über 1000 Funde mit Malewarebytes

cosinus · 04.06.2014, 22:15

TFC - Temp File Cleaner

Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

turtle2014 · 05.06.2014, 14:48

Hallo,

ich habe das Programm laufe lassen und es hat glaube ich Einiges gelöscht.

Mit den Cookes werde ich denke ich die Firefoxerweiterung nutzen.

Jetzt habe ich immernoch das Problem, dass ich immerzu auf andere Seite umgeleitet werde - auch während ich hier schreibe und Alles immer noch sehr lang dauert und das Netbook ständig wie irre im Hintergrnd an was auch immer arbeitet. Es gehen auch oft von ganz alleine irgednwelche Seiten auf, die Malewarebytes aber z. T. blockiert. Außerdem habe ich jetzt teilweise mitten im Text plötzlich blaue unterstrichene Wörter und das ist dan automatisch ein link.

Und diese Norton-Testversion lässt sich nicht deistallieren.

Vielen Dank für deine Hilfe! Ich hätte echt nicht gewusst was ich tun soll.

Magst du mir noch sagen, welches Virenprogramm zu empfehlen ist? Ich würdeauch eines kaufen, möchte nur gerne auch was Gutes.

Gruß turtle

cosinus · 05.06.2014, 15:12

Zitat:

Und diese Norton-Testversion lässt sich nicht deistallieren.

Norton Removal Tool? https://support.norton.com/sp/de/de/...rProfile_de_de

Zitat:

Magst du mir noch sagen, welches Virenprogramm zu empfehlen ist? Ich würdeauch eines kaufen, möchte nur gerne auch was Gutes.

Anti-Virusprogramme

Nutze einen Virenscanner mit Hintergrundwächter mit stets aktueller Datenbank. Welches Produkt gewählt wird, spielt keine so entscheidende Rolle. Wenn du ein kommerzielles Programm kaufen möchtest, kann ich dir Emsisoft Anti-Malware empfehlen (die Freeware-Version davon reicht aber nicht, denn die hat keinen Hintergrundwächter). Bevorzugst du ein kostenloses Produkt, dann ist Avast! Free Antivirus eine gute Alternative.
Betreibe aber keinesfalls zwei Wächter parallel, die würden sich gegenseitig behindern.
Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
Zusätzlich zum Virenscanner kannst du dein System regelmässig mit einem On-Demand Antimalwareprogramm scannen. Empfehlenswert ist die Free-Version von Malwarebytes Anti-Malware. Vor jedem Scan die Datenbank updaten.

cosinus · 06.06.2014, 11:01

Ach, noch eine bitte:

Zitat:

C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys

Bitte diese Datei bei Virustotal auswerten lassen und den Ergebnislink posten. Falls Du die Datei nicht siehst, musst Du sie evtl. vorher sichtbar machen.
Wenn die Datei schon ausgewertet sein sollte, bitte eine weitere Auswertung starten.

turtle2014 · 07.06.2014, 13:56

Hallo cosinus,

ich habe jetzt avast installiert - ging alles problemlos.

Die datei war scho gescannt und da gabs 2 funde und jetzt hab ich es nochmal nue gemacht mit 4 funden.

Ich kopiere jetzt einfach den link? Ich hoffe das ist richtig.

https://www.virustotal.com/de/file/252830ba9b765df84c1ef8a8bffb138ec36150096ddf7180b33970e3a3a65cb1/analysis/1402145091/

cosinus · 08.06.2014, 15:40

Dann ist das rel. neue Adware. Bite neue Logs mit FRST erstellen und posten

turtle2014 · 09.06.2014, 21:48

Ich verstehe gar nicht woher das kommt. Hab mit dem Computer gar nichts gemacht außer die Arbeiten hier.
Man kan ja wegen der ständigen Umleituge und dem langsamen laden auc kaum mit dem arbeiten.

scans sind fertig:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03
Ran by Jutta (administrator) on 1SCHNUCKELCHEN on 09-06-2014 22:29:26
Running from C:\Users\Jutta\Desktop
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Registration\GREGsvc.exe
(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.0.9\ccsvchst.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe
(AVM Berlin) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Symantec Corporation) C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [GfxServiceInstall] => C:\Windows\system32\GfxCUIServiceInstall.vbs [131 2012-02-26] ()
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1934632 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10959464 2012-01-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [714120 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [ROC_roc_ssl_v12] => "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM\...\Run: [MRT] => C:\Windows\system32\MRT.exe [90547776 2014-05-18] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-07] (AVAST Software)
HKU\S-1-5-21-3008509189-370871999-48178643-1000\...\MountPoints2: {1999427a-1397-11e2-a141-08edb9350df0} - D:\pushinst.exe

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - C:\Program Files\Allin1Convert_8h\bar\1.bin\8hSrcAs.dll No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: hxxp://home.tb.ask.com/index.jhtml?ptb=4ABCF663-EFD5-484D-8B4D-0BCEE769D1A3&n=77fd06ab&p2=^AYY^xdm070^YYA^de&si=flvrunner
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.169\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.169\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: APPPtoU - C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default\Extensions\uing-0em@ievqgtchsaoe.com [2014-02-01]
FF Extension: PPPT2PNGG - C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default\Extensions\xjulx0_ak@uoeumdrf-rj.edu [2014-03-01]
FF Extension: downloaddiitkeep - C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default\Extensions\z.fox0@oaidraaaukqi.co.uk [2014-03-01]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-07]
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\IPSFFPlgn\
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\IPSFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\coFFPlgn\
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-07]
FF HKCU\...\Firefox\Extensions: [{d49d2752-93ae-4630-b849-87ab7b01b61c}] - C:\Program Files\LyricsContainer\157.xpi

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-07]
CHR Extension: (Google Drive) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-07]
CHR Extension: (YouTube) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-07]
CHR Extension: (Google-Suche) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-07]
CHR Extension: (Google Wallet) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-07]
CHR Extension: (Google Mail) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-07]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-07]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\Exts\Chrome.crx [2014-06-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-07] (AVAST Software)
R2 GREGService; C:\Program Files\Packard Bell\Registration\GREGsvc.exe [28264 2012-02-29] (Acer Incorporated)
R2 IconMan_R; C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1755136 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [255376 2012-02-07] (Acer Incorporated)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.0.9\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [3236224 2013-04-29] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-06-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-06-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-06-07] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-06-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-06-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-06-07] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [68312 2014-06-07] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-06-07] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin) [File not signed]
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20121106.001\BHDrvx86.sys [995488 2012-10-24] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309000.009\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-11-13] (Symantec Corporation)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20121129.001\IDSvix86.sys [386720 2012-11-10] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-09] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20121129.023\NAVENG.SYS [92704 2012-11-13] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20121129.023\NAVEX15.SYS [1601184 2012-11-13] (Symantec Corporation)
R3 RSPCIESTOR; C:\Windows\System32\DRIVERS\RtsPStor.sys [254056 2011-05-30] (Realtek Semiconductor Corp.)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309000.009\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1309000.009\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1309000.009\SYMDS.SYS [340088 2011-08-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1309000.009\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-03-20] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1309000.009\Ironx86.SYS [149624 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1309000.009\SYMNETS.SYS [318584 2012-04-18] (Symantec Corporation)
R1 {fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w; C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys [52920 2014-04-24] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-09 22:29 - 2014-06-09 22:31 - 00015208 _____ () C:\Users\Jutta\Desktop\FRST.txt
2014-06-07 14:09 - 2014-06-07 14:09 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\AVAST Software
2014-06-07 14:08 - 2014-06-07 14:08 - 00002127 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-07 14:08 - 2014-06-07 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-07 14:06 - 2014-06-07 14:06 - 00002201 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-07 14:06 - 2014-06-07 14:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-07 14:04 - 2014-06-09 22:15 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-07 14:04 - 2014-06-07 14:24 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-07 14:04 - 2014-06-07 14:07 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Google
2014-06-07 14:04 - 2014-06-07 14:06 - 00000000 ____D () C:\Program Files\Google
2014-06-07 14:03 - 2014-06-07 14:07 - 00777488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-07 14:03 - 2014-06-07 14:07 - 00411680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-07 14:03 - 2014-06-07 14:07 - 00068312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00776976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00411552 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00271264 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-07 14:03 - 2014-06-07 14:03 - 00180632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-07 14:03 - 2014-06-07 14:03 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-07 14:01 - 2014-06-07 14:01 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-07 13:55 - 2014-06-07 13:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-07 13:49 - 2014-06-07 13:52 - 88882192 _____ (AVAST Software) C:\Users\Jutta\Downloads\avast_free18_antivirus_setup.exe
2014-06-05 15:25 - 2014-06-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Jutta\Desktop\TFC.exe
2014-06-04 20:24 - 2014-06-04 20:24 - 02347384 _____ (ESET) C:\Users\Jutta\Downloads\esetsmartinstaller_deu.exe
2014-06-04 19:59 - 2014-06-04 19:59 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Systweak
2014-06-03 20:05 - 2014-06-03 20:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-02 20:21 - 2014-06-09 22:29 - 01072128 _____ (Farbar) C:\Users\Jutta\Desktop\FRST.exe
2014-06-02 20:21 - 2014-06-09 22:29 - 00000000 ____D () C:\Users\Jutta\Desktop\FRST-OlderVersion
2014-05-31 20:40 - 2014-05-31 20:40 - 00001998 _____ () C:\Users\Jutta\Desktop\JRT.txt
2014-05-30 19:31 - 2014-05-30 19:31 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST(1).exe
2014-05-30 19:16 - 2014-05-30 19:16 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 19:14 - 2014-05-30 19:14 - 01016261 _____ (Thisisu) C:\Users\Jutta\Downloads\JRT(1).exe
2014-05-30 19:13 - 2014-05-30 19:13 - 01016261 _____ (Thisisu) C:\Users\Jutta\Desktop\JRT.exe
2014-05-30 18:56 - 2014-05-30 18:59 - 00000000 ____D () C:\AdwCleaner
2014-05-30 18:55 - 2014-05-30 18:55 - 01327971 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.211.exe
2014-05-27 12:41 - 2014-05-27 12:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-27 12:25 - 2014-05-27 12:27 - 00030582 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-05-27 12:21 - 2014-06-09 22:29 - 00000000 ____D () C:\FRST
2014-05-27 12:21 - 2014-05-30 19:35 - 00028288 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-05-27 12:14 - 2014-05-27 12:15 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST.exe
2014-05-24 19:44 - 2014-06-09 22:31 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-24 19:41 - 2014-06-03 20:08 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-24 19:41 - 2014-06-03 20:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-24 19:40 - 2014-06-03 20:08 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-24 19:40 - 2014-05-24 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-24 19:40 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-24 19:40 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-24 19:40 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-24 19:28 - 2014-05-24 19:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-18 19:40 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-18 19:40 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-18 19:40 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-18 19:40 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-18 19:40 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-18 19:40 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-18 19:40 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-18 19:40 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-18 19:40 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-18 19:39 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-18 19:39 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-18 19:39 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-18 19:39 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-18 19:39 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-18 19:39 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-18 19:39 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-18 19:25 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-18 19:22 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-18 19:22 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-18 19:22 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

==================== One Month Modified Files and Folders =======

2014-06-09 22:31 - 2014-06-09 22:29 - 00015208 _____ () C:\Users\Jutta\Desktop\FRST.txt
2014-06-09 22:31 - 2014-05-24 19:44 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-09 22:31 - 2012-10-02 20:32 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Temp
2014-06-09 22:29 - 2014-06-02 20:21 - 01072128 _____ (Farbar) C:\Users\Jutta\Desktop\FRST.exe
2014-06-09 22:29 - 2014-06-02 20:21 - 00000000 ____D () C:\Users\Jutta\Desktop\FRST-OlderVersion
2014-06-09 22:29 - 2014-05-27 12:21 - 00000000 ____D () C:\FRST
2014-06-09 22:26 - 2012-04-18 09:53 - 01911174 _____ () C:\Windows\WindowsUpdate.log
2014-06-09 22:25 - 2009-07-14 06:34 - 00016480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-09 22:25 - 2009-07-14 06:34 - 00016480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-09 22:18 - 2012-12-18 06:31 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-06-09 22:15 - 2014-06-07 14:04 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-09 22:15 - 2013-06-10 20:00 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-06-09 22:14 - 2014-03-05 00:08 - 00000374 _____ () C:\Windows\Tasks\LookForWord_wd.job
2014-06-09 22:14 - 2014-03-05 00:08 - 00000372 _____ () C:\Windows\Tasks\LookForWord Update.job
2014-06-09 22:14 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-09 22:14 - 2009-07-14 06:39 - 00060582 _____ () C:\Windows\setupact.log
2014-06-09 22:13 - 2010-11-20 23:48 - 00418374 _____ () C:\Windows\PFRO.log
2014-06-07 14:52 - 2012-03-20 11:09 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-07 14:24 - 2014-06-07 14:04 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-07 14:09 - 2014-06-07 14:09 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\AVAST Software
2014-06-07 14:08 - 2014-06-07 14:08 - 00002127 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-07 14:08 - 2014-06-07 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-07 14:07 - 2014-06-07 14:04 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Google
2014-06-07 14:07 - 2014-06-07 14:03 - 00777488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-07 14:07 - 2014-06-07 14:03 - 00411680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-07 14:07 - 2014-06-07 14:03 - 00068312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-07 14:06 - 2014-06-07 14:06 - 00002201 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-07 14:06 - 2014-06-07 14:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-07 14:06 - 2014-06-07 14:04 - 00000000 ____D () C:\Program Files\Google
2014-06-07 14:03 - 2014-06-07 14:03 - 00776976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00411552 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00271264 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-07 14:03 - 2014-06-07 14:03 - 00180632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-07 14:03 - 2014-06-07 14:03 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-07 14:01 - 2014-06-07 14:01 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-07 13:56 - 2014-06-07 13:55 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-07 13:52 - 2014-06-07 13:49 - 88882192 _____ (AVAST Software) C:\Users\Jutta\Downloads\avast_free18_antivirus_setup.exe
2014-06-05 15:25 - 2014-06-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Jutta\Desktop\TFC.exe
2014-06-05 15:16 - 2013-07-10 20:10 - 00000278 _____ () C:\Windows\Tasks\AdvancedDriverUpdater_UPDATES.job
2014-06-04 20:24 - 2014-06-04 20:24 - 02347384 _____ (ESET) C:\Users\Jutta\Downloads\esetsmartinstaller_deu.exe
2014-06-04 20:05 - 2012-03-20 11:05 - 00000000 ____D () C:\ProgramData\Symantec
2014-06-04 19:59 - 2014-06-04 19:59 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Systweak
2014-06-03 20:42 - 2010-11-20 23:01 - 01620776 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-03 20:28 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-03 20:08 - 2014-05-24 19:41 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-03 20:08 - 2014-05-24 19:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-03 20:08 - 2014-05-24 19:40 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-03 20:06 - 2014-06-03 20:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-02 20:23 - 2014-02-22 14:06 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 20:22 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-31 20:40 - 2014-05-31 20:40 - 00001998 _____ () C:\Users\Jutta\Desktop\JRT.txt
2014-05-30 19:35 - 2014-05-27 12:21 - 00028288 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-05-30 19:31 - 2014-05-30 19:31 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST(1).exe
2014-05-30 19:16 - 2014-05-30 19:16 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 19:14 - 2014-05-30 19:14 - 01016261 _____ (Thisisu) C:\Users\Jutta\Downloads\JRT(1).exe
2014-05-30 19:13 - 2014-05-30 19:13 - 01016261 _____ (Thisisu) C:\Users\Jutta\Desktop\JRT.exe
2014-05-30 19:01 - 2011-04-22 16:12 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-30 18:59 - 2014-05-30 18:56 - 00000000 ____D () C:\AdwCleaner
2014-05-30 18:59 - 2012-10-02 20:35 - 00001156 _____ () C:\Users\Jutta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-30 18:59 - 2012-03-20 10:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Packard Bell - Security & Support
2014-05-30 18:59 - 2011-04-22 16:12 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-30 18:59 - 2011-04-22 16:12 - 00001015 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-30 18:55 - 2014-05-30 18:55 - 01327971 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.211.exe
2014-05-27 12:41 - 2014-05-27 12:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-27 12:27 - 2014-05-27 12:25 - 00030582 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-05-27 12:15 - 2014-05-27 12:14 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST.exe
2014-05-25 13:52 - 2012-03-20 10:57 - 00000000 ____D () C:\Windows\fi
2014-05-24 23:33 - 2012-10-28 16:37 - 00000000 ____D () C:\Users\Jutta\AppData\Local\CrashDumps
2014-05-24 20:41 - 2009-07-14 04:04 - 00000505 _____ () C:\Windows\win.ini
2014-05-24 20:40 - 2014-02-22 14:06 - 00000000 ____D () C:\ProgramData\PPPT2PNGG
2014-05-24 20:40 - 2014-02-22 14:06 - 00000000 ____D () C:\ProgramData\downloaddiitkeep
2014-05-24 20:40 - 2014-01-27 22:00 - 00000000 ____D () C:\ProgramData\APPPtoU
2014-05-24 20:40 - 2013-11-15 18:08 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Systweak
2014-05-24 20:40 - 2013-11-15 18:08 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Systweak
2014-05-24 20:02 - 2014-05-07 09:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-24 20:02 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-24 19:53 - 2012-03-20 11:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-24 19:53 - 2012-03-20 11:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-24 19:40 - 2014-05-24 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-24 19:34 - 2014-05-24 19:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-24 19:06 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-18 19:29 - 2013-08-15 23:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-18 19:29 - 2012-11-04 16:08 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 19:28 - 2012-10-02 20:38 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Skype
2014-05-18 19:19 - 2013-07-20 10:13 - 00001414 _____ () C:\Users\Jutta\Desktop\Registry kostenlos entrümpeln!.lnk
2014-05-12 07:26 - 2014-05-24 19:40 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-24 19:40 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:25 - 2014-05-24 19:40 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-04-01 13:39

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:09-06-2014 03
Ran by Jutta at 2014-06-09 22:33:36
Running from C:\Users\Jutta\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AV: avast! Antivirus (Disabled - Out of date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
AS: Norton Internet Security (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

337 GAMES (HKCU\...\337Games) (Version: 1.1.1.0 - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe AIR (Version: 2.6.0.19120 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.8 - Adobe Systems Incorporated)
Advanced Driver Updater (HKLM\...\Advanced Driver Updater_is1) (Version: 2.1.1086.14630 - Systweak Inc)
Advanced File Optimizer (HKLM\...\Advanced File Optimizer_is1) (Version: 2.1.1000.10518 - Systweak Software)
Akhra: The Treasures (Version: 2.2.0.98 - WildTangent) Hidden
Alice's Magical Mahjong (Version: 2.2.0.98 - WildTangent) Hidden
avast! Free Antivirus (HKLM\...\Avast) (Version: 9.0.2018 - Avast Software)
Bejeweled 3 (Version: 2.2.0.98 - WildTangent) Hidden
Bing Bar (HKLM\...\{C28D96C0-6A90-459E-A077-A6706F4EC0FC}) (Version: 7.0.765.0 - Microsoft Corporation)
CasinoClub (HKLM\...\CasinoClub ) (Version:  - Boss Media AB)
Chuzzle Deluxe (Version: 2.2.0.95 - WildTangent) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Diego's Ultimate Rescue (Version: 2.2.0.95 - WildTangent) Hidden
eBay Worldwide (HKLM\...\{D3E5A972-9A15-427D-AE78-8181A5FD943C}) (Version: 2.2.0409 - OEM)
Evernote v. 4.5.2 (HKLM\...\{F77EF646-19EB-11E1-9A9E-984BE15F174E}) (Version: 4.5.2.5866 - Evernote Corp.)
Final Drive: Nitro (Version: 2.2.0.95 - WildTangent) Hidden
Fooz Kids (HKLM\...\FoozKids) (Version: 3.1.2 - FUHU, Inc.)
Fooz Kids (Version: 3.1.2 - FUHU, Inc.) Hidden
Fooz Kids Platform (HKLM\...\{8D68CE08-9A14-4B7B-9857-3C646A2F34C7}) (Version: 2.1 - FUHU, Inc.)
Fotogalerija Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Freemake Video Downloader (HKLM\...\Freemake Video Downloader_is1) (Version: 3.2.0 - Ellora Assets Corporation)
Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (Version: 1.3.21.169 - Google Inc.) Hidden
Identity Card (HKLM\...\Identity Card) (Version: 1.00.3501 - Packard Bell)
Insaniquarium Deluxe (Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.14.8.1075 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM\...\LManager) (Version: 5.1.7 - Packard Bell)
LibreOffice 3.6 (HKLM\...\{1E85458A-9B00-443F-A187-2E06DBB15E43}) (Version: 3.6.2.2 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
My Farm Life (Version: 2.2.0.97 - WildTangent) Hidden
My Kingdom for the Princess 3 (Version: 2.2.0.98 - WildTangent) Hidden
Norton Internet Security (HKLM\...\NIS) (Version: 19.9.0.9 - Symantec Corporation)
Packard Bell Games (HKLM\...\WildTangent packardbell Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Packard Bell Power Management (HKLM\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3010 - Packard Bell)
Packard Bell Recovery Management (HKLM\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3507 - Packard Bell)
Packard Bell Registration (HKLM\...\Packard Bell Registration) (Version: 1.04.3506 - Packard Bell)
Packard Bell ScreenSaver (HKLM\...\Packard Bell Screensaver) (Version: 1.1.0124.2011 - Packard Bell )
Packard Bell Social Networks (HKLM\...\InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}) (Version: 3.0.3106 - CyberLink Corp.)
Packard Bell Social Networks (Version: 3.0.3106 - CyberLink Corp.) Hidden
Packard Bell Updater (HKLM\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3501 - Packard Bell)
PhotoScape (HKLM\...\PhotoScape) (Version:  - )
Poczta usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6549 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.83 - Realtek Semiconductor Corp.)
Running Sheep (Version: 2.2.0.98 - WildTangent) Hidden
Skip-Bo - Castaway Caper (Version: 2.2.0.95 - WildTangent) Hidden
Skype™ 5.5 (HKLM\...\{AA59DDE4-B672-4621-A016-4C248204957A}) (Version: 5.5.117 - Skype Technologies S.A.)
Slingo Deluxe (Version: 2.2.0.95 - WildTangent) Hidden
Super Granny 6 (Version: 2.2.0.97 - WildTangent) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.18.0 - Synaptics Incorporated)
Update Installer for WildTangent Games App (Version:  - WildTangent) Hidden
Video Web Camera (HKLM\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2624.00 - CyberLink Corp.)
Video Web Camera (Version: 1.5.2624.00 - CyberLink Corp.) Hidden
Wedding Dash (Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (HKLM\...\Packard Bell Welcome Center) (Version: 1.02.3507 - Packard Bell)
WildTangent Games App (Version: 4.0.10.2 - WildTangent) Hidden
Windows Live Argazki Galeria (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Συλλογή φωτογραφιών του Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

12-02-2014 15:39:43 Windows Update
01-03-2014 09:55:10 Windows Update
04-03-2014 22:13:41 Windows Update
25-03-2014 15:42:44 Windows Update
11-04-2014 12:03:35 Windows Update
17-04-2014 19:40:48 Windows Update
18-04-2014 10:22:28 Windows Update
23-04-2014 19:48:32 Windows Update
25-04-2014 10:42:25 Windows Update
25-04-2014 10:55:28 Windows Update
30-04-2014 17:03:06 Windows Update
07-05-2014 07:12:37 Windows Update
18-05-2014 17:21:06 Windows Update
24-05-2014 17:11:25 Windows Update
04-06-2014 18:03:00 Removed Norton Online Backup
07-06-2014 12:00:43 avast! antivirus system restore point

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0ADFB07D-E6B0-46A8-AC43-3CBAE1A22050} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\19.9.0.9\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {0B56A14E-7EC4-4029-9827-1EF5F328BF0E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-24] (Adobe Systems Incorporated)
Task: {1518AE10-721D-4721-B402-2918CB329826} - System32\Tasks\{24B7CD0E-B186-48B8-A9C8-4D7CA800FB66} => C:\Program Files\Microsoft Office\Options14\MSOO.EXE [2010-02-28] (Microsoft Corporation)
Task: {2E17B5C3-CD99-4571-8240-44CD40E26547} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\19.9.0.9\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {31EC83C5-B494-4A9F-904B-9266D5141236} - System32\Tasks\LookForWord_wd => C:\Program Files\LyricsContainer\LookForWord_wd.exe <==== ATTENTION
Task: {3636B378-C0D4-4DB3-AC53-34C9FEE9F635} - System32\Tasks\LookForWord Update => C:\Program Files\LyricsContainer\LookF.exe <==== ATTENTION
Task: {5083AFF3-3927-49D4-AA12-D6F83ADCC831} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-06-07] (Google Inc.)
Task: {59409BE6-9DE4-47A1-B54F-0099136D172A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-06-07] (Google Inc.)
Task: {6B77E85A-458D-45D2-B24D-3986EBA39893} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\19.9.0.9\WSCStub.exe [2012-09-26] (Symantec Corporation)
Task: {72353609-3155-44E9-9983-76C8A294CD76} - System32\Tasks\{39E03F6F-1894-426C-ACD1-ED2C1F4F0BCF} => C:\Program Files\Microsoft Office\Options14\MSOO.EXE [2010-02-28] (Microsoft Corporation)
Task: {9DEC916F-494D-441A-B4E3-D0E169E72B45} - System32\Tasks\AdvancedDriverUpdaterRunAtStartup => C:\Program Files\Advanced Driver Updater\adu.exe [2012-11-22] (Systweak Inc)
Task: {9EF58C15-1204-43B3-AFB4-F1D46746FFCD} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{4BD8451C-F6FB-4FDD-AB92-94020634B34F}.exe
Task: {F7FD7C8A-12FD-4807-A5FD-5243ACB59BF5} - System32\Tasks\UALU notificatin => C:\Program Files\Packard Bell\Packard Bell Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: {F89DD4D2-B06D-41D2-9E7C-5AECF877BEE8} - System32\Tasks\AdvancedDriverUpdater_UPDATES => C:\Program Files\Advanced Driver Updater\adu.exe [2012-11-22] (Systweak Inc)
Task: {F8C7D082-0117-410C-A8F5-564B4590E1F6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-06-07] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AdvancedDriverUpdater_UPDATES.job => C:\Program Files\Advanced Driver Updater\adu.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{4BD8451C-F6FB-4FDD-AB92-94020634B34F}.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\LookForWord Update.job => C:\Program Files\LyricsContainer\LookF.exe <==== ATTENTION
Task: C:\Windows\Tasks\LookForWord_wd.job => C:\Program Files\LyricsContainer\LookForWord_wd.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-06-07 14:18 - 2014-06-07 14:18 - 02775040 _____ () C:\Program Files\AVAST Software\Avast\defs\14060701\algo.dll
2014-06-09 22:16 - 2014-06-09 22:16 - 02775040 _____ () C:\Program Files\AVAST Software\Avast\defs\14060901\algo.dll
2014-06-07 14:03 - 2014-06-07 14:03 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-05-27 12:41 - 2014-05-27 12:41 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-04-03 14:49 - 2014-04-03 14:49 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\0a0467413a424068d1471448ff6ca6cc\IsdiInterop.ni.dll
2012-03-20 10:32 - 2010-11-06 09:50 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Symantec Iron Driver
Description: Symantec Iron Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SymIRON
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: BHDrvx86
Description: BHDrvx86
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: BHDrvx86
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Norton Internet Security Settings Manager
Description: Norton Internet Security Settings Manager
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: ccSet_NIS
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/09/2014 10:15:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2014 02:00:57 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary ogvykxln.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (06/07/2014 02:00:42 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {f41fe862-4566-4109-943c-f6ba1383386d}

Error: (06/07/2014 01:25:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/05/2014 03:17:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/04/2014 07:57:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/03/2014 07:53:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/02/2014 08:24:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/02/2014 08:10:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/01/2014 02:58:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (06/09/2014 10:17:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (06/09/2014 10:17:48 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (06/09/2014 10:14:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON

Error: (06/07/2014 01:24:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON

Error: (06/05/2014 03:36:13 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (06/05/2014 03:16:27 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON

Error: (06/04/2014 07:57:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON

Error: (06/03/2014 07:53:32 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON

Error: (06/02/2014 08:24:07 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON

Error: (06/02/2014 08:09:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BHDrvx86
ccSet_NIS
cdrom
SymIRON


Microsoft Office Sessions:
=========================
Error: (06/09/2014 10:15:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2014 02:00:57 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary ogvykxln.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (06/07/2014 02:00:42 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {f41fe862-4566-4109-943c-f6ba1383386d}

Error: (06/07/2014 01:25:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/05/2014 03:17:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/04/2014 07:57:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/03/2014 07:53:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/02/2014 08:24:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/02/2014 08:10:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/01/2014 02:58:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 80%
Total physical RAM: 1012.3 MB
Available physical RAM: 200.37 MB
Total Pagefile: 2036.3 MB
Available Pagefile: 727.95 MB
Total Virtual: 2047.88 MB
Available Virtual: 1925.21 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:284.99 GB) (Free:246.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 43338D6D)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 09.06.2014, 21:55

Du sollst ja auch nicht verstehen wie das unter der Haube aussieht. Aber:

Zitat:

AV: Norton Internet Security (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AV: avast! Antivirus (Disabled - Out of date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

Du solltest wissen, dass man nicht zwei solcher Scanner verwendet.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

R1 {fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w; C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys [52920 2014-04-24] (StdLib)
C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

turtle2014 · 09.06.2014, 22:34

Das Northon war nur eine Testversion und läuft nicht mehr - bisher hat er sich beim entfernen immer aufgehängt...ich versuchs aber weiter.

scan hab ich gemacht:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03
Ran by Jutta (administrator) on 1SCHNUCKELCHEN on 09-06-2014 23:26:21
Running from C:\Users\Jutta\Desktop
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Registration\GREGsvc.exe
(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.0.9\ccsvchst.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe
(AVM Berlin) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Symantec Corporation) C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
(Symantec Corporation) C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [GfxServiceInstall] => C:\Windows\system32\GfxCUIServiceInstall.vbs [131 2012-02-26] ()
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1934632 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10959464 2012-01-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [714120 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [ROC_roc_ssl_v12] => "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM\...\Run: [MRT] => C:\Windows\system32\MRT.exe [90547776 2014-05-18] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-07] (AVAST Software)
HKU\S-1-5-21-3008509189-370871999-48178643-1000\...\MountPoints2: {1999427a-1397-11e2-a141-08edb9350df0} - D:\pushinst.exe

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - C:\Program Files\Allin1Convert_8h\bar\1.bin\8hSrcAs.dll No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: hxxp://home.tb.ask.com/index.jhtml?ptb=4ABCF663-EFD5-484D-8B4D-0BCEE769D1A3&n=77fd06ab&p2=^AYY^xdm070^YYA^de&si=flvrunner
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.169\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.169\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: APPPtoU - C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default\Extensions\uing-0em@ievqgtchsaoe.com [2014-02-01]
FF Extension: PPPT2PNGG - C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default\Extensions\xjulx0_ak@uoeumdrf-rj.edu [2014-03-01]
FF Extension: downloaddiitkeep - C:\Users\Jutta\AppData\Roaming\Mozilla\Firefox\Profiles\tf6oliqx.default\Extensions\z.fox0@oaidraaaukqi.co.uk [2014-03-01]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-07]
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\IPSFFPlgn\
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\IPSFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\coFFPlgn\
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-07]
FF HKCU\...\Firefox\Extensions: [{d49d2752-93ae-4630-b849-87ab7b01b61c}] - C:\Program Files\LyricsContainer\157.xpi

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-07]
CHR Extension: (Google Drive) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-07]
CHR Extension: (YouTube) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-07]
CHR Extension: (Google-Suche) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-07]
CHR Extension: (Google Wallet) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-07]
CHR Extension: (Google Mail) - C:\Users\Jutta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-07]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-07]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\19.9.0.9\Exts\Chrome.crx [2014-06-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-07] (AVAST Software)
R2 GREGService; C:\Program Files\Packard Bell\Registration\GREGsvc.exe [28264 2012-02-29] (Acer Incorporated)
R2 IconMan_R; C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1755136 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [255376 2012-02-07] (Acer Incorporated)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.0.9\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [3236224 2013-04-29] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-06-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-06-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-06-07] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-06-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-06-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-06-07] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [68312 2014-06-07] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-06-07] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin) [File not signed]
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20121106.001\BHDrvx86.sys [995488 2012-10-24] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309000.009\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-11-13] (Symantec Corporation)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20121129.001\IDSvix86.sys [386720 2012-11-10] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-09] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20121129.023\NAVENG.SYS [92704 2012-11-13] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20121129.023\NAVEX15.SYS [1601184 2012-11-13] (Symantec Corporation)
R3 RSPCIESTOR; C:\Windows\System32\DRIVERS\RtsPStor.sys [254056 2011-05-30] (Realtek Semiconductor Corp.)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309000.009\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1309000.009\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1309000.009\SYMDS.SYS [340088 2011-08-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1309000.009\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-03-20] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1309000.009\Ironx86.SYS [149624 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1309000.009\SYMNETS.SYS [318584 2012-04-18] (Symantec Corporation)
R1 {fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w; C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys [52920 2014-04-24] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-09 23:25 - 2014-06-09 23:25 - 00000216 _____ () C:\Users\Jutta\Desktop\fixlist.txt
2014-06-09 22:33 - 2014-06-09 22:35 - 00029579 _____ () C:\Users\Jutta\Desktop\Addition.txt
2014-06-09 22:29 - 2014-06-09 23:26 - 00015294 _____ () C:\Users\Jutta\Desktop\FRST.txt
2014-06-07 14:09 - 2014-06-07 14:09 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\AVAST Software
2014-06-07 14:08 - 2014-06-07 14:08 - 00002127 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-07 14:08 - 2014-06-07 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-07 14:06 - 2014-06-07 14:06 - 00002201 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-07 14:06 - 2014-06-07 14:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-07 14:04 - 2014-06-09 23:09 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-07 14:04 - 2014-06-09 22:15 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-07 14:04 - 2014-06-07 14:07 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Google
2014-06-07 14:04 - 2014-06-07 14:06 - 00000000 ____D () C:\Program Files\Google
2014-06-07 14:03 - 2014-06-07 14:07 - 00777488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-07 14:03 - 2014-06-07 14:07 - 00411680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-07 14:03 - 2014-06-07 14:07 - 00068312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00776976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00411552 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00271264 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-07 14:03 - 2014-06-07 14:03 - 00180632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-07 14:03 - 2014-06-07 14:03 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-07 14:01 - 2014-06-07 14:01 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-07 13:55 - 2014-06-07 13:56 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-07 13:49 - 2014-06-07 13:52 - 88882192 _____ (AVAST Software) C:\Users\Jutta\Downloads\avast_free18_antivirus_setup.exe
2014-06-05 15:25 - 2014-06-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Jutta\Desktop\TFC.exe
2014-06-04 20:24 - 2014-06-04 20:24 - 02347384 _____ (ESET) C:\Users\Jutta\Downloads\esetsmartinstaller_deu.exe
2014-06-04 19:59 - 2014-06-04 19:59 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Systweak
2014-06-03 20:05 - 2014-06-03 20:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-02 20:21 - 2014-06-09 22:29 - 01072128 _____ (Farbar) C:\Users\Jutta\Desktop\FRST.exe
2014-06-02 20:21 - 2014-06-09 22:29 - 00000000 ____D () C:\Users\Jutta\Desktop\FRST-OlderVersion
2014-05-31 20:40 - 2014-05-31 20:40 - 00001998 _____ () C:\Users\Jutta\Desktop\JRT.txt
2014-05-30 19:31 - 2014-05-30 19:31 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST(1).exe
2014-05-30 19:16 - 2014-05-30 19:16 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 19:14 - 2014-05-30 19:14 - 01016261 _____ (Thisisu) C:\Users\Jutta\Downloads\JRT(1).exe
2014-05-30 19:13 - 2014-05-30 19:13 - 01016261 _____ (Thisisu) C:\Users\Jutta\Desktop\JRT.exe
2014-05-30 18:56 - 2014-05-30 18:59 - 00000000 ____D () C:\AdwCleaner
2014-05-30 18:55 - 2014-05-30 18:55 - 01327971 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.211.exe
2014-05-27 12:41 - 2014-05-27 12:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-27 12:25 - 2014-05-27 12:27 - 00030582 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-05-27 12:21 - 2014-06-09 23:26 - 00000000 ____D () C:\FRST
2014-05-27 12:21 - 2014-05-30 19:35 - 00028288 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-05-27 12:14 - 2014-05-27 12:15 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST.exe
2014-05-24 19:44 - 2014-06-09 22:31 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-24 19:41 - 2014-06-03 20:08 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-24 19:41 - 2014-06-03 20:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-24 19:40 - 2014-06-03 20:08 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-24 19:40 - 2014-05-24 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-24 19:40 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-24 19:40 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-24 19:40 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-24 19:28 - 2014-05-24 19:34 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-18 19:40 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-18 19:40 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-18 19:40 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-18 19:40 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-18 19:40 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-18 19:40 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-18 19:40 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-18 19:40 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-18 19:40 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-18 19:39 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-18 19:39 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-18 19:39 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-18 19:39 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-18 19:39 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-18 19:39 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-18 19:39 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-18 19:39 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-18 19:25 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-18 19:22 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-18 19:22 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-18 19:22 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

==================== One Month Modified Files and Folders =======

2014-06-09 23:28 - 2014-06-09 22:29 - 00015294 _____ () C:\Users\Jutta\Desktop\FRST.txt
2014-06-09 23:28 - 2012-10-02 20:32 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Temp
2014-06-09 23:26 - 2014-05-27 12:21 - 00000000 ____D () C:\FRST
2014-06-09 23:25 - 2014-06-09 23:25 - 00000216 _____ () C:\Users\Jutta\Desktop\fixlist.txt
2014-06-09 23:09 - 2014-06-07 14:04 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-09 23:09 - 2014-03-05 00:08 - 00000374 _____ () C:\Windows\Tasks\LookForWord_wd.job
2014-06-09 22:58 - 2014-03-05 00:08 - 00000372 _____ () C:\Windows\Tasks\LookForWord Update.job
2014-06-09 22:51 - 2012-03-20 11:09 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-09 22:35 - 2014-06-09 22:33 - 00029579 _____ () C:\Users\Jutta\Desktop\Addition.txt
2014-06-09 22:31 - 2014-05-24 19:44 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-09 22:29 - 2014-06-02 20:21 - 01072128 _____ (Farbar) C:\Users\Jutta\Desktop\FRST.exe
2014-06-09 22:29 - 2014-06-02 20:21 - 00000000 ____D () C:\Users\Jutta\Desktop\FRST-OlderVersion
2014-06-09 22:26 - 2012-04-18 09:53 - 01911174 _____ () C:\Windows\WindowsUpdate.log
2014-06-09 22:25 - 2009-07-14 06:34 - 00016480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-09 22:25 - 2009-07-14 06:34 - 00016480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-09 22:18 - 2012-12-18 06:31 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-06-09 22:15 - 2014-06-07 14:04 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-09 22:15 - 2013-06-10 20:00 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-06-09 22:14 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-09 22:14 - 2009-07-14 06:39 - 00060582 _____ () C:\Windows\setupact.log
2014-06-09 22:13 - 2010-11-20 23:48 - 00418374 _____ () C:\Windows\PFRO.log
2014-06-07 14:09 - 2014-06-07 14:09 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\AVAST Software
2014-06-07 14:08 - 2014-06-07 14:08 - 00002127 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-07 14:08 - 2014-06-07 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-07 14:07 - 2014-06-07 14:04 - 00000000 ____D () C:\Users\Jutta\AppData\Local\Google
2014-06-07 14:07 - 2014-06-07 14:03 - 00777488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-07 14:07 - 2014-06-07 14:03 - 00411680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-07 14:07 - 2014-06-07 14:03 - 00068312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-07 14:06 - 2014-06-07 14:06 - 00002201 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-07 14:06 - 2014-06-07 14:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-07 14:06 - 2014-06-07 14:04 - 00000000 ____D () C:\Program Files\Google
2014-06-07 14:03 - 2014-06-07 14:03 - 00776976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00411552 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402142849561
2014-06-07 14:03 - 2014-06-07 14:03 - 00271264 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-07 14:03 - 2014-06-07 14:03 - 00180632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-07 14:03 - 2014-06-07 14:03 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-07 14:03 - 2014-06-07 14:03 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-07 14:01 - 2014-06-07 14:01 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-07 13:56 - 2014-06-07 13:55 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-07 13:52 - 2014-06-07 13:49 - 88882192 _____ (AVAST Software) C:\Users\Jutta\Downloads\avast_free18_antivirus_setup.exe
2014-06-05 15:25 - 2014-06-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Jutta\Desktop\TFC.exe
2014-06-05 15:16 - 2013-07-10 20:10 - 00000278 _____ () C:\Windows\Tasks\AdvancedDriverUpdater_UPDATES.job
2014-06-04 20:24 - 2014-06-04 20:24 - 02347384 _____ (ESET) C:\Users\Jutta\Downloads\esetsmartinstaller_deu.exe
2014-06-04 20:05 - 2012-03-20 11:05 - 00000000 ____D () C:\ProgramData\Symantec
2014-06-04 19:59 - 2014-06-04 19:59 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Systweak
2014-06-03 20:42 - 2010-11-20 23:01 - 01620776 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-03 20:28 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-03 20:08 - 2014-05-24 19:41 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-03 20:08 - 2014-05-24 19:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-03 20:08 - 2014-05-24 19:40 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-03 20:06 - 2014-06-03 20:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-02 20:23 - 2014-02-22 14:06 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-02 20:22 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-31 20:40 - 2014-05-31 20:40 - 00001998 _____ () C:\Users\Jutta\Desktop\JRT.txt
2014-05-30 19:35 - 2014-05-27 12:21 - 00028288 _____ () C:\Users\Jutta\Downloads\FRST.txt
2014-05-30 19:31 - 2014-05-30 19:31 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST(1).exe
2014-05-30 19:16 - 2014-05-30 19:16 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 19:14 - 2014-05-30 19:14 - 01016261 _____ (Thisisu) C:\Users\Jutta\Downloads\JRT(1).exe
2014-05-30 19:13 - 2014-05-30 19:13 - 01016261 _____ (Thisisu) C:\Users\Jutta\Desktop\JRT.exe
2014-05-30 19:01 - 2011-04-22 16:12 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-30 18:59 - 2014-05-30 18:56 - 00000000 ____D () C:\AdwCleaner
2014-05-30 18:59 - 2012-10-02 20:35 - 00001156 _____ () C:\Users\Jutta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-30 18:59 - 2012-03-20 10:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Packard Bell - Security & Support
2014-05-30 18:59 - 2011-04-22 16:12 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-30 18:59 - 2011-04-22 16:12 - 00001015 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-30 18:55 - 2014-05-30 18:55 - 01327971 _____ () C:\Users\Jutta\Downloads\adwcleaner_3.211.exe
2014-05-27 12:41 - 2014-05-27 12:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-27 12:27 - 2014-05-27 12:25 - 00030582 _____ () C:\Users\Jutta\Downloads\Addition.txt
2014-05-27 12:15 - 2014-05-27 12:14 - 01056256 _____ (Farbar) C:\Users\Jutta\Downloads\FRST.exe
2014-05-25 13:52 - 2012-03-20 10:57 - 00000000 ____D () C:\Windows\fi
2014-05-24 23:33 - 2012-10-28 16:37 - 00000000 ____D () C:\Users\Jutta\AppData\Local\CrashDumps
2014-05-24 20:41 - 2009-07-14 04:04 - 00000505 _____ () C:\Windows\win.ini
2014-05-24 20:40 - 2014-02-22 14:06 - 00000000 ____D () C:\ProgramData\PPPT2PNGG
2014-05-24 20:40 - 2014-02-22 14:06 - 00000000 ____D () C:\ProgramData\downloaddiitkeep
2014-05-24 20:40 - 2014-01-27 22:00 - 00000000 ____D () C:\ProgramData\APPPtoU
2014-05-24 20:40 - 2013-11-15 18:08 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Systweak
2014-05-24 20:40 - 2013-11-15 18:08 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Systweak
2014-05-24 20:02 - 2014-05-07 09:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-24 20:02 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-24 19:53 - 2012-03-20 11:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-24 19:53 - 2012-03-20 11:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-24 19:40 - 2014-05-24 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-24 19:34 - 2014-05-24 19:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jutta\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-24 19:06 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-18 19:29 - 2013-08-15 23:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-18 19:29 - 2012-11-04 16:08 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 19:28 - 2012-10-02 20:38 - 00000000 ____D () C:\Users\Jutta\AppData\Roaming\Skype
2014-05-18 19:19 - 2013-07-20 10:13 - 00001414 _____ () C:\Users\Jutta\Desktop\Registry kostenlos entrümpeln!.lnk
2014-05-12 07:26 - 2014-05-24 19:40 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-24 19:40 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:25 - 2014-05-24 19:40 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-04-01 13:39

==================== End Of Log ============================

--- --- ---

cosinus · 09.06.2014, 22:43

Ähm, bist du sicher, dass du meinen Text gelesen und umgesetzt hast?

turtle2014 · 09.06.2014, 23:29

jau...ich glaub mir is immernoch zu warm....ich trottel hab scan und nicht fix gedrückt.

so, gleich nochmal:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:09-06-2014 03
Ran by Jutta at 2014-06-10 00:25:25 Run:2
Running from C:\Users\Jutta\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
R1 {fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w; C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys [52920 2014-04-24] (StdLib)
C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys
         
*****************

{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w => Service stopped successfully.
{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w => Service deleted successfully.
C:\Windows\System32\drivers\{fe0d951b-f1e9-4cbc-8054-78c95ed14cc5}w.sys => Moved successfully.

==== End of Fixlog ====

cosinus · 10.06.2014, 09:21

Gut. Was ist jetzt mit dem Removal Tool von Norton => https://support.norton.com/sp/de/de/...rProfile_de_de

turtle2014 · 10.06.2014, 09:54

Guten Morgen,

es hat gestern Nacht dann noch funktioniert ohne abzustürzen.

cosinus · 10.06.2014, 10:32

Dann wären wir durch!

Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Es empfiehlt sich Malwarebytes Anti-Malware zu behalten und damit wöchentlich nach Malware zu scannen.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

turtle2014 · 12.06.2014, 15:48

Hallo nochmal,

ich bin immernoch beim Updaten...das dauert hier sehr lange.

Ich habe immernoch das Problem mit den Umleitungen - einfach nur wenn die Seite offen ist auch ohne das ich etwas tue. Und auch die unterstrichenen Wörter in Texten mit so einem kleinen grünen Pfeil dran, die dann links sind, sind noch da.

Ist das auch irgendein Virus oder kann ich das mit Noscript und Adblock stoppen?
Avast und auch Malewarebytes zeigen mir auch dauernd an ,dass sie Seiten blockieren. Ist das ok so? Tut mir leid für die doofen Fragen - ich weiß einfach nicht ob das der Normalzustand ist auf dem Computer - ich kenne sowas sonst nicht.

Liebe Grüße
turtle

08.06.2014, 15:40	#21
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	über 1000 Funde mit Malewarebytes Dann ist das rel. neue Adware. Bite neue Logs mit FRST erstellen und posten __________________ --> über 1000 Funde mit Malewarebytes

09.06.2014, 22:43	#25
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	über 1000 Funde mit Malewarebytes Ähm, bist du sicher, dass du meinen Text gelesen und umgesetzt hast? __________________ Logfiles bitte immer in CODE-Tags posten

10.06.2014, 09:21	#27
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	über 1000 Funde mit Malewarebytes Gut. Was ist jetzt mit dem Removal Tool von Norton => https://support.norton.com/sp/de/de/...rProfile_de_de __________________ Logfiles bitte immer in CODE-Tags posten

über 1000 Funde mit Malewarebytes

Plagegeister aller Art und deren Bekämpfung: über 1000 Funde mit Malewarebytes