Antivir durch Gruppenrichtlinie blockiert

Ms Lightyear · 12.05.2014, 22:21

Hi!
Ich brauche eure Hilfe, folgendes:
Mein Antivir lässt sich nicht mehr starten. Stattdessen erscheint die Fehlermeldung "Ausführung durch Gruppenrichtlinie blockiert". Deinstallieren kann ich das Programm ebensowenig.
Ich habe schon malwarebytes, adwcleaner, jrt und FRST durchlaufen lassen und logs dazu erstellt. Diese findet ihr im Anhang

Ich hoffe ihr könnt mir helfen! Auch nach meinen bereits durchgeführten Scans ist immer noch alles wie vorher...

Danke schon mal!

Lieben Gruß
Laura

Machiavelli · 13.05.2014, 06:16

Hallo und willkommen an Board, Ms Lightyear

Mein Name ist Machiavelli und werde bei Deinem Malware Problemen behilflich sein. Falls Du Dich im abgesicherten Modus befindest, würde ich Dir raten, alle Anweisungen von mir auszudrucken, um besseren Überblick auf die Gesamtsituation zu bekommen. Ich bin hier im Malwareteam und daher ist es mir möglich, Dir zu helfen.

Damit eine Bereinigung ermöglicht werden kann, musst Du ein paar Regeln/Tipps beachten:

Malware zu entfernen ist normalerweise recht schwierig
Heutige Malware kann sich sehr gut verstecken, so kann es sein, dass es bestimmte Tools nicht sehen. Eine Neuinstallation ist daher oft das klügere.
Bitte folge meinen Anweisung bis in das kleinste Detail
Falls Du was falsches machst, wie z.B. irgendwas fixt, was nicht durch mich genehmigt wurde, kann der PC dadurch beschädigt werden. Daher folge meinen Anweisungen ganz genau
Bleibe mit mir in Kontakt, bis Deine Probleme vollständig gelöst sind
Themen, in welchen innerhalb von 4 Tagen keine Antwort gepostet wird, werden geschlossen.
Bitte lasse keine anderen Tools laufen, während ich bereinige
Wenn Du Tools wie z.B. Malwarebytes etc. ohne meines Wissens laufen lässt, kann es unter Umständen Ergebnisse verfälschen.
Ließ meine Posts vollständig durch
Falls nicht, kann das zu schwerwiegenden Problemen (z.B. PC bootet nicht mehr) führen oder der Prozess der Malwareentfernung wird länger

Alle Logs in Code Tags posten.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Ms Lightyear · 13.05.2014, 10:18

Hi!
Danke für die schnelle Antwort. Ok dann hier die logfiles noch einmal:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 12.05.2014
Scan Time: 21:48:10
Logfile: 
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.12.07
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7
CPU: x86
File System: NTFS
User: Laura

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 238943
Time Elapsed: 11 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 8
PUP.Optional.WebCake.A, HKLM\SOFTWARE\CLASSES\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}, Quarantined, [087f61ef463588aeac0b7ddd887aa858], 
PUP.Optional.WebCake.A, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517}, Delete-on-Reboot, [9cebec647b00f145d5d1ae7ae31f6997], 
PUP.Optional.Qone8.A, HKLM\SOFTWARE\qone8Software, Quarantined, [691e3719d0ab6dc9730b288f59aad828], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [2a5d222edba0f541359e3c7ce71cd729], 
PUP.Optional.Softonic.A, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\softonicToolbar, Delete-on-Reboot, [3a4d78d8cdae9d9978fec7c1e919df21], 
PUP.Optional.Conduit.A, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, Delete-on-Reboot, [a6e1262a26556dc92e61288abb48ab55], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, Delete-on-Reboot, [335496ba502b0135faee9cfa59a9f10f], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, Delete-on-Reboot, [147387c9f58674c29e6cfdb0b64d0af6], 

Registry Values: 2
Trojan.Ransom.Gend, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|ovjrjxxf, regsvr32.exe "C:\ProgramData\ovjrjxxf.dat", Delete-on-Reboot, [9dead17f413a37ff3cd4c545a8596f91]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1235139973-2671818785-655692419-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, Delete-on-Reboot, [147387c9f58674c29e6cfdb0b64d0af6]

Registry Data: 2
PUP.Optional.Qone8, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1383131214&from=cor&uid=WDCXWD7500BPVT-75A1YT0_WXB1A9216654A9216654, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1383131214&from=cor&uid=WDCXWD7500BPVT-75A1YT0_WXB1A9216654A9216654),Replaced,[96f1afa11368ad89262010351fe5817f]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[cbbc2f21b0cbf541dc6ba99ce91bfe02]

Folders: 19
PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log, Quarantined, [e6a183cd3f3c3600150c266db05253ad], 
PUP.Optional.DigitalSite.A, C:\Users\Laura\AppData\Roaming\DigitalSite\UpdateProc, Quarantined, [cbbc75db83f80c2af4be7f1ad82a7b85], 
Adware.InstallBrain, C:\ProgramData\IBUpdaterService, Quarantined, [c5c28fc1a9d2bf77d304553143c005fb], 
PUP.Optional.OpenCandy, C:\Users\Laura\AppData\Roaming\OpenCandy, Quarantined, [5f28d7796b10ce68b4fa7af3877b2ad6], 
PUP.Optional.OpenCandy, C:\Users\Laura\AppData\Roaming\OpenCandy\C0885A0C001D46ACAF72DC135CABB55E, Quarantined, [5f28d7796b10ce68b4fa7af3877b2ad6], 
PUP.Optional.OpenCandy, C:\Users\Laura\AppData\Roaming\OpenCandy\C3C7CC9DEBBF488EACF6AAF2CCE4E029, Quarantined, [5f28d7796b10ce68b4fa7af3877b2ad6], 
PUP.Optional.OpenCandy, C:\Users\Laura\AppData\Roaming\OpenCandy\OpenCandy_C3C7CC9DEBBF488EACF6AAF2CCE4E029, Quarantined, [5f28d7796b10ce68b4fa7af3877b2ad6], 
PUP.Optional.FileScout.A, C:\Users\Laura\AppData\Roaming\File Scout, Quarantined, [8007fb55176449eddbeba6c7d42ed729], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct2653012, Quarantined, [1770a2aeb3c840f6899cd6987989b54b], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\CT3264748, Quarantined, [3a4db39d7308be78b471c4aa03ffef11], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\xpi, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\xpi\defaults, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\xpi\defaults\preferences, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Temp\mt_ffx\Softonic, Quarantined, [582f5cf47308b6807afce095f90905fb], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Temp\mt_ffx\Softonic\Softonic, Quarantined, [582f5cf47308b6807afce095f90905fb], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Temp\mt_ffx\Softonic\Softonic\1.8.21.14, Quarantined, [582f5cf47308b6807afce095f90905fb], 

Files: 75
Trojan.Ransom.Gend, C:\ProgramData\ovjrjxxf.dat, Quarantined, [9dead17f413a37ff3cd4c545a8596f91], 
PUP.Optional.FileScout.A, C:\Users\Laura\AppData\Roaming\File Scout\filescout.exe, Quarantined, [ec9bbc94de9d3cfacc08f214c53c23dd], 
PUP.Optional.OpenCandy.A, C:\Users\Laura\AppData\Roaming\OpenCandy\C0885A0C001D46ACAF72DC135CABB55E\Setupsft_chr_p1v7.exe, Quarantined, [a8df4e02d2a9fb3be65d023346be1ce4], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct2653012\statisticsStub.exe, Quarantined, [1374401095e685b18c7e36d057aa1de3], 
PUP.Optional.Elex.A, C:\Users\Laura\AppData\Local\Temp\is1590112554\4397234_stp\cor_ar_qone8.exe, Quarantined, [ed9a80d06a1191a5be5857cef30ee917], 
PUP.Optional.RegCleanerPro, C:\Users\Laura\AppData\Local\Temp\is1590112554\4397328_stp\rcpsetup_adppi_adppi.exe, Quarantined, [652259f7d5a6a3936681d534e21f22de], 
PUP.Optional.BatBrowse.A, C:\Users\Laura\AppData\Local\Temp\is1590112554\4397407_stp\BatBrowseSetup.exe, Quarantined, [f394450bafcc7eb819854e83f211639d], 
Trojan.Agent.ED, C:\Users\Laura\AppData\Local\Temp\Low\aof.dll, Quarantined, [5a2d72de5d1e999dde64c0a9c33e728e], 
PUP.Optional.Wsys.A, C:\Users\Laura\AppData\Local\Temp\eIntaller\E2D3C05CD6EE4bfc80C9F0451088193F\eGdpSvc.exe, Quarantined, [097e351b760575c15fd18a9ba55c07f9], 
PUP.Optional.Wilsys.A, C:\Users\Laura\AppData\Local\Temp\eIntaller\E2D3C05CD6EE4bfc80C9F0451088193F\help.exe, Quarantined, [81061739cfacf73f48e713125ba6c43c], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\ctbe.exe, Quarantined, [d0b77cd4c1ba52e4f88c5ac447b99a66], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\ffLogic.exe, Quarantined, [7b0c54fc6f0c092d46c5ea1c6d946898], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\ieLogic.exe, Quarantined, [90f7dd735922a78f513447d4b64b9f61], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\spff.exe, Quarantined, [f790480895e679bdff869982e021a35d], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\statisticsStub.exe, Quarantined, [1d6acb85a6d5ab8bdf2b49bdf809ef11], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\stub.exe, Quarantined, [9ee9460a1b60280e4794e53924dcfd03], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\searchplugins\softonic.xml, Quarantined, [a2e5ce82f08b87af165c8efa9a68c937], 
PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log\eGdpSvc.LOG, Quarantined, [e6a183cd3f3c3600150c266db05253ad], 
PUP.Optional.DigitalSite.A, C:\Users\Laura\AppData\Roaming\DigitalSite\UpdateProc\config.dat, Quarantined, [cbbc75db83f80c2af4be7f1ad82a7b85], 
PUP.Optional.DigitalSite.A, C:\Users\Laura\AppData\Roaming\DigitalSite\UpdateProc\prod.dat, Quarantined, [cbbc75db83f80c2af4be7f1ad82a7b85], 
Adware.InstallBrain, C:\ProgramData\IBUpdaterService\repository.xml, Quarantined, [c5c28fc1a9d2bf77d304553143c005fb], 
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot.exe, Quarantined, [f196014ffa814ceae51e6c426a9908f8], 
PUP.Optional.OpenCandy, C:\Users\Laura\AppData\Roaming\OpenCandy\C3C7CC9DEBBF488EACF6AAF2CCE4E029\TuneUpUtilities2013-2200217-p3v0.exe, Quarantined, [5f28d7796b10ce68b4fa7af3877b2ad6], 
PUP.Optional.FileScout.A, C:\Users\Laura\AppData\Roaming\File Scout\uninst.exe, Quarantined, [8007fb55176449eddbeba6c7d42ed729], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct2653012\ffLogic.exe, Quarantined, [1770a2aeb3c840f6899cd6987989b54b], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\CT3264748\ddt.csf, Quarantined, [3a4db39d7308be78b471c4aa03ffef11], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\chromeid.txt, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\conduit.xml, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\CT3279411.xpi, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\setup.ini.txt, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\version.txt, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\xpi\install.rdf, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Local\Temp\ct3279411\xpi\defaults\preferences\defaults.js, Quarantined, [dcab80d0fa81072f52d3e38b3ec4916f], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\appCntrl.js, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\bg.html, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\bg.js, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\chMntz.dll, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\CrmAdpt.dll, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\ct.js, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\CTB.dll, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\dpk.js, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\hprtkMsg.htm, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\hprtkMsg.js, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\json2.min.js, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\logo.png, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\manifest.json, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Google\Chrome\User Data\default\extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\pref.json, Quarantined, [2463222e92e97cbaf97ba6cfbf43ba46], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Local\Temp\mt_ffx\Softonic\Softonic\1.8.21.14\softonic.xpi, Quarantined, [582f5cf47308b6807afce095f90905fb], 
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.admin", false);), Replaced,[04833b15c0bbc2741a54abc62ed6dc24]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.aflt", "OC");), Replaced,[d0b7014f601bac8a72fcfd74ec1851af]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");), Replaced,[b0d71838b9c2280e8ee0b0c1b94bb947]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.autoRvrt", "false");), Replaced,[6d1ad27e9be04cea78f668094fb526da]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dfltLng", "de");), Replaced,[3651ea66fd7e06307af4b0c122e204fc]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dfltSrch", true);), Replaced,[3d4a3b15b6c57db96b036c05c242e41c]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dnsErr", true);), Replaced,[42453020780361d56707caa749bb24dc]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.excTlbr", false);), Replaced,[7c0b58f88af1b2840767f081ee16629e]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.ffxUnstlRst", false);), Replaced,[c1c6410f730883b3d896df92fa0a847c]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hmpg", true);), Replaced,[394edc740a71fb3bdd91acc517ede917]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=7a1b4f3a00000000000000ff67baf1ee");), Replaced,[315651ffb0cbca6c73fbe88942c27c84]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.id", "7a1b4f3a00000000000000ff67baf1ee");), Replaced,[acdbafa17dfe23134925e8896c9840c0]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.instlDay", "16048");), Replaced,[cbbc1a360378f83ec3ab492809fbcd33]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.instlRef", "MOY00621");), Replaced,[eb9c2b25c7b4092d88e6145d2ed6df21]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newTab", true);), Replaced,[21663c146d0e42f4cca2db96cf358977]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=7a1b4f3a00000000000000ff67baf1ee");), Replaced,[ea9d60f0f08b47ef95d95a17b450c040]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.prdct", "Softonic");), Replaced,[5c2b6de30e6dce680569106128dc1ae6]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.prtnrId", "softonic");), Replaced,[70170e426b104bebb2bc1859788c8a76]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.rvrt", "false");), Replaced,[e1a6cb8583f86dc98de198d90202649c]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.smplGrp", "none");), Replaced,[3651014fd9a29e98df8fe091a95be11f]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");), Replaced,[8afd0f41c3b8d1654d211160d331e020]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.tlbrId", "opencandy2013");), Replaced,[4e3987c9740751e5c4aa5b1641c3e020]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=7a1b4f3a00000000000000ff67baf1ee&q=");), Replaced,[99eea7a9bfbc92a43b3376fb55afa858]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsn", "1.8.21.14");), Replaced,[1374a8a81f5c1a1c2e401e53d72d7b85]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsnTs", "1.8.21.1418:29:51");), Replaced,[612681cf2655ba7cc8a66908ae567d83]
PUP.Optional.Softonic.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsni", "1.8.21.14");), Replaced,[7611e16f0972f34392dce78a1fe5a858]
PUP.Optional.Conduit.A, C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js, Good: (), Bad: (user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=3&q={searchTerms}");), Replaced,[0d7a193777041026cc069ed3ae56d52b]

Physical Sectors: 0
(No malicious items detected)


(end)

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by Laura on 12.05.2014 at 22:16:37,72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{59137BE9-A134-4D50-88F3-998AF7240FAA}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{88FA33A3-7935-49D0-B80C-7196C2DE3B03}



~~~ Files

Successfully deleted: [File] "C:\Users\Laura\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\taskbar\startfenster.lnk"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\big fish games"



~~~ FireFox

Emptied folder: C:\Users\Laura\AppData\Roaming\mozilla\firefox\profiles\vg5xa0kc.default\minidumps [358 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.05.2014 at 22:19:53,01
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:11-05-2014 01
Ran by Laura (administrator) on LAURA-PC on 12-05-2014 22:24:55
Running from C:\Users\Laura\Desktop
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Atheros Communications) C:\Program Files\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AthBtTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(eInstruction Corporation) C:\Program Files\eInstruction\Device Manager\Launch.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737360 2014-04-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1565992 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [474272 2010-07-29] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files\Bluetooth Suite\AthBtTray.exe [298144 2010-07-29] (Atheros Commnucations)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9177632 2010-04-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1423904 2010-04-23] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20924064 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [Facebook Update] => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-04-30] (Facebook Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\eInstruction Device Manager.lnk
ShortcutTarget: eInstruction Device Manager.lnk -> C:\Program Files\eInstruction\Device Manager\Launch.exe (eInstruction Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x73156749CA09CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default
FF Homepage: https://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&seamless=novl&offerId=webmail-de-de&authLev=0&siteState=ver%3A4%7Crt%3ASTANDARD%7Cat%3ASNS%7Cld%3Amail.aol.de%7Cuv%3AAOL%7Clc%3Ade-de%7Cmt%3AANGELIA%7Csnt%3AScreenName%7Csid%3A6f4f5722-6e03-4c7e-b611-09f75c4cb4f2&locale=de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Laura\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: QuickJava - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi [2013-03-29]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [235696 2014-01-16] (McAfee, Inc.)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [36352 2009-12-12] ()

==================== Drivers (Whitelisted) ====================

S3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [34976 2010-07-29] (Atheros)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-02] (Avira Operations GmbH & Co. KG)
S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [255648 2010-07-29] (Atheros)
R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2010-07-29] (Atheros)
S3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [175776 2010-07-29] (Atheros)
S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [45728 2010-07-29] (Atheros)
S3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [141088 2010-07-29] (Atheros)
R3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd32.sys [8750592 2010-10-21] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-13] (Avira GmbH)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-12 22:24 - 2014-05-12 22:25 - 00013605 _____ () C:\Users\Laura\Desktop\FRST.txt
2014-05-12 22:24 - 2014-05-12 22:24 - 01056256 _____ (Farbar) C:\Users\Laura\Desktop\FRST.exe
2014-05-12 22:24 - 2014-05-12 22:24 - 00000000 ____D () C:\FRST
2014-05-12 22:19 - 2014-05-12 22:19 - 00001599 _____ () C:\Users\Laura\Desktop\JRT.txt
2014-05-12 22:13 - 2014-05-12 22:13 - 00000000 ____D () C:\Windows\ERUNT
2014-05-12 22:12 - 2014-05-12 22:12 - 01016261 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe
2014-05-12 22:04 - 2014-05-12 22:06 - 00000000 ____D () C:\AdwCleaner
2014-05-12 22:04 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-12 22:03 - 2014-05-12 22:03 - 01325827 _____ () C:\Users\Laura\Desktop\adwcleaner.exe
2014-05-12 21:36 - 2014-05-12 22:16 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-12 21:36 - 2014-05-12 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-12 21:35 - 2014-05-12 21:36 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-12 21:35 - 2014-05-12 21:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-12 21:35 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 21:35 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 21:35 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 12:49 - 2014-05-11 12:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-06 21:38 - 2014-05-06 21:38 - 00000000 ___RD () C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-05-05 20:57 - 2014-05-05 20:57 - 00000000 ___RD () C:\Users\Laura\Documents\Notes
2014-05-05 15:58 - 2014-05-05 15:58 - 00000000 ____H () C:\Users\Laura\Documents\Default.rdp
2014-05-03 20:51 - 2014-05-03 20:51 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\DropboxMaster
2014-04-30 19:04 - 2014-05-12 22:09 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA.job
2014-04-30 19:04 - 2014-05-11 20:43 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core.job
2014-04-30 19:04 - 2014-04-30 19:04 - 00000000 ____D () C:\Users\Laura\AppData\Local\Facebook
2014-04-29 20:01 - 2012-03-26 05:00 - 00314880 _____ (CANON INC.) C:\Windows\system32\CNMLMB8.DLL
2014-04-24 23:51 - 2014-05-04 12:03 - 00004608 _____ () C:\Users\Laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-18 23:23 - 2014-04-18 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-18 23:23 - 2014-04-14 20:13 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-18 23:23 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-18 23:23 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-18 23:23 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-18 23:22 - 2014-04-18 23:23 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2014-05-12 22:25 - 2014-05-12 22:24 - 00013605 _____ () C:\Users\Laura\Desktop\FRST.txt
2014-05-12 22:24 - 2014-05-12 22:24 - 01056256 _____ (Farbar) C:\Users\Laura\Desktop\FRST.exe
2014-05-12 22:24 - 2014-05-12 22:24 - 00000000 ____D () C:\FRST
2014-05-12 22:22 - 2009-07-14 06:34 - 00014784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-12 22:22 - 2009-07-14 06:34 - 00014784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-12 22:19 - 2014-05-12 22:19 - 00001599 _____ () C:\Users\Laura\Desktop\JRT.txt
2014-05-12 22:19 - 2013-02-13 11:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-12 22:19 - 2013-02-12 22:05 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-12 22:18 - 2013-02-12 21:56 - 01641193 _____ () C:\Windows\WindowsUpdate.log
2014-05-12 22:17 - 2013-06-10 13:06 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\Dropbox
2014-05-12 22:16 - 2014-05-12 21:36 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-12 22:16 - 2013-06-10 13:08 - 00000000 ___RD () C:\Users\Laura\Dropbox
2014-05-12 22:16 - 2013-02-23 20:39 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\Skype
2014-05-12 22:14 - 2013-06-10 20:05 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-05-12 22:14 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-12 22:14 - 2009-07-14 06:39 - 00080158 _____ () C:\Windows\setupact.log
2014-05-12 22:13 - 2014-05-12 22:13 - 00000000 ____D () C:\Windows\ERUNT
2014-05-12 22:12 - 2014-05-12 22:12 - 01016261 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe
2014-05-12 22:09 - 2014-04-30 19:04 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA.job
2014-05-12 22:07 - 2013-02-13 12:12 - 00032432 _____ () C:\Windows\PFRO.log
2014-05-12 22:06 - 2014-05-12 22:04 - 00000000 ____D () C:\AdwCleaner
2014-05-12 22:03 - 2014-05-12 22:03 - 01325827 _____ () C:\Users\Laura\Desktop\adwcleaner.exe
2014-05-12 21:51 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32
2014-05-12 21:36 - 2014-05-12 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-12 21:36 - 2014-05-12 21:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-12 21:35 - 2014-05-12 21:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-12 09:55 - 2013-02-13 11:15 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-11 20:47 - 2013-02-15 11:49 - 00000000 ____D () C:\Users\Laura\AppData\Local\Adobe
2014-05-11 20:47 - 2013-02-13 11:26 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-11 20:47 - 2013-02-13 11:26 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-11 20:43 - 2014-04-30 19:04 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core.job
2014-05-11 12:49 - 2014-05-11 12:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-06 21:38 - 2014-05-06 21:38 - 00000000 ___RD () C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-05-05 20:57 - 2014-05-05 20:57 - 00000000 ___RD () C:\Users\Laura\Documents\Notes
2014-05-05 15:58 - 2014-05-05 15:58 - 00000000 ____H () C:\Users\Laura\Documents\Default.rdp
2014-05-04 12:07 - 2013-03-13 17:23 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\vlc
2014-05-04 12:03 - 2014-04-24 23:51 - 00004608 _____ () C:\Users\Laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-03 20:51 - 2014-05-03 20:51 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\DropboxMaster
2014-05-03 20:51 - 2013-06-10 13:06 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-03 05:07 - 2013-03-17 19:34 - 00000000 ____D () C:\Users\Laura\AppData\Local\CrashDumps
2014-04-30 19:04 - 2014-04-30 19:04 - 00000000 ____D () C:\Users\Laura\AppData\Local\Facebook
2014-04-29 10:24 - 2013-02-13 11:18 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-04-29 10:24 - 2013-02-13 11:18 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-04-28 22:56 - 2014-01-11 23:02 - 00000000 ____D () C:\Users\Laura\Documents\Bluetooth Folder
2014-04-28 22:56 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-18 23:23 - 2014-04-18 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-18 23:23 - 2014-04-18 23:22 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-04-18 23:23 - 2013-10-20 19:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-18 23:23 - 2013-06-26 23:01 - 00000000 ____D () C:\Program Files\Java
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iPod
2014-04-16 20:55 - 2013-09-09 15:45 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-14 20:13 - 2014-04-18 23:23 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-14 20:05 - 2014-04-18 23:23 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-14 20:05 - 2014-04-18 23:23 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-14 20:04 - 2014-04-18 23:23 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe

Files to move or delete:
====================
C:\Users\Laura\Supreme.exe


Some content of TEMP:
====================
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3vgphv.dll
C:\Users\Laura\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Laura\AppData\Local\Temp\ose00000.exe
C:\Users\Laura\AppData\Local\Temp\Quarantine.exe
C:\Users\Laura\AppData\Local\Temp\vlc-2.1.3-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 19:25

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:11-05-2014 01
Ran by Laura at 2014-05-12 22:25:24
Running from C:\Users\Laura\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.23 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\...\{7849B77A-3769-7B88-9596-5F2826B30C3F}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.614 - Avira)
Big Fish Games: Game Manager (HKLM\...\BFGC) (Version: 3.0.1.60 - )
Bluetooth Win7 Suite (HKLM\...\{101A497C-7EF6-4001-834D-E5FA1C70FEFA}) (Version: 7.02.000.6 - Atheros Communications)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Cambridge English Pronouncing Dictionary - 18th Edition (HKLM\...\NSIS_cepd) (Version:  - )
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2010.1021.531.7998 - ATI) Hidden
Catalyst Control Center InstallProxy (Version: 2010.1021.531.7998 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2010.1021.531.7998 - ATI) Hidden
CCC Help Chinese Standard (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Czech (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Danish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Dutch (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help English (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Finnish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help French (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help German (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Greek (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Hungarian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Italian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Japanese (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Korean (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Norwegian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Polish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Portuguese (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Russian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Spanish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Swedish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Thai (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Turkish (Version: 2010.1021.0530.7998 - ATI) Hidden
ccc-core-static (Version: 2010.1021.531.7998 - Ihr Firmenname) Hidden
ccc-utility (Version: 2010.1021.531.7998 - ATI) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version:  - Microsoft)
DeviceManager (HKLM\...\DeviceManager) (Version: 7.1.134.71814  - eInstruction)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.31 - Dropbox, Inc.)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Free YouTube Download version 3.2.18.1128 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.18.1128 - DVDVideoSoft Ltd.)
Freeplane (HKLM\...\{D3941722-C4DD-4509-88C4-0E87F675A859}_is1) (Version: 1.2.23 - Open source)
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{CCAFF072-4DDB-4846-963D-15F02A8E9472}) (Version: 13.00.0000 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.6.1001 - Intel Corporation)
iTunes (HKLM\...\{2F21564D-DE05-4C6D-B21E-08B9D313FAB3}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mystery of Mortlake Mansion (HKLM\...\BFG-Mystery of Mortlake Mansion) (Version:  - )
OpenVPN 2.1.1 (HKLM\...\OpenVPN) (Version: 2.1.1 - )
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PX Profile Update (Version: 1.00.1. - AMD) Hidden
RCT3 Soaked (HKLM\...\{EA926717-CE5A-4CB4-AB21-9E6E9565A458}) (Version: 1.00.000 - )
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6096 - Realtek Semiconductor Corp.)
RollerCoaster Tycoon 3 (HKLM\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
Timon & Pumbaa's Jungle Games (HKLM\...\Timon & Pumbaa's Jungle Games_is1) (Version:  - GameFabrique)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WorkSpace (HKLM\...\{4EEA8A8A-6532-4A3E-8B00-DCC090FE902E}) (Version: 9.2.97.71415 - eInstruction)

==================== Restore Points  =========================

09-04-2014 21:36:16 Windows Update
18-04-2014 21:22:12 Installed Java 7 Update 55
26-04-2014 13:13:41 Geplanter Prüfpunkt
04-05-2014 13:26:53 Geplanter Prüfpunkt
11-05-2014 15:39:04 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1E7B52C1-F511-4E17-AF06-F705B6EDCC0E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {216B673C-B5A9-433A-884F-E183E89780E7} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
Task: {31DFA380-FBB3-46E1-B4F5-25A5B7A1B113} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-30] (Facebook Inc.)
Task: {324B3412-BD0D-4ACA-AA22-D0B4E0D6DF31} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-11] (Adobe Systems Incorporated)
Task: {4CE9891A-B3AF-4110-8693-88E7890FA025} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {911A4548-1814-43C1-8839-13A7538923BA} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {986C4B49-D001-4B69-A8D4-E46F69B10AE3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C79E9720-0D23-4DBA-8858-B1A53E281858} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-30] (Facebook Inc.)
Task: {E049ADEA-B396-44A2-9BF4-26D99E08C9B2} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core.job => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA.job => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-02-13 01:42 - 2009-12-23 18:32 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
2014-02-19 20:31 - 2011-11-09 19:17 - 00225280 _____ () C:\Program Files\eInstruction\Device Manager\STTubeDevice30.dll
2014-02-19 20:31 - 2013-03-22 14:27 - 00304640 _____ () C:\Program Files\eInstruction\Device Manager\NativeSupport.dll
2014-02-19 20:31 - 2010-12-10 13:04 - 00098304 _____ () C:\Program Files\eInstruction\Device Manager\jspWin.dll
2014-05-12 22:16 - 2014-05-12 22:16 - 00041984 _____ () c:\users\laura\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3vgphv.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Laura\AppData\Roaming\Dropbox\bin\libcef.dll
2010-08-26 16:45 - 2010-08-26 16:45 - 00016384 ____R () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-10-21 06:30 - 2010-10-21 06:30 - 00270336 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-05-11 12:49 - 2014-05-11 12:49 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-04-29 10:20 - 2014-05-11 20:47 - 16351920 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:7ADB695A

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-05-12 22:16:07.993
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 22:08:44.467
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 21:52:57.610
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 21:07:30.604
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 10:00:02.905
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-11 11:46:45.904
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-11 01:26:39.145
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-10 18:44:04.649
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-10 00:54:07.804
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:35:03.730
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 2870.69 MB
Available physical RAM: 1567.83 MB
Total Pagefile: 5739.65 MB
Available Pagefile: 4010.78 MB
Total Virtual: 2047.88 MB
Available Virtual: 1878.63 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:698.54 GB) (Free:586.18 GB) NTFS
Drive d: (MONACO_FRANZE_DISK_3) (CDROM) (Total:7.79 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: AACB90F1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Ich hoffe das passt jetzt so. Ich habe auch den awg cleaner durchlaufen lassen, aber leider ist mir da das logfile abhanden gekommen.

Sorry.

Besten Gruß,
Laura

Machiavelli · 13.05.2014, 15:52

Befindet sich Adwareclean Log vll hier: C:\AdwCleaner\

Ms Lightyear · 13.05.2014, 17:10

Hi!
Ja super, du hattest recht, hier bitteschön:

Code:

ATTFilter

# AdwCleaner v3.208 - Bericht erstellt am 12/05/2014 um 22:04:09
# Aktualisiert 11/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (32 bits)
# Benutzername : Laura - LAURA-PC
# Gestartet von : C:\Users\Laura\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\END
Datei Gefunden : C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk
Datei Gefunden : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\user.js
Datei Gefunden : C:\Windows\System32\Tasks\DigitalSite
Datei Gefunden : C:\Windows\Tasks\DigitalSite.job
Ordner Gefunden : C:\Program Files\Conduit
Ordner Gefunden : C:\Program Files\MyPC Backup
Ordner Gefunden : C:\ProgramData\eSafe
Ordner Gefunden : C:\ProgramData\Tarma Installer
Ordner Gefunden : C:\Users\Laura\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Laura\AppData\Local\Temp\eIntaller
Ordner Gefunden : C:\Users\Laura\AppData\Local\Temp\mt_ffx
Ordner Gefunden : C:\Users\Laura\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Laura\AppData\Roaming\digitalsite
Ordner Gefunden : C:\Users\Laura\AppData\Roaming\PerformerSoft
Ordner Gefunden : C:\Users\Laura\AppData\Roaming\Systweak

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\dsiteproducts
Schlüssel Gefunden : HKCU\Software\filescout
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT3279411
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowse_Setup_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowse_Setup_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowseSetup_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowseSetup_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04039795-199D-4BE3-B64C-B121E1D7F0E8}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04039795-199D-4BE3-B64C-B121E1D7F0E8}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5E02F60D-B659-468D-9898-062C6D18B73C}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\Software\systweak
Schlüssel Gefunden : HKLM\Software\Tarma Installer
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js ]

Zeile gefunden : user_pref("CT3279411.FF19Solved", "true");
Zeile gefunden : user_pref("CT3279411.UserID", "UN37862903111904218");
Zeile gefunden : user_pref("CT3279411.browser.search.defaultthis.engineName", "true");
Zeile gefunden : user_pref("CT3279411.fullUserID", "UN37862903111904218.IN.20130802203544");
Zeile gefunden : user_pref("CT3279411.installDate", "02/08/2013 20:35:44");
Zeile gefunden : user_pref("CT3279411.installSessionId", "{398F09AE-30FB-4C46-91C3-41AEE01E5DA4}");
Zeile gefunden : user_pref("CT3279411.installSp", "TRUE");
Zeile gefunden : user_pref("CT3279411.installerVersion", "1.5.4.5");
Zeile gefunden : user_pref("CT3279411.keyword", "true");
Zeile gefunden : user_pref("CT3279411.originalHomepage", "hxxps://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&seamless=novl&offerId=webmail-de-de&authLev=0&siteState=ver%3A4%7Crt%[...]
Zeile gefunden : user_pref("CT3279411.originalSearchAddressUrl", "");
Zeile gefunden : user_pref("CT3279411.originalSearchEngine", "");
Zeile gefunden : user_pref("CT3279411.originalSearchEngineName", "");
Zeile gefunden : user_pref("CT3279411.searchRevert", "false");
Zeile gefunden : user_pref("CT3279411.searchUserMode", "2");
Zeile gefunden : user_pref("CT3279411.smartbar.homepage", "true");
Zeile gefunden : user_pref("CT3279411.versionFromInstaller", "10.16.9.6");
Zeile gefunden : user_pref("CT3279411.xpeMode", "0");
Zeile gefunden : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3279411&octid=CT3279411&SearchSource=61&CUI=UN37862903111904218&UM=2&UP=SPDCCE1F2A-7B89-48D8-B081-ACD6407793A3");
Zeile gefunden : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gefunden : user_pref("browser.search.defaultthis.engineName", "appbario12 Customized Web Search");
Zeile gefunden : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=3&q={searchTerms}");
Zeile gefunden : user_pref("extensions.Softonic.admin", false);
Zeile gefunden : user_pref("extensions.Softonic.aflt", "OC");
Zeile gefunden : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Zeile gefunden : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gefunden : user_pref("extensions.Softonic.dfltSrch", true);
Zeile gefunden : user_pref("extensions.Softonic.dnsErr", true);
Zeile gefunden : user_pref("extensions.Softonic.excTlbr", false);
Zeile gefunden : user_pref("extensions.Softonic.ffxUnstlRst", false);
Zeile gefunden : user_pref("extensions.Softonic.hmpg", true);
Zeile gefunden : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=7a1b4f3a00000000000000ff67baf1ee");
Zeile gefunden : user_pref("extensions.Softonic.id", "7a1b4f3a00000000000000ff67baf1ee");
Zeile gefunden : user_pref("extensions.Softonic.instlDay", "16048");
Zeile gefunden : user_pref("extensions.Softonic.instlRef", "MOY00621");
Zeile gefunden : user_pref("extensions.Softonic.newTab", true);
Zeile gefunden : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=7a1b4f3a00000000000000ff67baf1ee");
Zeile gefunden : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gefunden : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gefunden : user_pref("extensions.Softonic.rvrt", "false");
Zeile gefunden : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gefunden : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Zeile gefunden : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Zeile gefunden : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=7a1b4f3a00000000000000ff67baf1ee&q=");
Zeile gefunden : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Zeile gefunden : user_pref("extensions.Softonic.vrsnTs", "1.8.21.1418:29:51");
Zeile gefunden : user_pref("extensions.Softonic.vrsni", "1.8.21.14");
Zeile gefunden : user_pref("smartbar.addressBarOwnerCTID", "CT3279411");
Zeile gefunden : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3279411&octid=CT3279411&SearchSource[...]
Zeile gefunden : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&SearchSource=2&CUI=UN37862903111904218&UM=2&q=");
Zeile gefunden : user_pref("smartbar.defaultSearchOwnerCTID", "CT3279411");
Zeile gefunden : user_pref("smartbar.homePageOwnerCTID", "CT3279411");
Zeile gefunden : user_pref("smartbar.machineId", "VGERMS7FFKWARHECUWLXY7UPAPTABK53DETASI4TPGE/NYVKBBRSEYNH4CLLZF0TX7DEY85M1/A1MP3HJ2SHBG");
Zeile gefunden : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=13");

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [10449 octets] - [12/05/2014 22:04:09]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [10510 octets] ##########

Code:

ATTFilter

# AdwCleaner v3.208 - Bericht erstellt am 12/05/2014 um 22:06:12
# Aktualisiert 11/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (32 bits)
# Benutzername : Laura - LAURA-PC
# Gestartet von : C:\Users\Laura\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\MyPC Backup
Ordner Gelöscht : C:\Users\Laura\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Laura\AppData\Local\Temp\eIntaller
Ordner Gelöscht : C:\Users\Laura\AppData\Local\Temp\mt_ffx
Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Systweak
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk
Datei Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\user.js
Datei Gelöscht : C:\Windows\Tasks\DigitalSite.job
Datei Gelöscht : C:\Windows\System32\Tasks\DigitalSite

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04039795-199D-4BE3-B64C-B121E1D7F0E8}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04039795-199D-4BE3-B64C-B121E1D7F0E8}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5E02F60D-B659-468D-9898-062C6D18B73C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowse_Setup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowse_Setup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowseSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BatBrowseSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3279411
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Tarma Installer

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\prefs.js ]

Zeile gelöscht : user_pref("CT3279411.FF19Solved", "true");
Zeile gelöscht : user_pref("CT3279411.UserID", "UN37862903111904218");
Zeile gelöscht : user_pref("CT3279411.browser.search.defaultthis.engineName", "true");
Zeile gelöscht : user_pref("CT3279411.fullUserID", "UN37862903111904218.IN.20130802203544");
Zeile gelöscht : user_pref("CT3279411.installDate", "02/08/2013 20:35:44");
Zeile gelöscht : user_pref("CT3279411.installSessionId", "{398F09AE-30FB-4C46-91C3-41AEE01E5DA4}");
Zeile gelöscht : user_pref("CT3279411.installSp", "TRUE");
Zeile gelöscht : user_pref("CT3279411.installerVersion", "1.5.4.5");
Zeile gelöscht : user_pref("CT3279411.keyword", "true");
Zeile gelöscht : user_pref("CT3279411.originalHomepage", "hxxps://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&seamless=novl&offerId=webmail-de-de&authLev=0&siteState=ver%3A4%7Crt%[...]
Zeile gelöscht : user_pref("CT3279411.originalSearchAddressUrl", "");
Zeile gelöscht : user_pref("CT3279411.originalSearchEngine", "");
Zeile gelöscht : user_pref("CT3279411.originalSearchEngineName", "");
Zeile gelöscht : user_pref("CT3279411.searchRevert", "false");
Zeile gelöscht : user_pref("CT3279411.searchUserMode", "2");
Zeile gelöscht : user_pref("CT3279411.smartbar.homepage", "true");
Zeile gelöscht : user_pref("CT3279411.versionFromInstaller", "10.16.9.6");
Zeile gelöscht : user_pref("CT3279411.xpeMode", "0");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3279411&octid=CT3279411&SearchSource=61&CUI=UN37862903111904218&UM=2&UP=SPDCCE1F2A-7B89-48D8-B081-ACD6407793A3");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "appbario12 Customized Web Search");
Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=3&q={searchTerms}");
Zeile gelöscht : user_pref("extensions.Softonic.admin", false);
Zeile gelöscht : user_pref("extensions.Softonic.aflt", "OC");
Zeile gelöscht : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Zeile gelöscht : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.Softonic.dfltSrch", true);
Zeile gelöscht : user_pref("extensions.Softonic.dnsErr", true);
Zeile gelöscht : user_pref("extensions.Softonic.excTlbr", false);
Zeile gelöscht : user_pref("extensions.Softonic.ffxUnstlRst", false);
Zeile gelöscht : user_pref("extensions.Softonic.hmpg", true);
Zeile gelöscht : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=7a1b4f3a00000000000000ff67baf1ee");
Zeile gelöscht : user_pref("extensions.Softonic.id", "7a1b4f3a00000000000000ff67baf1ee");
Zeile gelöscht : user_pref("extensions.Softonic.instlDay", "16048");
Zeile gelöscht : user_pref("extensions.Softonic.instlRef", "MOY00621");
Zeile gelöscht : user_pref("extensions.Softonic.newTab", true);
Zeile gelöscht : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=7a1b4f3a00000000000000ff67baf1ee");
Zeile gelöscht : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gelöscht : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gelöscht : user_pref("extensions.Softonic.rvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=7a1b4f3a00000000000000ff67baf1ee&q=");
Zeile gelöscht : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Zeile gelöscht : user_pref("extensions.Softonic.vrsnTs", "1.8.21.1418:29:51");
Zeile gelöscht : user_pref("extensions.Softonic.vrsni", "1.8.21.14");
Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3279411");
Zeile gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3279411&octid=CT3279411&SearchSource[...]
Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&SearchSource=2&CUI=UN37862903111904218&UM=2&q=");
Zeile gelöscht : user_pref("smartbar.defaultSearchOwnerCTID", "CT3279411");
Zeile gelöscht : user_pref("smartbar.homePageOwnerCTID", "CT3279411");
Zeile gelöscht : user_pref("smartbar.machineId", "VGERMS7FFKWARHECUWLXY7UPAPTABK53DETASI4TPGE/NYVKBBRSEYNH4CLLZF0TX7DEY85M1/A1MP3HJ2SHBG");
Zeile gelöscht : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3279411&CUI=UN37862903111904218&UM=2&SearchSource=13");

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [10591 octets] - [12/05/2014 22:04:09]
AdwCleaner[S0].txt - [10523 octets] - [12/05/2014 22:06:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10584 octets] ##########

Machiavelli · 13.05.2014, 17:18

Hey,
schaut schon ziemlich gut aus.

Schritt 1: FRST Fix

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
SearchScopes: HKLM - DefaultScope value is missing.
FF Homepage: https://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&seamless=novl&offerId=webmail-de-de&authLev=0&siteState=ver%3A4%7Crt%3ASTANDARD%7Cat%3ASNS%7Cld%3Amail.aol.de%7Cuv%3AAOL%7Clc%3Ade-de%7Cmt%3AANGELIA%7Csnt%3AScreenName%7Csid%3A6f4f5722-6e03-4c7e-b611-09f75c4cb4f2&locale=de
C:\Users\Laura\Supreme.exe
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3vgphv.dll
C:\Users\Laura\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Laura\AppData\Local\Temp\ose00000.exe
C:\Users\Laura\AppData\Local\Temp\vlc-2.1.3-win32.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2: FRST Scan

Bitte starte FRST erneut, setze den Haken auch bei Addition.txt und drücke auf Scan.

Schritt 3: ESET Scan

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Ms Lightyear · 13.05.2014, 17:30

Danke für die schnelle Antwort! Hier schon mal das fixlog-file

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:11-05-2014 01
Ran by Laura at 2014-05-13 18:20:11 Run:1
Running from C:\Users\Laura\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
SearchScopes: HKLM - DefaultScope value is missing.
FF Homepage: https://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&seamless=novl&offerId=webmail-de-de&authLev=0&siteState=ver%3A4%7Crt%3ASTANDARD%7Cat%3ASNS%7Cld%3Amail.aol.de%7Cuv%3AAOL%7Clc%3Ade-de%7Cmt%3AANGELIA%7Csnt%3AScreenName%7Csid%3A6f4f5722-6e03-4c7e-b611-09f75c4cb4f2&locale=de
C:\Users\Laura\Supreme.exe
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3vgphv.dll
C:\Users\Laura\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Laura\AppData\Local\Temp\ose00000.exe
C:\Users\Laura\AppData\Local\Temp\vlc-2.1.3-win32.exe
         
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
Firefox homepage deleted successfully.
C:\Users\Laura\Supreme.exe => Moved successfully.
C:\Users\Laura\AppData\Local\Temp\avgnt.exe => Moved successfully.
"C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3vgphv.dll" => File/Directory not found.
C:\Users\Laura\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe => Moved successfully.
C:\Users\Laura\AppData\Local\Temp\ose00000.exe => Moved successfully.
C:\Users\Laura\AppData\Local\Temp\vlc-2.1.3-win32.exe => Moved successfully.

==== End of Fixlog ====

Und das logfile von FRST nach dem erneuten Scan:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:11-05-2014 01
Ran by Laura (administrator) on LAURA-PC on 13-05-2014 18:21:40
Running from C:\Users\Laura\Desktop
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Atheros Communications) C:\Program Files\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AthBtTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(eInstruction Corporation) C:\Program Files\eInstruction\Device Manager\Launch.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737360 2014-04-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1565992 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [474272 2010-07-29] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files\Bluetooth Suite\AthBtTray.exe [298144 2010-07-29] (Atheros Commnucations)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9177632 2010-04-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1423904 2010-04-23] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20924064 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-1235139973-2671818785-655692419-1000\...\Run: [Facebook Update] => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-04-30] (Facebook Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\eInstruction Device Manager.lnk
ShortcutTarget: eInstruction Device Manager.lnk -> C:\Program Files\eInstruction\Device Manager\Launch.exe (eInstruction Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x73156749CA09CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Laura\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: QuickJava - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\vg5xa0kc.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi [2013-03-29]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [235696 2014-01-16] (McAfee, Inc.)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [36352 2009-12-12] ()

==================== Drivers (Whitelisted) ====================

S3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [34976 2010-07-29] (Atheros)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-02] (Avira Operations GmbH & Co. KG)
S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [255648 2010-07-29] (Atheros)
R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2010-07-29] (Atheros)
S3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [175776 2010-07-29] (Atheros)
S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [45728 2010-07-29] (Atheros)
S3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [141088 2010-07-29] (Atheros)
R3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd32.sys [8750592 2010-10-21] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-13] (Avira GmbH)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2009-12-12] (The OpenVPN Project)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-12 22:38 - 2014-05-12 22:38 - 00077358 _____ () C:\Users\Laura\Desktop\OTL.Txt
2014-05-12 22:38 - 2014-05-12 22:38 - 00035536 _____ () C:\Users\Laura\Desktop\Extras.Txt
2014-05-12 22:34 - 2014-05-12 22:34 - 00602112 _____ (OldTimer Tools) C:\Users\Laura\Desktop\OTL.exe
2014-05-12 22:25 - 2014-05-12 22:25 - 00023258 _____ () C:\Users\Laura\Desktop\Addition.txt
2014-05-12 22:24 - 2014-05-13 18:21 - 00012897 _____ () C:\Users\Laura\Desktop\FRST.txt
2014-05-12 22:24 - 2014-05-13 18:21 - 00000000 ____D () C:\FRST
2014-05-12 22:24 - 2014-05-12 22:24 - 01056256 _____ (Farbar) C:\Users\Laura\Desktop\FRST.exe
2014-05-12 22:19 - 2014-05-12 22:19 - 00001599 _____ () C:\Users\Laura\Desktop\JRT.txt
2014-05-12 22:13 - 2014-05-12 22:13 - 00000000 ____D () C:\Windows\ERUNT
2014-05-12 22:12 - 2014-05-12 22:12 - 01016261 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe
2014-05-12 22:04 - 2014-05-12 23:04 - 00000000 ____D () C:\AdwCleaner
2014-05-12 22:04 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-12 22:03 - 2014-05-12 22:03 - 01325827 _____ () C:\Users\Laura\Desktop\adwcleaner.exe
2014-05-12 21:36 - 2014-05-13 18:00 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-12 21:36 - 2014-05-12 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-12 21:35 - 2014-05-12 21:36 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-12 21:35 - 2014-05-12 21:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-12 21:35 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 21:35 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 21:35 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 12:49 - 2014-05-11 12:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-06 21:38 - 2014-05-06 21:38 - 00000000 ___RD () C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-05-05 20:57 - 2014-05-05 20:57 - 00000000 ___RD () C:\Users\Laura\Documents\Notes
2014-05-05 15:58 - 2014-05-05 15:58 - 00000000 ____H () C:\Users\Laura\Documents\Default.rdp
2014-05-03 20:51 - 2014-05-03 20:51 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\DropboxMaster
2014-04-30 19:04 - 2014-05-13 13:09 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA.job
2014-04-30 19:04 - 2014-05-11 20:43 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core.job
2014-04-30 19:04 - 2014-04-30 19:04 - 00000000 ____D () C:\Users\Laura\AppData\Local\Facebook
2014-04-29 20:01 - 2012-03-26 05:00 - 00314880 _____ (CANON INC.) C:\Windows\system32\CNMLMB8.DLL
2014-04-24 23:51 - 2014-05-04 12:03 - 00004608 _____ () C:\Users\Laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-18 23:23 - 2014-04-18 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-18 23:23 - 2014-04-14 20:13 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-18 23:23 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-18 23:23 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-18 23:23 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-18 23:22 - 2014-04-18 23:23 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2014-05-13 18:21 - 2014-05-12 22:24 - 00012897 _____ () C:\Users\Laura\Desktop\FRST.txt
2014-05-13 18:21 - 2014-05-12 22:24 - 00000000 ____D () C:\FRST
2014-05-13 18:20 - 2013-02-23 20:39 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\Skype
2014-05-13 18:20 - 2013-02-13 01:23 - 00000000 ____D () C:\Users\Laura
2014-05-13 18:19 - 2013-02-13 11:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-13 18:06 - 2009-07-14 06:34 - 00014784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-13 18:06 - 2009-07-14 06:34 - 00014784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-13 18:05 - 2009-07-14 06:39 - 00080438 _____ () C:\Windows\setupact.log
2014-05-13 18:03 - 2013-02-12 22:05 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-13 18:02 - 2013-02-12 21:56 - 01666404 _____ () C:\Windows\WindowsUpdate.log
2014-05-13 18:00 - 2014-05-12 21:36 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-13 18:00 - 2013-06-10 13:08 - 00000000 ___RD () C:\Users\Laura\Dropbox
2014-05-13 18:00 - 2013-06-10 13:06 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\Dropbox
2014-05-13 17:59 - 2013-06-10 20:05 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-05-13 17:58 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-13 13:09 - 2014-04-30 19:04 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA.job
2014-05-12 23:05 - 2013-02-13 12:12 - 00032742 _____ () C:\Windows\PFRO.log
2014-05-12 23:04 - 2014-05-12 22:04 - 00000000 ____D () C:\AdwCleaner
2014-05-12 22:38 - 2014-05-12 22:38 - 00077358 _____ () C:\Users\Laura\Desktop\OTL.Txt
2014-05-12 22:38 - 2014-05-12 22:38 - 00035536 _____ () C:\Users\Laura\Desktop\Extras.Txt
2014-05-12 22:34 - 2014-05-12 22:34 - 00602112 _____ (OldTimer Tools) C:\Users\Laura\Desktop\OTL.exe
2014-05-12 22:25 - 2014-05-12 22:25 - 00023258 _____ () C:\Users\Laura\Desktop\Addition.txt
2014-05-12 22:24 - 2014-05-12 22:24 - 01056256 _____ (Farbar) C:\Users\Laura\Desktop\FRST.exe
2014-05-12 22:19 - 2014-05-12 22:19 - 00001599 _____ () C:\Users\Laura\Desktop\JRT.txt
2014-05-12 22:13 - 2014-05-12 22:13 - 00000000 ____D () C:\Windows\ERUNT
2014-05-12 22:12 - 2014-05-12 22:12 - 01016261 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe
2014-05-12 22:03 - 2014-05-12 22:03 - 01325827 _____ () C:\Users\Laura\Desktop\adwcleaner.exe
2014-05-12 21:51 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32
2014-05-12 21:36 - 2014-05-12 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-12 21:36 - 2014-05-12 21:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-12 21:35 - 2014-05-12 21:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-12 09:55 - 2013-02-13 11:15 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-11 20:47 - 2013-02-15 11:49 - 00000000 ____D () C:\Users\Laura\AppData\Local\Adobe
2014-05-11 20:47 - 2013-02-13 11:26 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-11 20:47 - 2013-02-13 11:26 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-11 20:43 - 2014-04-30 19:04 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core.job
2014-05-11 12:49 - 2014-05-11 12:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-06 21:38 - 2014-05-06 21:38 - 00000000 ___RD () C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-05-05 20:57 - 2014-05-05 20:57 - 00000000 ___RD () C:\Users\Laura\Documents\Notes
2014-05-05 15:58 - 2014-05-05 15:58 - 00000000 ____H () C:\Users\Laura\Documents\Default.rdp
2014-05-04 12:07 - 2013-03-13 17:23 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\vlc
2014-05-04 12:03 - 2014-04-24 23:51 - 00004608 _____ () C:\Users\Laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-03 20:51 - 2014-05-03 20:51 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\DropboxMaster
2014-05-03 20:51 - 2013-06-10 13:06 - 00000000 ____D () C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-03 05:07 - 2013-03-17 19:34 - 00000000 ____D () C:\Users\Laura\AppData\Local\CrashDumps
2014-04-30 19:04 - 2014-04-30 19:04 - 00000000 ____D () C:\Users\Laura\AppData\Local\Facebook
2014-04-29 10:24 - 2013-02-13 11:18 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-04-29 10:24 - 2013-02-13 11:18 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-04-28 22:56 - 2014-01-11 23:02 - 00000000 ____D () C:\Users\Laura\Documents\Bluetooth Folder
2014-04-28 22:56 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-18 23:23 - 2014-04-18 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-18 23:23 - 2014-04-18 23:22 - 00004241 _____ () C:\Windows\system32\jupdate-1.7.0_55-b14.log
2014-04-18 23:23 - 2013-10-20 19:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-18 23:23 - 2013-06-26 23:01 - 00000000 ____D () C:\Program Files\Java
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iTunes
2014-04-16 20:55 - 2014-04-16 20:55 - 00000000 ____D () C:\Program Files\iPod
2014-04-16 20:55 - 2013-09-09 15:45 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-14 20:13 - 2014-04-18 23:23 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-14 20:05 - 2014-04-18 23:23 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-14 20:05 - 2014-04-18 23:23 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-14 20:04 - 2014-04-18 23:23 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe

Some content of TEMP:
====================
C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_6yuqh.dll
C:\Users\Laura\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 19:25

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:11-05-2014 01
Ran by Laura at 2014-05-13 18:22:11
Running from C:\Users\Laura\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.23 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\...\{7849B77A-3769-7B88-9596-5F2826B30C3F}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.614 - Avira)
Big Fish Games: Game Manager (HKLM\...\BFGC) (Version: 3.0.1.60 - )
Bluetooth Win7 Suite (HKLM\...\{101A497C-7EF6-4001-834D-E5FA1C70FEFA}) (Version: 7.02.000.6 - Atheros Communications)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Cambridge English Pronouncing Dictionary - 18th Edition (HKLM\...\NSIS_cepd) (Version:  - )
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2010.1021.531.7998 - ATI) Hidden
Catalyst Control Center InstallProxy (Version: 2010.1021.531.7998 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2010.1021.531.7998 - ATI) Hidden
CCC Help Chinese Standard (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Czech (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Danish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Dutch (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help English (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Finnish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help French (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help German (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Greek (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Hungarian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Italian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Japanese (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Korean (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Norwegian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Polish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Portuguese (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Russian (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Spanish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Swedish (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Thai (Version: 2010.1021.0530.7998 - ATI) Hidden
CCC Help Turkish (Version: 2010.1021.0530.7998 - ATI) Hidden
ccc-core-static (Version: 2010.1021.531.7998 - Ihr Firmenname) Hidden
ccc-utility (Version: 2010.1021.531.7998 - ATI) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version:  - Microsoft)
DeviceManager (HKLM\...\DeviceManager) (Version: 7.1.134.71814  - eInstruction)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.31 - Dropbox, Inc.)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Free YouTube Download version 3.2.18.1128 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.18.1128 - DVDVideoSoft Ltd.)
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{CCAFF072-4DDB-4846-963D-15F02A8E9472}) (Version: 13.00.0000 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.6.1001 - Intel Corporation)
iTunes (HKLM\...\{2F21564D-DE05-4C6D-B21E-08B9D313FAB3}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mystery of Mortlake Mansion (HKLM\...\BFG-Mystery of Mortlake Mansion) (Version:  - )
OpenVPN 2.1.1 (HKLM\...\OpenVPN) (Version: 2.1.1 - )
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PX Profile Update (Version: 1.00.1. - AMD) Hidden
RCT3 Soaked (HKLM\...\{EA926717-CE5A-4CB4-AB21-9E6E9565A458}) (Version: 1.00.000 - )
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6096 - Realtek Semiconductor Corp.)
RollerCoaster Tycoon 3 (HKLM\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
Timon & Pumbaa's Jungle Games (HKLM\...\Timon & Pumbaa's Jungle Games_is1) (Version:  - GameFabrique)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WorkSpace (HKLM\...\{4EEA8A8A-6532-4A3E-8B00-DCC090FE902E}) (Version: 9.2.97.71415 - eInstruction)

==================== Restore Points  =========================

09-04-2014 21:36:16 Windows Update
18-04-2014 21:22:12 Installed Java 7 Update 55
26-04-2014 13:13:41 Geplanter Prüfpunkt
04-05-2014 13:26:53 Geplanter Prüfpunkt
11-05-2014 15:39:04 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1E7B52C1-F511-4E17-AF06-F705B6EDCC0E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {216B673C-B5A9-433A-884F-E183E89780E7} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
Task: {31DFA380-FBB3-46E1-B4F5-25A5B7A1B113} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-30] (Facebook Inc.)
Task: {324B3412-BD0D-4ACA-AA22-D0B4E0D6DF31} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-11] (Adobe Systems Incorporated)
Task: {4CE9891A-B3AF-4110-8693-88E7890FA025} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {911A4548-1814-43C1-8839-13A7538923BA} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {986C4B49-D001-4B69-A8D4-E46F69B10AE3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C79E9720-0D23-4DBA-8858-B1A53E281858} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-30] (Facebook Inc.)
Task: {E049ADEA-B396-44A2-9BF4-26D99E08C9B2} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1235139973-2671818785-655692419-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000Core.job => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1235139973-2671818785-655692419-1000UA.job => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-02-13 01:42 - 2009-12-23 18:32 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
2014-02-19 20:31 - 2011-11-09 19:17 - 00225280 _____ () C:\Program Files\eInstruction\Device Manager\STTubeDevice30.dll
2014-02-19 20:31 - 2013-03-22 14:27 - 00304640 _____ () C:\Program Files\eInstruction\Device Manager\NativeSupport.dll
2014-02-19 20:31 - 2010-12-10 13:04 - 00098304 _____ () C:\Program Files\eInstruction\Device Manager\jspWin.dll
2014-05-13 18:00 - 2014-05-13 18:00 - 00041984 _____ () c:\users\laura\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_6yuqh.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Laura\AppData\Roaming\Dropbox\bin\libcef.dll
2010-08-26 16:45 - 2010-08-26 16:45 - 00016384 ____R () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-10-21 06:30 - 2010-10-21 06:30 - 00270336 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-05-11 12:49 - 2014-05-11 12:49 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-04-29 10:20 - 2014-05-11 20:47 - 16351920 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:7ADB695A

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Standard-VGA-Grafikkarte
Description: Standard-VGA-Grafikkarte
Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardgrafikkartentypen)
Service: vga
Problem: : This device cannot work properly until you restart your computer. (Code14)
Resolution: Restart your computer.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (05/13/2014 06:00:06 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/13/2014 11:53:59 AM) (Source: Disk) (User: ) (EventID: 11)
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (05/13/2014 11:53:58 AM) (Source: Disk) (User: ) (EventID: 11)
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (05/13/2014 11:53:57 AM) (Source: Disk) (User: ) (EventID: 11)
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (05/13/2014 10:05:05 AM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/12/2014 11:07:07 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-05-13 17:59:54.987
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-13 10:04:31.944
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 23:07:18.135
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 22:16:07.993
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 22:08:44.467
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 21:52:57.610
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 21:07:30.604
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-12 10:00:02.905
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-11 11:46:45.904
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-11 01:26:39.145
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 2870.69 MB
Available physical RAM: 1586 MB
Total Pagefile: 5739.65 MB
Available Pagefile: 4032.06 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.22 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:698.54 GB) (Free:586.13 GB) NTFS
Drive d: (MONACO_FRANZE_DISK_3) (CDROM) (Total:7.79 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: AACB90F1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Machiavelli · 13.05.2014, 17:32

Dann wart ich jetzt nur noch auf das ESET Log.

Ms Lightyear · 13.05.2014, 19:55

läuft grad noch

ist jetzt bei 95% aber ich glaub das dauert noch...

Machiavelli · 13.05.2014, 20:04

Ja, ESET kann länger dauern.

Ms Lightyear · 13.05.2014, 20:41

So endlich, hier jetzt das logfile:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e15132474611d04e9909dcb923b7438a
# engine=18246
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-13 07:38:59
# local_time=2014-05-13 09:38:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT 
# compatibility_mode=1799 16775165 100 97 12882 39266607 5672 0
# compatibility_mode=5893 16776574 100 94 39299240 152448682 0 0
# scanned=155599
# found=9
# cleaned=0
# scan_time=11016
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Veoh Networks\VeohWebPlayer\ConduitInstaller_veoh.exe"
sh=441A2DB1E874921AB5A464A19C019F0DD218DCAA ft=1 fh=cae042f77220f344 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe"
sh=C6BA138956D7EDCC2B4BB28A5B0865C7FD38D882 ft=0 fh=0000000000000000 vn="JS/Exploit.Agent.NGQ Trojaner" ac=I fn="C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H1LVC8IG\uw5sgmtt7u[1].htm"
sh=966BF0E3088CBB1E74A0CE3CC3BDAE54152D5890 ft=0 fh=0000000000000000 vn="JS/Exploit.Agent.NGQ Trojaner" ac=I fn="C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JFFH2Q15\a6zy8leua5[1].htm"
sh=642798AF76242736FBF18885B682559B12821644 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T09GIFZU\superpornwax_com[1].htm"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Laura\AppData\Local\Temp\is1590112554\4397081_stp\wajam_validate.exe"
sh=1C9BD651288D9CE6AB7F2091EB55B7A552F3AFB6 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\a331351-5b23f9e4"
sh=1C9BD651288D9CE6AB7F2091EB55B7A552F3AFB6 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\128d1fb0-58a17d6d"

Machiavelli · 13.05.2014, 20:56

Hey,

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_6yuqh.dll
C:\Program Files\Veoh Networks\VeohWebPlayer\ConduitInstaller_veoh.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.ex
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H1LVC8IG\uw5sgmtt7u[1].htm
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JFFH2Q15\a6zy8leua5[1].htm
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T09GIFZU\superpornwax_com[1].htm
C:\Users\Laura\AppData\Local\Temp\is1590112554\4397081_stp
C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\a331351-5b23f9e4
C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\128d1fb0-58a17d6d

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Wie läuft der PC?

Ms Lightyear · 13.05.2014, 21:13

Hier der neue fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:11-05-2014 01
Ran by Laura at 2014-05-13 22:12:27 Run:2
Running from C:\Users\Laura\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_6yuqh.dll
C:\Program Files\Veoh Networks\VeohWebPlayer\ConduitInstaller_veoh.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.ex
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H1LVC8IG\uw5sgmtt7u[1].htm
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JFFH2Q15\a6zy8leua5[1].htm
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T09GIFZU\superpornwax_com[1].htm
C:\Users\Laura\AppData\Local\Temp\is1590112554\4397081_stp
C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\a331351-5b23f9e4
C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\128d1fb0-58a17d6d
*****************

C:\Users\Laura\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_6yuqh.dll => Moved successfully.
C:\Program Files\Veoh Networks\VeohWebPlayer\ConduitInstaller_veoh.exe => Moved successfully.
"C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.ex" => File/Directory not found.
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H1LVC8IG\uw5sgmtt7u[1].htm => Moved successfully.
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JFFH2Q15\a6zy8leua5[1].htm => Moved successfully.
C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T09GIFZU\superpornwax_com[1].htm => Moved successfully.
C:\Users\Laura\AppData\Local\Temp\is1590112554\4397081_stp => Moved successfully.
C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\a331351-5b23f9e4 => Moved successfully.
C:\Users\Laura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\128d1fb0-58a17d6d => Moved successfully.

==== End of Fixlog ====

Mein PC läuft ganz normal, während dem ESET Scan zwischen drin mal etwas langsamer, aber ansonsten alles wie immer.

Machiavelli · 13.05.2014, 21:16

Hallo,
nach meiner Erkenntnis, ist Dein PC soweit sauber.

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du mir Feedback geben willst, kannst Du es hier gerne tun: Lob, Kritik und Wünsche - Trojaner-Board

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Ms Lightyear · 13.05.2014, 21:23

Super!!! Vielen vielen Dank! Mein AntiVir lässt sich jetzt auch wieder starten!

Werde deine Tipps auf jeden Fall befolgen! Nochmal danke!

Ach und kann ich das Malwarebytes drauflassen?

Antivir durch Gruppenrichtlinie blockiert

Log-Analyse und Auswertung: Antivir durch Gruppenrichtlinie blockiert