____D () C:\Users\DM\Desktop\NetObjects
2014-04-15 09:35 - 2014-04-15 09:36 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-15 09:35 - 2014-03-31 03:51 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\Program Files\McAfee Security Scan

==================== One Month Modified Files and Folders =======

2014-05-14 11:10 - 2014-05-14 11:10 - 00009990 _____ () C:\Users\DM\Desktop\FRST.txt
2014-05-14 11:10 - 2014-05-10 14:47 - 00000000 ____D () C:\FRST
2014-05-14 11:03 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-14 11:03 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-14 11:01 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-14 10:58 - 2014-03-31 14:32 - 01861471 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 10:57 - 2014-05-10 13:32 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-14 10:57 - 2014-04-05 17:23 - 00001086 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-14 10:55 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-14 10:55 - 2009-07-14 06:39 - 00043119 _____ () C:\Windows\setupact.log
2014-05-13 21:39 - 2014-04-05 17:23 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-13 21:37 - 2014-05-10 14:47 - 00033648 _____ () C:\Users\DM\Downloads\FRST.txt
2014-05-13 21:36 - 2014-05-13 21:36 - 01056256 _____ (Farbar) C:\Users\DM\Desktop\FRST (1).exe
2014-05-13 21:32 - 2014-05-13 21:32 - 00000645 _____ () C:\Users\DM\Desktop\JRT.txt
2014-05-13 21:26 - 2014-05-13 21:26 - 00000000 ____D () C:\Windows\ERUNT
2014-05-13 21:25 - 2014-05-13 21:25 - 01016261 _____ (Thisisu) C:\Users\DM\Downloads\JRT.exe
2014-05-13 21:19 - 2014-05-13 21:19 - 00001928 _____ () C:\Users\DM\Desktop\mbam.txt
2014-05-13 20:55 - 2010-11-20 23:48 - 00070830 _____ () C:\Windows\PFRO.log
2014-05-13 20:52 - 2014-05-13 20:49 - 00000000 ____D () C:\AdwCleaner
2014-05-13 20:52 - 2014-04-05 17:23 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-13 20:48 - 2014-05-13 20:47 - 01325827 _____ () C:\Users\DM\Downloads\adwcleaner08.exe
2014-05-13 20:44 - 2014-04-13 11:12 - 00000000 ____D () C:\Users\DM\AppData\Roaming\DVDVideoSoft
2014-05-11 12:17 - 2014-05-11 12:17 - 00131312 _____ () C:\Users\DM\Downloads\OTL.Txt
2014-05-11 12:17 - 2014-05-11 12:17 - 00031444 _____ () C:\Users\DM\Downloads\Extras.Txt
2014-05-11 12:06 - 2014-05-11 12:06 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (2).exe
2014-05-11 12:04 - 2014-05-11 12:04 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL (1).exe
2014-05-11 11:59 - 2014-05-11 11:59 - 00602112 _____ (OldTimer Tools) C:\Users\DM\Downloads\OTL.exe
2014-05-10 14:48 - 2014-05-10 14:48 - 00013808 _____ () C:\Users\DM\Downloads\Addition.txt
2014-05-10 14:46 - 2014-05-10 14:46 - 01054720 _____ (Farbar) C:\Users\DM\Downloads\FRST.exe
2014-05-10 13:31 - 2014-05-10 13:31 - 00001027 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 13:31 - 2014-05-10 13:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-10 13:30 - 2014-05-10 13:21 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\DM\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-10 08:42 - 2014-04-05 17:23 - 00000000 ____D () C:\Program Files\Google
2014-05-08 13:37 - 2014-04-05 17:23 - 00000000 ____D () C:\Users\DM\AppData\Local\Google
2014-05-08 10:13 - 2014-04-05 17:24 - 00002088 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-08 10:13 - 2014-04-05 13:18 - 00001376 _____ () C:\Users\DM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-06 13:23 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\AppReady Software
2014-05-06 13:23 - 2014-05-05 08:54 - 00000000 ____D () C:\ProgramData\InstallMate
2014-05-05 09:13 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-05 09:04 - 2014-05-05 08:56 - 00000000 ____D () C:\ProgramData\a385c8f7db692ada
2014-05-05 08:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-05-05 08:57 - 2014-04-27 18:15 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Gast
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\DM\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-05-05 08:56 - 2014-05-05 08:56 - 00000000 ____D () C:\Users\Administrator
2014-05-05 08:53 - 2014-05-05 08:53 - 00000020 _____ () C:\Windows\¬ôœ
2014-05-05 08:46 - 2014-04-27 18:22 - 00000000 ____D () C:\Users\DM\Tracing
2014-04-29 14:48 - 2014-05-04 09:42 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 14:34 - 2014-05-04 09:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 13:22 - 2014-04-29 13:21 - 00000000 ____D () C:\Users\DM\AppData\Local\Windows Live Writer
2014-04-29 13:21 - 2014-04-29 13:21 - 00000000 ____D () C:\Users\DM\AppData\Roaming\Windows Live Writer
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieUserList
2014-04-29 13:14 - 2014-04-29 13:14 - 00000000 __SHD () C:\Users\DM\AppData\Local\EmieSiteList
2014-04-28 11:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-04-28 09:53 - 2014-04-09 15:34 - 00000000 ____D () C:\Users\DM\Dani Betz
2014-04-28 09:45 - 2014-04-28 09:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-28 09:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-27 19:41 - 2014-04-27 19:41 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 19:40 - 2014-04-27 19:40 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-27 19:40 - 2014-04-27 19:40 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Sun
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Java
2014-04-27 19:40 - 2014-04-27 19:40 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-27 18:54 - 2014-04-27 18:54 - 00921512 _____ (Oracle Corporation) C:\Users\DM\Downloads\chromeinstall-7u55.exe
2014-04-27 18:54 - 2014-04-27 18:54 - 00405504 _____ () C:\Users\DM\Downloads\intel_srldetect_4.5.13.0.msi
2014-04-27 18:26 - 2014-04-27 18:26 - 00000000 ____D () C:\Users\DM\Documents\Eigene Webs
2014-04-27 18:22 - 2014-04-05 13:18 - 00000000 ____D () C:\Users\DM
2014-04-27 18:19 - 2014-04-27 18:19 - 00000020 _____ () C:\Windows\8ôt
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ___RD () C:\Users\DM\SkyDrive
2014-04-27 18:16 - 2014-04-27 18:16 - 00000000 ____D () C:\Program Files\Microsoft SkyDrive
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-04-27 18:15 - 2014-04-27 18:15 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2014-04-27 16:12 - 2014-04-27 15:54 - 142602520 _____ (Microsoft Corporation) C:\Users\DM\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-04-16 10:54 - 2014-04-16 10:54 - 00002129 _____ () C:\Users\Public\Desktop\NetObjects Fusion Essentials.lnk
2014-04-16 10:54 - 2014-04-16 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetObjects
2014-04-16 10:53 - 2014-04-16 10:53 - 00000000 ____D () C:\Program Files\NetObjects
2014-04-16 10:46 - 2014-04-16 10:46 - 00000000 ____D () C:\Users\DM\Desktop\NetObjects
2014-04-15 09:36 - 2014-04-15 09:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-14 20:46 - 2014-04-09 16:17 - 00000000 ____D () C:\Users\DM\Michi
2014-04-14 11:45 - 2014-04-13 11:22 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-04-14 09:29 - 2014-04-14 09:29 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-04-14 09:29 - 2014-04-11 19:39 - 00001979 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-04-14 04:11 - 2014-04-27 18:53 - 00361984 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:07 - 2014-04-27 18:53 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

Some content of TEMP:
====================
C:\Users\DM\AppData\Local\Temp\Tsu20838877.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-10 11:05

==================== End Of Log ============================

--- --- ---

--- --- ---

Machiavelli · 14.05.2014, 13:24

Ich habe nach der Addition.txt gefragt, nicht nach der FRST.txt.

Damimo · 15.05.2014, 12:00

jetzt aber

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:11-05-2014 01
Ran by DM at 2014-05-15 12:56:55
Running from C:\Users\DM\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ESET Smart Security 6.0 (Enabled - Out of date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
AS: ESET Smart Security 6.0 (Enabled - Out of date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal Firewall (Enabled) {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

==================== Installed Programs ======================

Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.124.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 7.0 (HKLM\...\Adobe Photoshop Elements 7) (Version: 7.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 7.0 (Version: 7.0 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
BlackBerry Link (HKLM\...\BlackBerry_10_Desktop) (Version: 1.2.3.23 - BlackBerry Ltd.)
BlackBerry Link (Version: 1.2.3.23 - BlackBerry Ltd.) Hidden
ESET Smart Security (HKLM\...\{093AA1A8-C32E-4998-8C2E-204DF024B114}) (Version: 6.0.316.1 - ESET, spol s r. o.)
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2000 Premium (HKLM\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NetObjects Fusion Essentials (HKLM\...\NetObjects Fusion Essentials) (Version:  - )
Wartung Samsung ML-191x 252x Series (HKLM\...\Samsung ML-191x 252x Series) (Version:  - Samsung Electronics CO.,LTD)

==================== Restore Points  =========================

26-04-2014 13:28:34 Windows-Sicherung
27-04-2014 16:15:12 Windows Live Essentials
27-04-2014 16:16:28 DirectX wurde installiert
27-04-2014 16:16:54 DirectX wurde installiert
27-04-2014 16:17:21 DirectX wurde installiert
27-04-2014 16:18:20 WLSetup
27-04-2014 16:39:11 Windows Update
27-04-2014 16:54:43 Installed System Requirements Lab for Intel
27-04-2014 17:40:04 Installed Java 7 Update 55
28-04-2014 07:27:35 Windows Update
03-05-2014 10:33:30 Windows Update
04-05-2014 07:41:33 Windows Update
04-05-2014 17:03:22 Windows-Sicherung
05-05-2014 06:51:24 Windows Live Essentials
05-05-2014 06:51:50 WLSetup
05-05-2014 06:58:07 Removed System Requirements Lab for Intel
05-05-2014 06:58:31 Removed Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
10-05-2014 06:46:18 Windows Update
11-05-2014 10:11:11 OTL Restore Point - 11.05.2014 12:11:07
12-05-2014 06:52:22 Windows-Sicherung
13-05-2014 11:35:23 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {2C5C0506-F834-4BD9-ABA6-A410439E2230} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {CCC6564C-079D-4228-A639-169656CAAD82} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-05] (Google Inc.)
Task: {D87AEDFB-F9B5-4684-B329-B3B2FEA686F0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-05] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-06-22 07:41 - 2011-06-22 07:41 - 00024064 ____N () C:\Windows\System32\ssp4ml3.dll
2014-04-05 13:30 - 2010-06-07 12:57 - 00618496 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2014-01-10 11:27 - 2014-01-10 11:27 - 00663056 _____ () C:\Program Files\Common Files\Research In Motion\nginx\nginx.exe
2014-05-01 18:02 - 2014-04-24 02:33 - 00065352 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
2014-05-01 18:02 - 2014-04-24 02:33 - 00674632 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
2014-05-01 18:02 - 2014-04-24 02:33 - 00093000 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\libegl.dll
2014-05-01 18:02 - 2014-04-24 02:33 - 04081480 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll
2014-05-01 18:02 - 2014-04-24 02:33 - 00390472 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll
2014-05-01 18:02 - 2014-04-24 02:33 - 01647432 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (05/14/2014 06:23:30 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 2277

Error: (05/14/2014 06:23:30 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledEvent 2277

Error: (05/14/2014 06:23:30 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/14/2014 06:23:29 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 1045

Error: (05/14/2014 06:23:29 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledEvent 1045

Error: (05/14/2014 06:23:29 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/14/2014 00:23:18 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 6271

Error: (05/14/2014 00:23:18 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledEvent 6271

Error: (05/14/2014 00:23:18 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/14/2014 00:23:17 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 5257


System errors:
=============
Error: (05/14/2014 06:23:30 PM) (Source: Disk) (User: ) (EventID: 11)
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (05/14/2014 10:55:35 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (05/14/2014 06:23:30 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 2277

Error: (05/14/2014 06:23:30 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledEvent 2277

Error: (05/14/2014 06:23:30 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/14/2014 06:23:29 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 1045

Error: (05/14/2014 06:23:29 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledEvent 1045

Error: (05/14/2014 06:23:29 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/14/2014 00:23:18 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 6271

Error: (05/14/2014 00:23:18 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledEvent 6271

Error: (05/14/2014 00:23:18 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/14/2014 00:23:17 PM) (Source: RIM MDNS) (User: ) (EventID: 100)
Description: Task Scheduling Error: m->NextScheduledSPRetry 5257


==================== Memory info =========================== 

Percentage of memory in use: 66%
Total physical RAM: 1911.23 MB
Available physical RAM: 641.59 MB
Total Pagefile: 3822.47 MB
Available Pagefile: 2159.44 MB
Total Virtual: 2047.88 MB
Available Virtual: 1929.52 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:297.89 GB) (Free:262.2 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 6446BFF2)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Machiavelli · 15.05.2014, 15:22

Hey,

Schritt 1: FRST Fix

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

SearchScopes: HKLM - DefaultScope value is missing.
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
2014-05-05 08:56 - 2014-05-05 09:04 - 00000000 ____D () C:\ProgramData\a385c8f7db692ada
2014-05-05 08:54 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\InstallMate
C:\Users\DM\AppData\Local\Temp\Tsu20838877.dll

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2: ESET

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Damimo · 16.05.2014, 16:07

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-05-2014
Ran by DM at 2014-05-16 15:44:40 Run:1
Running from C:\Users\DM\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
SearchScopes: HKLM - DefaultScope value is missing.
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
2014-05-05 08:56 - 2014-05-05 09:04 - 00000000 ____D () C:\ProgramData\a385c8f7db692ada
2014-05-05 08:54 - 2014-05-06 13:23 - 00000000 ____D () C:\ProgramData\InstallMate
C:\Users\DM\AppData\Local\Temp\Tsu20838877.dll
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
C:\ProgramData\a385c8f7db692ada => Moved successfully.
C:\ProgramData\InstallMate => Moved successfully.
C:\Users\DM\AppData\Local\Temp\Tsu20838877.dll => Moved successfully.

==== End of Fixlog ====

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=528712e8529ab943b3bd703629c5b2a9
# engine=18288
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2014-05-16 02:59:26
# local_time=2014-05-16 04:59:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 4668 151883557 0 0
# compatibility_mode=8213 16776701 100 97 3983164 150265316 0 0
# scanned=174119
# found=13
# cleaned=0
# scan_time=3531
# nod_component=V3 Build:0x30000000
sh=8641D9C0BAA30D5B657533F1B1BE4FB826A70AB2 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\ProgramData\InstallMate\{1D830E61-3B98-4718-A5F3-73BAC6602C97}\Custom.dll"
sh=6242214BA69AE72E6448841A40B8FCB50468343C ft=1 fh=9acc4e207c6773f4 vn="Variante von Win32/DomaIQ.BB evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000"
sh=AF267B6DFDEEA5E548D5CE574DBBF5242176B1EA ft=1 fh=4f137befdd281534 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ECOQPT5\9eb[1].exe"
sh=AF559288E931654E11E837939A10519F08A79476 ft=1 fh=835c6713d4fff2e7 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ECOQPT5\TydB[1].exe"
sh=FEC19241949864DE766A2D193BC81E3366E379E4 ft=1 fh=ac6e9bcd558de938 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN9CZ5HQ\SPSetup[1].exe"
sh=5540EEF8AA7835DC221338FCBBF9855D789E207C ft=1 fh=9d89ca7d12c25cce vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MWD2YQ06\ie[1].exe"
sh=4AB884B3483D2B28D5AD88BEA2219A6707FC7847 ft=1 fh=8726eac6bd799518 vn="Variante von Win32/AdWare.Lollipop.U Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Temp\625164c8-1982-401d-bca4-95c696b324cb\software\LollipopInstaller_14656.exe"
sh=DB2995BD79CD039E27CDEE6E8878BAFB4E73F94C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Temp\nsx55D5.tmp\299385"
sh=6DC8FC46537748147FA134E4AD7BCF51AEA414EC ft=1 fh=c71c0011ed541cc0 vn="Variante von Win32/Packed.VMDetector.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Temp\nsx55D5.tmp\InstallerUtils.dll"
sh=CA9F165DCC3FEC1274BDFDF0789AD6B922C98404 ft=1 fh=5b3755edc7204352 vn="Win32/Packed.VMDetector.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DM\AppData\Local\Temp\nsx55D5.tmp\InstallerUtils2.dll"
sh=FD5D1274D9E28F6AF00C6D0719FEFD0754798D6B ft=1 fh=e237b576c92c3fb8 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\FreeYouTubeToMP3Converter_3.11.29.825.exe"
sh=ED7141BDBB9226FCF42A5F2DA97E8026FC19FA37 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="E:\DM-PC\Backup Set 2014-04-26 152832\Backup Files 2014-04-26 152832\Backup files 1.zip"
sh=6A361BBEAA7A745AA4EF2CC386E960887E5DA7E4 ft=0 fh=0000000000000000 vn="Variante von Win32/DomaIQ.BB evtl. unerwünschte Anwendung" ac=I fn="E:\DM-PC\Backup Set 2014-04-26 152832\Backup Files 2014-05-12 085214\Backup files 2.zip"

Machiavelli · 16.05.2014, 16:40

Hey,

Zitat:

sh=ED7141BDBB9226FCF42A5F2DA97E8026FC19FA37 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="E:\DM-PC\Backup Set 2014-04-26 152832\Backup Files 2014-04-26 152832\Backup files 1.zip"
sh=6A361BBEAA7A745AA4EF2CC386E960887E5DA7E4 ft=0 fh=0000000000000000 vn="Variante von Win32/DomaIQ.BB evtl. unerwünschte Anwendung" ac=I fn="E:\DM-PC\Backup Set 2014-04-26 152832\Backup Files 2014-05-12 085214\Backup files 2.zip"

Ich wollte Dich nur informieren, dass sich in Deinen BackUps Malware befindet. Ich werde diese Dateien nicht löschen. Das kannst Du selber machen, falls Du dies machen willst.

Step 1: FRST Fix

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ECOQPT5
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN9CZ5HQ
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MWD2YQ06
E:\Downloads\FreeYouTubeToMP3Converter_3.11.29.825.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Step 2: TFC

Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Step 3: Frage

Wie läuft Dein PC?

Damimo · 17.05.2014, 10:16

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-05-2014
Ran by DM at 2014-05-16 20:03:06 Run:2
Running from C:\Users\DM\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ECOQPT5
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN9CZ5HQ
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MWD2YQ06
E:\Downloads\FreeYouTubeToMP3Converter_3.11.29.825.exe
*****************

C:\Users\DM\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000 => Moved successfully.
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ECOQPT5 => Moved successfully.
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KN9CZ5HQ => Moved successfully.
C:\Users\DM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MWD2YQ06 => Moved successfully.
E:\Downloads\FreeYouTubeToMP3Converter_3.11.29.825.exe => Moved successfully.

==== End of Fixlog ====

Hallo,

also, der PC läuft wieder super! Keine nervigen Fenster mehr. Vielen Dank für Deine Hilfe!!

Was die Backups betrifft, werde ich diese noch löschen.