Mailzugang gesperrt, weil Viren/Spam Mails verschickt werden

Dawn007 · 29.05.2014, 19:32

Hallo!

Mein Telefonanbieter hat gestern und auch wieder heute meinen mobilen Mailzugang gesperrt, da von diesem Spam- bzw. Virenmails verschickt wurden. Ich steige am PC über den Hotspot ins Internet ein.

Mir hat jemand von diesem Telekom Mail erzählt und ich bin mir jetzt nicht sicher, ob ich das geöffnet habe.

Ich habe dann den WinZip Malware Protecto laufen lassen und die folgenden Daten erhalten. Es wurden 395 Infektionen entdeckt. Kann ich alles bereinigen.

Leider kenne ich mich gar nicht aus und ich wäre wirklich froh, wenn mir jemand weiterhelfen könnte.

Liebe Grüße
C*

Das ist das Protokoll:

Nico Mak Computing
WinZip Malware Protector

Datum der Überprüfung Donnerstag, 29. Mai 2014
Datenbankversion 1817
Gefundene Elemente insgesamt 395
Überprüfte Objekte: 321387
Abgelaufene Zeit: 00:23:11
Name Gefundene Elemente

Name der Infektion pup.optional
Kategorie Potentially Unwanted Application
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 131

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\nsd67a1.exe
MD5 10464307472671609845
Signatur 0
Md5hash: cbb0857b4e4c5d947a0933733f19affc

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\nsn31f1.exe
MD5 10464307472671609845
Signatur 0
Md5hash: cbb0857b4e4c5d947a0933733f19affc

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\nssd51f.exe
MD5 10464307472671609845
Signatur 0
Md5hash: cbb0857b4e4c5d947a0933733f19affc

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\nst5a94.exe
MD5 10464307472671609845
Signatur 0
Md5hash: cbb0857b4e4c5d947a0933733f19affc

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\nsy238d.exe
MD5 10464307472671609845
Signatur 0
Md5hash: cbb0857b4e4c5d947a0933733f19affc

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\nsyf7b0.exe
MD5 10464307472671609845
Signatur 0
Md5hash: cbb0857b4e4c5d947a0933733f19affc

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\ct3317892\fflogic.exe
MD5 18119549121414533377
Signatur 0
Md5hash: 80fa2c7cbb2976e2ab8387ebc340ddeb

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\temp\ct3317892\stub.exe
MD5 13667161005847759553
Signatur 0
Md5hash: 38f9eb9aad7dbc947c5a55f57f081692

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\downloadguide\offers\mconduitinstaller.exe
MD5 5813395861795313261
Signatur 0
Md5hash: 7edd87ee5faed1733fe49eb16f691bb8

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\microsoft\windows\temporary internet files\content.ie5\2sswtz2q\conduitinstaller[1].exe
MD5 13667161005847759553
Signatur 0
Md5hash: 38f9eb9aad7dbc947c5a55f57f081692

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\microsoft\windows\temporary internet files\content.ie5\2sswtz2q\spsetup[1].exe
MD5 6003231468161003056
Signatur 0
Md5hash: 12fd3fdd30842b7b335c8b3e984bec2b

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\microsoft\windows\temporary internet files\content.ie5\vtw4rb5w\radiototal1[1].exe
MD5 18119549121414533377
Signatur 0
Md5hash: 80fa2c7cbb2976e2ab8387ebc340ddeb

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
clsid\{4aa46d49-459f-4358-b4d1-169048547c23}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
clsid\{4aa46d49-459f-4358-b4d1-169048547c23}
id

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\backgroundcontainer

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\backgroundcontainer
lastautoupdatetime

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\backgroundcontainer\logicfilemanager

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\backgroundcontainer\logicfilemanager
logicfileversion

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\backgroundcontainer\logicfilemanager
logicfilepath

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\assetsuserchangemonitor

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\assetsuserchangemonitor
assetsmonitor_active

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\assetsuserchangemonitor
assetsmonitor_ieoptionsthreadid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\assetsuserchangemonitor
assetsmonitor_manageaddonsthreadid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\assetsuserchangemonitor
assetsmonitor_homepagehasbeenselectedbyuser

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\assetsuserchangemonitor
assetsmonitor_searchhasbeenselectedbyuser

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
toolbaruserid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
toolbarfulluserid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
whitelist

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.downloaddate

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.shouldfirsttimedialog

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.enablealerts

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.openthankyoupage

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.installid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.installtype

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.searchinnewtabenabled

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.searchrevert

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.startpage

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.startpageurl

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.versionfrominstaller

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.installsp

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.defaultsearch

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.installsessionid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.startashidden

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.embeddedworkwhenhidden

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.searchusermode

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.searchuninstallusermode

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ctid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.installerversion

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.enablefix404

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.fixpagenotfounderror

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.installerkeysneedmigration

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.toolbarinstalldate

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.uninstallcommand

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.default.originalhomepage

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.default.originalrestoreonstartup

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.default.originalrestoreonstartupurls

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.default.originalsuggesturl

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.default.originalomniboxurl

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.default.originalsearchid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.nmhostversion

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\cfigonhgidedenkkhlilmefgodjpefna\repository
ct3317892.wasnativemessagingdeployed

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\globalstorage

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\globalstorage\repository

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\globalstorage\repository
machineid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\chromeextdata\globalstorage\repository
ctidupdatedfromhkcutohklmbycre

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\data

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\data\sources

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\data\sources\ie_tb_ct3317892

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\data\sources\ie_tb_ct3317892
1802207

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\registeredsources

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\registeredsources
ie_tb_ct3317892

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
autoupdateenabled

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
alpclientsservername

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
alpservicesservername

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
showalerts

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
userid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
firsttimemessagedisplayed

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
samplealertwasshown

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
loginmessagelastchecktime

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
loginmessagelastupdatetime

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\community alerts\settings
firsttimestamp

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook
activehooktoolbarname

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook\radiototal1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook\radiototal1
hookdllpath

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook\radiototal1
hookdllversion

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook\radiototal1
hookdllname

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\ie\hook\radiototal1
hook64dllname

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\revertsettings

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\revertsettings
homepage

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\revertsettings
defaultsearchscope

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\revertsettings
conduitlatesthomepage

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\settings

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\settings
param5

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\settings
param1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\settings
param2

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduit\settings
param3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduitsearchscopes

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\software\conduitsearchscopes
{8bd24955-f0cb-4c3c-a697-9a157deb9a07}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\toolbar

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\toolbar\registeredsources

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\toolbar\registeredsources
ct3317892

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\conduit\ff

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\conduit\ff
smartbar.machineid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\conduit\ff
ct3317892.userid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\conduit\ff
ct3317892.fulluserid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\conduit\ff
ct3317892.searchusermode

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\conduit\ff
ct3317892.searchuninstallusermode

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\clsid\{1aa60054-57d9-4f99-9a55-d0fbfbe7ecd3}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\clsid\{4aa46d49-459f-4358-b4d1-169048547c23}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\clsid\{4aa46d49-459f-4358-b4d1-169048547c23}
id

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect
spid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect
environment

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ch

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ch
carrierid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ch
carrierversion

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ff

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ff
carrierid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ff
carrierversion

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ie

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ie
carrierid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\searchprotect\ie
carrierversion

Name der Infektion malware.gen
Kategorie Generic Malware
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 1

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\adobe\acrobat\10.0\cache\rdlang_search.deu
MD5 0
Signatur 17654218230491659401
Md5hash: 372cfcc3d40be7b8011195163db33484

Name der Infektion malware.unclasified
Kategorie Generic Malware
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 1

Gefundener Bereich FileSystem
Details
Dateiname c:\users\carmen\appdata\local\microsoft\windows\temporary internet files\content.ie5\r1owtakw\tbupdaterlogic[1].dll
MD5 0
Signatur 2470296697182918983
Md5hash: dba5610430a43dcc2d1fe60905c078a7

Name der Infektion trojan.agent
Kategorie Trojan
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 2

Gefundener Bereich FileSystem
Details
Dateiname c:\windows\system32\svchospt.exe
MD5 0
Signatur 16760652018700823539
Md5hash: 1b286ff55b6726bc8ca87484ca5b2397

Gefundener Bereich FileSystem
Details
Dateiname c:\windows\system32\wpc32.exe
MD5 0
Signatur 9072986151952963037
Md5hash: dd8429b70f50b4ef32a5825668fc5881

Name der Infektion malware.affiliate
Kategorie Generic Malware
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 1

Gefundener Bereich RegistryValueData
Details
Registrierungsschlüssel hkey_local_machine
software\microsoft\internet explorer\main
start page

Name der Infektion pup.optional-sbx
Kategorie Potentially Unwanted Application
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\domstorage\conduit.com

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\domstorage\conduit.com
numberofsubdomains

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\domstorage\conduit.com
total

Name der Infektion pup.optional-snk
Kategorie Potentially Unwanted Application
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 224

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
date

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
data.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
data.1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
usr.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
usr.1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
uuid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
lrts

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
mode

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
iiid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
lrtt

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
370856c7

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
493c7345

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
3efeb33e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
4a40bed9

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
c65ee412

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
51d2f2ea

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
a2e3b941

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
bbf88800

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
a1dcff5b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
340d3099

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
0e93c3f3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
0c230bcb

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
27ddcf6f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
414bc593

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
f0bf0bde

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c99a5f5c

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
72758a5d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
e46c271e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
7f69fa1f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
3c09c42b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
7367429f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
0dc3ee96

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
d1abcdb6

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
38583bc3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c24899a6

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
65114b36

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
f1f24e29

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
6185d035

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c5705860

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
a0743acc

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c6c5dd44

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
1520c6f1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
2d71d5ab

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
8b9e4cbc

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
fe94ce1e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
587b5709

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
d94388d2

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
37b7a6d8

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
060df2cd

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
e8f9dcc7

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
1c311243

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
f2c53c49

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c59938ae

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\evq

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.4

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.5

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.6

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.7

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.8

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.9

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.a

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.c

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.10

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.11

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.12

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.13

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.14

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.15

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.16

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.17

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.18

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.19

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1a

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1c

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.1f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.20

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.21

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.22

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.23

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.24

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.25

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.26

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.27

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.28

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.29

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2a

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2c

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.2f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.30

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.31

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.33

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.34

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.35

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.36

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.37

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.38

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.39

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3a

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3c

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ext
npsq6wmnjrvyuohvaj.3f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
336342342

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
336342343

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
435687356234

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
4123423678

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
635687356234

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
3563346254316

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
535687356234

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
19283160754632

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
4232523456236

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\appdatalow\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\ini
735687356234

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{3a7d3e19-1b79-4e4e-bd96-5467da2c4ef0}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{3a7d3e19-1b79-4e4e-bd96-5467da2c4ef0}
n

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
date

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
data.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
data.1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
usr.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
usr.1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
version

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
uuid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
state

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
lrts

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
mode

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
svn

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
svx

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
svi

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
svt

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
iiid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
dlpath

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
svpath

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8
install_dir

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
370856c7

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
493c7345

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
3efeb33e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
4a40bed9

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\00000000
c65ee412

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
51d2f2ea

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
a2e3b941

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
bbf88800

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
a1dcff5b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
340d3099

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
0e93c3f3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
0c230bcb

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
27ddcf6f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
414bc593

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
f0bf0bde

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c99a5f5c

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
72758a5d

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
e46c271e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
7f69fa1f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
3c09c42b

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
7367429f

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
0dc3ee96

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
d1abcdb6

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
38583bc3

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c24899a6

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
65114b36

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
f1f24e29

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
6185d035

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c5705860

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
a0743acc

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
c6c5dd44

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
1520c6f1

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
2d71d5ab

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
8b9e4cbc

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
fe94ce1e

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
587b5709

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
d94388d2

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
37b7a6d8

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
060df2cd

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
e8f9dcc7

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
1c311243

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{5f189df5-2d05-472b-9091-84d9848ae48b}\_f3dadae8\eae10f9d
f2c53c49

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{77d46e27-0e41-4478-87a6-aabe6fbcf252}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{77d46e27-0e41-4478-87a6-aabe6fbcf252}
f3dadae8

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\{77d46e27-0e41-4478-87a6-aabe6fbcf252}
n

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\proxystubclsid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\proxystubclsid32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\typelib

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\typelib
version

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{c66f0b7a-bd67-4982-af71-c6ca6e7f016f}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{c66f0b7a-bd67-4982-af71-c6ca6e7f016f}\proxystubclsid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{c66f0b7a-bd67-4982-af71-c6ca6e7f016f}\proxystubclsid32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{c66f0b7a-bd67-4982-af71-c6ca6e7f016f}\typelib

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{c66f0b7a-bd67-4982-af71-c6ca6e7f016f}\typelib
version

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{eaf749dc-cd87-4b04-b22a-d4ac3fbcb2bc}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{eaf749dc-cd87-4b04-b22a-d4ac3fbcb2bc}\proxystubclsid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{eaf749dc-cd87-4b04-b22a-d4ac3fbcb2bc}\proxystubclsid32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{eaf749dc-cd87-4b04-b22a-d4ac3fbcb2bc}\typelib

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{eaf749dc-cd87-4b04-b22a-d4ac3fbcb2bc}\typelib
version

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\0\win32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\flags

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\helpdir

Name der Infektion pup.optional-wsas
Kategorie Potentially Unwanted Application
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 21

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\proxystubclsid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\proxystubclsid32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\typelib

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
interface\{31e3bc75-2a09-4cff-9c92-8d0ed8d1dc0f}\typelib
version

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\0\win32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\flags

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_classes_root
typelib\{e2343056-cc08-46ac-b898-bfc7acf4e755}\1.0\helpdir

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
displayname

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
faviconurl

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
faviconurlfallback

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_current_user
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
url

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
displayname

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
faviconurl

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
faviconurlfallback

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\microsoft\internet explorer\searchscopes\{bb74de59-bc4c-4172-9ac4-73315f71cffe}
url

Name der Infektion pup.optional-sqt
Kategorie Potentially Unwanted Application
Bedrohungsstufe High
Durchgeführte Aktion NoActionTaken
Elemente gefunden 11

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{3f607e46-0d3c-4442-b1de-de7fa4768f5c}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{3f607e46-0d3c-4442-b1de-de7fa4768f5c}\proxystubclsid

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{3f607e46-0d3c-4442-b1de-de7fa4768f5c}\proxystubclsid32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{3f607e46-0d3c-4442-b1de-de7fa4768f5c}\typelib

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\interface\{3f607e46-0d3c-4442-b1de-de7fa4768f5c}\typelib
version

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}\2.0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}\2.0\0

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}\2.0\0\win32

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}\2.0\flags

Gefundener Bereich Registry
Details
Registrierungsschlüssel hkey_local_machine
software\classes\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}\2.0\helpdir

© 2013 WinZip International LLC. All rights reserved.

cosinus · 29.05.2014, 19:36

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Dawn007 · 29.05.2014, 20:07

Hallo!

Danke für die schnelle Antwort.

Ich habe vorher noch das Programm Microsoft Support Emergency Response Tool verwendet, aber es wurde nichts gefunden.

Leider habe ich so gar keinen Plan und habe eben im Internet nachgeschaut und
eben unterschiedliche Möglichkeiten gefunden.

Ich werde mir gleich Farbar's Recovery Scan Tool runter laden und mit den Scan starten.

Vielen Dank!

LG, C*

#
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by Carmen (administrator) on PC on 29-05-2014 20:58:07
Running from C:\Users\Carmen\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Team H2O) C:\Program Files\Syncrosoft\POS\H2O\cledx.exe
(Pinnacle Systems GmbH) C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Nico Mak Computing) C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google) C:\Program Files\Google\Google Earth\client\googleearth.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11268096 2010-05-06] (Hewlett-Packard)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1983816 2009-07-27] (CANON INC.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [H2O] => C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [200069 2005-05-11] (Team H2O)
HKLM\...\Run: [USBToolTip] => C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe [199752 2007-02-20] (Pinnacle Systems GmbH)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Video_deluxe_MX_Download-Version\TrayServer_de.exe [90112 2008-08-07] (MAGIX AG)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [684024 2012-10-17] (Cisco Systems, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP: C:\Windows\system32\DeviceNP.dll (Hewlett-Packard Limited)
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [Amazon Cloud Player] => C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2013-12-12] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [yvhboot.exe] => C:\Users\Carmen\AppData\Roaming\Microsoft\yvhboot.exe [81920 2009-07-14] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {1698c791-4ce1-11e2-9d1f-6c626d50f8f0} - L:\Startme.exe
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {b03e6016-5592-11e2-b78a-6c626d50f8f0} - L:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {b79fe777-66c0-11e2-afa4-6c626d50f8f0} - L:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {e96cce0d-b079-11e3-a628-6c626d50f8f0} - L:\HTC_Sync_Manager_PC.exe
AppInit_DLLs: c:\progra~2\surfpr~1\surfpr~1.dll => C:\ProgramData\Surf Protect\SurfProtect.dll [4362752 2013-12-29] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Gadgetbox Search
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt.
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Gadgetbox Search
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt.
HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
URLSearchHook: HKLM - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
URLSearchHook: HKCU - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
SearchScopes: HKLM - DefaultScope {8BD24955-F0CB-4C3C-A697-9A157DEB9A07} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031783
SearchScopes: HKLM - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchingissme.info/?unqvl=23&l=1&q={searchTerms}
SearchScopes: HKCU - DefaultScope {8BD24955-F0CB-4C3C-A697-9A157DEB9A07} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {8BD24955-F0CB-4C3C-A697-9A157DEB9A07} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {AD8FB106-479B-45DF-87AE-AFF364B5017C} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=33019EC3-2EEC-45B9-9181-EAD46E667248&apn_sauid=88B877D9-E9AB-4C5B-9F55-98A93699F16C
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = 
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchingissme.info/?unqvl=23&l=1&q={searchTerms}
SearchScopes: HKCU - {D41A14C8-43E4-4464-9A05-A434CC01A2BA} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=58a98c6f000000000000100d7f322c2f&r=688
BHO: Isaavveur - {012F9CB5-DE63-5FED-E274-A242A02DDF77} - C:\ProgramData\Isaavveur\LR6.dll ()
BHO: RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: NetoCouPoon - {A5EBBE4A-BF8B-6AA9-AFB1-945D12A01B17} - C:\ProgramData\NetoCouPoon\G_76xS4V.dll ()
BHO: IsuaveR - {AAA00FFE-A528-48A2-0836-ADCF1449254D} - C:\ProgramData\IsuaveR\OQP8.dll ()
BHO: ResultsAlpha - {cbab673a-a480-4050-bd2b-5de24a7a0282} - C:\Program Files\ResultsAlpha\ResultsAlphabho.dll No File
BHO: TuobeIttAodBlockFar - {D06346B9-1B63-DD92-C021-06375480FEDA} - C:\ProgramData\TuobeIttAodBlockFar\ebsac_.dll ()
Toolbar: HKLM - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - RadioTotal1 Toolbar - {422F7661-9403-4DA4-B4EF-CC3E268817B5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.99 - C:\Program Files\NOS\bin\np_gp.dll No File
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\user.js
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Isaavveur - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\aiv.ou@xqdoyu-.org [2014-01-01]
FF Extension: CheeapMieu - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\c.ye@rtgr-jir.net [2014-05-21]
FF Extension: IsuaveR - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\qcvgssmbr@aooqrztag.net [2014-01-01]
FF Extension: Adblock Plus - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-25]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-05-11]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ []
FF HKLM\...\Firefox\Extensions: [support@predictad.com] - C:\Program Files\AutocompletePro\support@predictad.com
FF Extension: AutocompletePro - Your handy search suggestions tool - C:\Program Files\AutocompletePro\support@predictad.com [2010-10-24]
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-10-01]

Chrome: 
=======
CHR DefaultSearchProvider: Google 
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de
CHR DefaultNewTabURL: Google
CHR Extension: (Isaavveur) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd [2014-01-01]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-31]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-31]
CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf [2013-12-24]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm [2013-06-02]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga [2013-06-02]
CHR Extension: (Norton Identity Protection) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-31]
CHR Extension: (Google Wallet) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19]
CHR Extension: (Citavi Picker) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio [2013-11-19]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-31]
CHR Extension: (IsuaveR) - C:\ProgramData\fkphdobphgabmhaefenkmhcoijilggdo [2014-01-01]
CHR HKLM\...\Chrome\Extension: [aaokmnpaoippoclepikifeegeknpopea] - C:\Program Files\ResultsAlpha\aaokmnpaoippoclepikifeegeknpopea.crx [2014-01-01]
CHR HKLM\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\Carmen\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2014-01-01]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\Exts\Chrome.crx [2013-04-03]
CHR HKLM\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx [2013-10-01]
CHR HKCU\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\Carmen\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-10-01]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2012-01-18] ()
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300808 2010-04-22] (DigitalPersona, Inc.)
R2 f3dadae8; C:\ProgramData\Surf Protect\SurfProtectSvc.dll [179024 2013-12-29] ()
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®)
S3 FLCDLOCK; C:\Windows\system32\flcdlock.exe [362040 2010-04-28] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-16] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [298496 2010-05-06] (Hewlett-Packard)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [544248 2012-10-17] (Cisco Systems, Inc.)
S2 Update ResultsAlpha; "C:\Program Files\ResultsAlpha\updateResultsAlpha.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [87976 2012-10-17] (Cisco Systems, Inc.)
R3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh6.sys [1093888 2011-12-12] (Broadcom Corporation)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation)
R3 CLEDX; C:\Windows\System32\DRIVERS\cledx.sys [33792 2005-05-09] (Team H2O)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2010-03-08] (Hewlett-Packard Development Company L.P.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2013-04-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-04-02] (Symantec Corporation)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130705.001\IDSvix86.sys [386720 2012-09-01] (Symantec Corporation)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVENG.SYS [93272 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVEX15.SYS [1611992 2013-05-22] (Symantec Corporation)
S2 Nsynas32; C:\Windows\system32\Drivers\Nsynas32.sys [17784 2001-04-09] (Syncrosoft Hard- und Software GmbH)
R1 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)
R1 RsvLock; C:\Windows\system32\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\system32\Drivers\SafeBoot.sys [110520 2010-02-01] ()
R0 SbAlg; C:\Windows\system32\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\system32\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309010.00E\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1309010.00E\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation)
S3 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R0 SymDS; C:\Windows\System32\drivers\NIS\1309010.00E\SYMDS.SYS [340088 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1309010.00E\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-03-29] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [149624 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [318584 2012-04-18] (Symantec Corporation)
S3 .neoli; No ImagePath
S3 ASAPIW2K; \??\C:\Windows\system32\Drivers\asapiW2k.sys [X]
S3 grmnusb; system32\drivers\grmnusb.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-29 20:58 - 2014-05-29 20:58 - 00028401 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-29 20:53 - 2014-05-29 20:58 - 00000000 ____D () C:\FRST
2014-05-29 20:51 - 2014-05-29 20:51 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 14:18 - 2014-05-29 14:18 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-29 14:17 - 2014-05-29 14:17 - 00001149 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\Program Files\WinZip Malware Protector
2014-05-29 14:17 - 2013-03-15 17:01 - 00016384 _____ () C:\Windows\system32\wsusnative32.exe
2014-05-28 09:13 - 2014-05-28 09:22 - 102679320 _____ (Microsoft Corporation) C:\Users\Carmen\Desktop\msert.exe
2014-05-28 09:13 - 2014-05-28 09:13 - 00000000 ____D () C:\Users\Carmen\AppData\Local\{79065086-A415-4DFA-B5CC-704EB8A45519}
2014-05-28 08:29 - 2014-05-29 13:39 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-27 13:57 - 2014-05-27 16:48 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:34 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 19:34 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 19:34 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 16:26 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 16:26 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 16:26 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 16:26 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 16:26 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 16:26 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 16:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-14 16:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-07 01:09 - 2014-05-15 06:49 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-05-29 20:58 - 2014-05-29 20:58 - 00028401 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-29 20:58 - 2014-05-29 20:53 - 00000000 ____D () C:\FRST
2014-05-29 20:58 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-29 20:58 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-29 20:57 - 2010-09-21 22:28 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-29 20:51 - 2014-05-29 20:51 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 20:11 - 2013-04-07 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-29 19:16 - 2010-09-14 12:05 - 01584684 _____ () C:\Windows\WindowsUpdate.log
2014-05-29 15:56 - 2010-10-12 19:09 - 00000000 ____D () C:\Users\Carmen\AppData\Local\CrashDumps
2014-05-29 14:18 - 2014-05-29 14:18 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-29 14:17 - 2014-05-29 14:17 - 00001149 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\Program Files\WinZip Malware Protector
2014-05-29 13:39 - 2014-05-28 08:29 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-29 13:14 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\PDFC
2014-05-29 13:10 - 2009-07-25 14:54 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-29 13:06 - 2010-09-21 22:28 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-29 13:04 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-05-29 13:03 - 2011-05-24 21:51 - 00159302 _____ () C:\Windows\setupact.log
2014-05-29 13:03 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-28 09:22 - 2014-05-28 09:13 - 102679320 _____ (Microsoft Corporation) C:\Users\Carmen\Desktop\msert.exe
2014-05-28 09:13 - 2014-05-28 09:13 - 00000000 ____D () C:\Users\Carmen\AppData\Local\{79065086-A415-4DFA-B5CC-704EB8A45519}
2014-05-28 09:13 - 2012-06-17 20:37 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Windows Live
2014-05-28 08:53 - 2012-10-15 21:25 - 00000000 ____D () C:\Users\Carmen\05 Pädagogik
2014-05-27 16:48 - 2014-05-27 13:57 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-26 22:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-26 08:04 - 2012-11-15 22:47 - 00000324 _____ () C:\Windows\Tasks\HPCeeScheduleForCarmen.job
2014-05-25 19:47 - 2011-04-23 19:45 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2014-05-22 01:14 - 2012-11-03 17:33 - 00000000 ____D () C:\Users\Carmen\Documents\My Digital Editions
2014-05-22 00:19 - 2010-09-14 13:45 - 00289280 _____ () C:\Users\Carmen\Desktop\Kalender Wohnungen.xls
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-21 21:41 - 2014-01-01 00:24 - 00000000 ____D () C:\ProgramData\7fa4f63c7c9d599c
2014-05-17 23:18 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-16 18:06 - 2011-06-18 10:09 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-15 07:39 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 06:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 06:49 - 2014-05-07 01:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 06:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-14 19:39 - 2013-08-21 22:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 19:39 - 2010-09-14 12:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:36 - 2010-09-14 22:08 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 18:12 - 2012-12-10 20:33 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-14 18:12 - 2011-06-24 16:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 06:45 - 2012-12-12 13:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 09:06 - 2014-05-14 16:26 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-14 16:26 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-07 19:13 - 2013-12-23 08:27 - 00016063 _____ () C:\Users\Carmen\Desktop\to do.xlsx
2014-05-06 05:25 - 2014-05-14 19:34 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-14 19:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-14 19:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-04-29 00:41 - 2014-04-28 11:10 - 00001965 _____ () C:\Users\Carmen\Desktop\Ruepp.txt

Files to move or delete:
====================
C:\Users\Carmen\SyncToy_84f5b4d1-9b77-4dbf-ba50-954d00c42e2d.dat
C:\Users\Carmen\SyncToy_87bd734d-5699-4c8a-b49e-4f3a3ea1cf1b.dat
C:\Users\Carmen\SyncToy_9fe00e05-472c-4ad6-9f82-d40b2ad88f87.dat


Some content of TEMP:
====================
C:\Users\Carmen\AppData\Local\Temp\aacdec.exe
C:\Users\Carmen\AppData\Local\Temp\doxillionsetup.exe
C:\Users\Carmen\AppData\Local\Temp\nsd67A1.exe
C:\Users\Carmen\AppData\Local\Temp\nsn31F1.exe
C:\Users\Carmen\AppData\Local\Temp\nssD51F.exe
C:\Users\Carmen\AppData\Local\Temp\nst5A94.exe
C:\Users\Carmen\AppData\Local\Temp\nsy238D.exe
C:\Users\Carmen\AppData\Local\Temp\nsyF7B0.exe
C:\Users\Carmen\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Carmen\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Carmen\AppData\Local\Temp\SPStub.exe
C:\Users\Carmen\AppData\Local\Temp\sqlite3.exe
C:\Users\Carmen\AppData\Local\Temp\vavpmop-.dll
C:\Users\Carmen\AppData\Local\Temp\_l4plafv.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-14 16:26] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67

C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 17:39

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

#
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by Carmen (administrator) on PC on 29-05-2014 20:58:07
Running from C:\Users\Carmen\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Team H2O) C:\Program Files\Syncrosoft\POS\H2O\cledx.exe
(Pinnacle Systems GmbH) C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Nico Mak Computing) C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google) C:\Program Files\Google\Google Earth\client\googleearth.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11268096 2010-05-06] (Hewlett-Packard)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1983816 2009-07-27] (CANON INC.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [H2O] => C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [200069 2005-05-11] (Team H2O)
HKLM\...\Run: [USBToolTip] => C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe [199752 2007-02-20] (Pinnacle Systems GmbH)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Video_deluxe_MX_Download-Version\TrayServer_de.exe [90112 2008-08-07] (MAGIX AG)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [684024 2012-10-17] (Cisco Systems, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP: C:\Windows\system32\DeviceNP.dll (Hewlett-Packard Limited)
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [Amazon Cloud Player] => C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2013-12-12] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [yvhboot.exe] => C:\Users\Carmen\AppData\Roaming\Microsoft\yvhboot.exe [81920 2009-07-14] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {1698c791-4ce1-11e2-9d1f-6c626d50f8f0} - L:\Startme.exe
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {b03e6016-5592-11e2-b78a-6c626d50f8f0} - L:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {b79fe777-66c0-11e2-afa4-6c626d50f8f0} - L:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\MountPoints2: {e96cce0d-b079-11e3-a628-6c626d50f8f0} - L:\HTC_Sync_Manager_PC.exe
AppInit_DLLs: c:\progra~2\surfpr~1\surfpr~1.dll => C:\ProgramData\Surf Protect\SurfProtect.dll [4362752 2013-12-29] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Gadgetbox Search
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt.
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Gadgetbox Search
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt.
HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
URLSearchHook: HKLM - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
URLSearchHook: HKCU - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
SearchScopes: HKLM - DefaultScope {8BD24955-F0CB-4C3C-A697-9A157DEB9A07} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031783
SearchScopes: HKLM - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchingissme.info/?unqvl=23&l=1&q={searchTerms}
SearchScopes: HKCU - DefaultScope {8BD24955-F0CB-4C3C-A697-9A157DEB9A07} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {8BD24955-F0CB-4C3C-A697-9A157DEB9A07} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {AD8FB106-479B-45DF-87AE-AFF364B5017C} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=33019EC3-2EEC-45B9-9181-EAD46E667248&apn_sauid=88B877D9-E9AB-4C5B-9F55-98A93699F16C
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = 
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchingissme.info/?unqvl=23&l=1&q={searchTerms}
SearchScopes: HKCU - {D41A14C8-43E4-4464-9A05-A434CC01A2BA} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=58a98c6f000000000000100d7f322c2f&r=688
BHO: Isaavveur - {012F9CB5-DE63-5FED-E274-A242A02DDF77} - C:\ProgramData\Isaavveur\LR6.dll ()
BHO: RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: NetoCouPoon - {A5EBBE4A-BF8B-6AA9-AFB1-945D12A01B17} - C:\ProgramData\NetoCouPoon\G_76xS4V.dll ()
BHO: IsuaveR - {AAA00FFE-A528-48A2-0836-ADCF1449254D} - C:\ProgramData\IsuaveR\OQP8.dll ()
BHO: ResultsAlpha - {cbab673a-a480-4050-bd2b-5de24a7a0282} - C:\Program Files\ResultsAlpha\ResultsAlphabho.dll No File
BHO: TuobeIttAodBlockFar - {D06346B9-1B63-DD92-C021-06375480FEDA} - C:\ProgramData\TuobeIttAodBlockFar\ebsac_.dll ()
Toolbar: HKLM - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - RadioTotal1 Toolbar - {422F7661-9403-4DA4-B4EF-CC3E268817B5} - C:\Program Files\RadioTotal1\prxtbRadi.dll No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.99 - C:\Program Files\NOS\bin\np_gp.dll No File
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\user.js
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Isaavveur - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\aiv.ou@xqdoyu-.org [2014-01-01]
FF Extension: CheeapMieu - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\c.ye@rtgr-jir.net [2014-05-21]
FF Extension: IsuaveR - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\qcvgssmbr@aooqrztag.net [2014-01-01]
FF Extension: Adblock Plus - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-25]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-05-11]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ []
FF HKLM\...\Firefox\Extensions: [support@predictad.com] - C:\Program Files\AutocompletePro\support@predictad.com
FF Extension: AutocompletePro - Your handy search suggestions tool - C:\Program Files\AutocompletePro\support@predictad.com [2010-10-24]
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-10-01]

Chrome: 
=======
CHR DefaultSearchProvider: Google 
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de
CHR DefaultNewTabURL: Google
CHR Extension: (Isaavveur) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd [2014-01-01]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-31]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-31]
CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf [2013-12-24]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm [2013-06-02]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga [2013-06-02]
CHR Extension: (Norton Identity Protection) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-31]
CHR Extension: (Google Wallet) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19]
CHR Extension: (Citavi Picker) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio [2013-11-19]
CHR Extension: (No Name) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-31]
CHR Extension: (IsuaveR) - C:\ProgramData\fkphdobphgabmhaefenkmhcoijilggdo [2014-01-01]
CHR HKLM\...\Chrome\Extension: [aaokmnpaoippoclepikifeegeknpopea] - C:\Program Files\ResultsAlpha\aaokmnpaoippoclepikifeegeknpopea.crx [2014-01-01]
CHR HKLM\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\Carmen\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2014-01-01]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\Exts\Chrome.crx [2013-04-03]
CHR HKLM\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx [2013-10-01]
CHR HKCU\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\Carmen\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-10-01]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2012-01-18] ()
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300808 2010-04-22] (DigitalPersona, Inc.)
R2 f3dadae8; C:\ProgramData\Surf Protect\SurfProtectSvc.dll [179024 2013-12-29] ()
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®)
S3 FLCDLOCK; C:\Windows\system32\flcdlock.exe [362040 2010-04-28] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-16] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [298496 2010-05-06] (Hewlett-Packard)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [544248 2012-10-17] (Cisco Systems, Inc.)
S2 Update ResultsAlpha; "C:\Program Files\ResultsAlpha\updateResultsAlpha.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [87976 2012-10-17] (Cisco Systems, Inc.)
R3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh6.sys [1093888 2011-12-12] (Broadcom Corporation)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation)
R3 CLEDX; C:\Windows\System32\DRIVERS\cledx.sys [33792 2005-05-09] (Team H2O)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2010-03-08] (Hewlett-Packard Development Company L.P.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2013-04-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-04-02] (Symantec Corporation)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130705.001\IDSvix86.sys [386720 2012-09-01] (Symantec Corporation)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVENG.SYS [93272 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVEX15.SYS [1611992 2013-05-22] (Symantec Corporation)
S2 Nsynas32; C:\Windows\system32\Drivers\Nsynas32.sys [17784 2001-04-09] (Syncrosoft Hard- und Software GmbH)
R1 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)
R1 RsvLock; C:\Windows\system32\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\system32\Drivers\SafeBoot.sys [110520 2010-02-01] ()
R0 SbAlg; C:\Windows\system32\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\system32\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309010.00E\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1309010.00E\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation)
S3 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R0 SymDS; C:\Windows\System32\drivers\NIS\1309010.00E\SYMDS.SYS [340088 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1309010.00E\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-03-29] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [149624 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [318584 2012-04-18] (Symantec Corporation)
S3 .neoli; No ImagePath
S3 ASAPIW2K; \??\C:\Windows\system32\Drivers\asapiW2k.sys [X]
S3 grmnusb; system32\drivers\grmnusb.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-29 20:58 - 2014-05-29 20:58 - 00028401 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-29 20:53 - 2014-05-29 20:58 - 00000000 ____D () C:\FRST
2014-05-29 20:51 - 2014-05-29 20:51 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 14:18 - 2014-05-29 14:18 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-29 14:17 - 2014-05-29 14:17 - 00001149 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\Program Files\WinZip Malware Protector
2014-05-29 14:17 - 2013-03-15 17:01 - 00016384 _____ () C:\Windows\system32\wsusnative32.exe
2014-05-28 09:13 - 2014-05-28 09:22 - 102679320 _____ (Microsoft Corporation) C:\Users\Carmen\Desktop\msert.exe
2014-05-28 09:13 - 2014-05-28 09:13 - 00000000 ____D () C:\Users\Carmen\AppData\Local\{79065086-A415-4DFA-B5CC-704EB8A45519}
2014-05-28 08:29 - 2014-05-29 13:39 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-27 13:57 - 2014-05-27 16:48 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:34 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 19:34 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 19:34 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 16:26 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 16:26 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 16:26 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 16:26 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 16:26 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 16:26 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 16:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-14 16:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-07 01:09 - 2014-05-15 06:49 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-05-29 20:58 - 2014-05-29 20:58 - 00028401 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-29 20:58 - 2014-05-29 20:53 - 00000000 ____D () C:\FRST
2014-05-29 20:58 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-29 20:58 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-29 20:57 - 2010-09-21 22:28 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-29 20:51 - 2014-05-29 20:51 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 20:11 - 2013-04-07 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-29 19:16 - 2010-09-14 12:05 - 01584684 _____ () C:\Windows\WindowsUpdate.log
2014-05-29 15:56 - 2010-10-12 19:09 - 00000000 ____D () C:\Users\Carmen\AppData\Local\CrashDumps
2014-05-29 14:18 - 2014-05-29 14:18 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-29 14:17 - 2014-05-29 14:17 - 00001149 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 14:17 - 2014-05-29 14:17 - 00000000 ____D () C:\Program Files\WinZip Malware Protector
2014-05-29 13:39 - 2014-05-28 08:29 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-29 13:14 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\PDFC
2014-05-29 13:10 - 2009-07-25 14:54 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-29 13:06 - 2010-09-21 22:28 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-29 13:04 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-05-29 13:03 - 2011-05-24 21:51 - 00159302 _____ () C:\Windows\setupact.log
2014-05-29 13:03 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-28 09:22 - 2014-05-28 09:13 - 102679320 _____ (Microsoft Corporation) C:\Users\Carmen\Desktop\msert.exe
2014-05-28 09:13 - 2014-05-28 09:13 - 00000000 ____D () C:\Users\Carmen\AppData\Local\{79065086-A415-4DFA-B5CC-704EB8A45519}
2014-05-28 09:13 - 2012-06-17 20:37 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Windows Live
2014-05-28 08:53 - 2012-10-15 21:25 - 00000000 ____D () C:\Users\Carmen\05 Pädagogik
2014-05-27 16:48 - 2014-05-27 13:57 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-26 22:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-26 08:04 - 2012-11-15 22:47 - 00000324 _____ () C:\Windows\Tasks\HPCeeScheduleForCarmen.job
2014-05-25 19:47 - 2011-04-23 19:45 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2014-05-22 01:14 - 2012-11-03 17:33 - 00000000 ____D () C:\Users\Carmen\Documents\My Digital Editions
2014-05-22 00:19 - 2010-09-14 13:45 - 00289280 _____ () C:\Users\Carmen\Desktop\Kalender Wohnungen.xls
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-21 21:41 - 2014-01-01 00:24 - 00000000 ____D () C:\ProgramData\7fa4f63c7c9d599c
2014-05-17 23:18 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-16 18:06 - 2011-06-18 10:09 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-15 07:39 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 06:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 06:49 - 2014-05-07 01:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 06:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-14 19:39 - 2013-08-21 22:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 19:39 - 2010-09-14 12:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:36 - 2010-09-14 22:08 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 18:12 - 2012-12-10 20:33 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-14 18:12 - 2011-06-24 16:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 06:45 - 2012-12-12 13:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 09:06 - 2014-05-14 16:26 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-14 16:26 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-07 19:13 - 2013-12-23 08:27 - 00016063 _____ () C:\Users\Carmen\Desktop\to do.xlsx
2014-05-06 05:25 - 2014-05-14 19:34 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-14 19:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-14 19:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-04-29 00:41 - 2014-04-28 11:10 - 00001965 _____ () C:\Users\Carmen\Desktop\Ruepp.txt

Files to move or delete:
====================
C:\Users\Carmen\SyncToy_84f5b4d1-9b77-4dbf-ba50-954d00c42e2d.dat
C:\Users\Carmen\SyncToy_87bd734d-5699-4c8a-b49e-4f3a3ea1cf1b.dat
C:\Users\Carmen\SyncToy_9fe00e05-472c-4ad6-9f82-d40b2ad88f87.dat


Some content of TEMP:
====================
C:\Users\Carmen\AppData\Local\Temp\aacdec.exe
C:\Users\Carmen\AppData\Local\Temp\doxillionsetup.exe
C:\Users\Carmen\AppData\Local\Temp\nsd67A1.exe
C:\Users\Carmen\AppData\Local\Temp\nsn31F1.exe
C:\Users\Carmen\AppData\Local\Temp\nssD51F.exe
C:\Users\Carmen\AppData\Local\Temp\nst5A94.exe
C:\Users\Carmen\AppData\Local\Temp\nsy238D.exe
C:\Users\Carmen\AppData\Local\Temp\nsyF7B0.exe
C:\Users\Carmen\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Carmen\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Carmen\AppData\Local\Temp\SPStub.exe
C:\Users\Carmen\AppData\Local\Temp\sqlite3.exe
C:\Users\Carmen\AppData\Local\Temp\vavpmop-.dll
C:\Users\Carmen\AppData\Local\Temp\_l4plafv.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-14 16:26] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67

C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 17:39

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Ich glaube jetzt hab ich zwei mal das gleiche geschickt...

Dawn007 · 29.05.2014, 20:07

#FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:25-05-2014 02
Ran by Carmen at 2014-05-29 20:58:29
Running from C:\Users\Carmen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe AIR (Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden
Adobe Digital Editions 2.0 (HKLM\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Reader X (10.1.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agent Ransack 2010 (HKLM\...\Agent Ransack_is1) (Version:  - )
Alpenvereinskarten Digital 2007 (HKLM\...\Alpenvereinskarten Digital 2007_is1) (Version:  - Deutscher Alpenverein und Österreichischer Alpenverein)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.2.0.399 - Amazon Services LLC)
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AutocompletePro (HKLM\...\AutocompletePro2_is1) (Version:  - ) <==== ATTENTION
Avid Studio (HKLM\...\{B35DC076-CEF2-4631-9EF7-45380E27C841}) (Version: 1.0.0.2804 - Avid)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon MP Navigator EX 3.0 (HKLM\...\MP Navigator EX 3.0) (Version:  - )
Canon MP550 series Benutzerregistrierung (HKLM\...\Canon MP550 series Benutzerregistrierung) (Version:  - )
Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version:  - )
Canon Utilities My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP)
Cisco AnyConnect Secure Mobility Client  (HKLM\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.01065 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.01065 - Cisco Systems, Inc.) Hidden
Citavi 4 (HKLM\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.2.0.11 - Swiss Academic Software)
conTinueytossave (HKLM\...\{C1C6816E-CBB3-A748-85F9-A8B47B68985B}) (Version:  - continue to save) <==== ATTENTION
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Debut Video Capture Software (HKLM\...\Debut) (Version:  - NCH Software)
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.8 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM\...\Drive Encryption) (Version: 5.0.6.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.6.0 - Hewlett-Packard) Hidden
EboookBryowsie (HKLM\...\{E5B7E1B4-21FC-6765-A3D7-BA0416DC6AF7}) (Version:  - EbookBrowse)
EC Software TNT Screen Capture 2.1 (HKLM\...\TNT Screen Capture_is1) (Version:  - EC Software)
File Sanitizer For HP ProtectTools (HKLM\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.4 - Hewlett-Packard)
Firebird SQL Server - MAGIX Edition (HKLM\...\{6C5F8503-55D2-4398-858C-362B7A7AF51C}) (Version: 2.1.31.0 - MAGIX AG)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free M4a to MP3 Converter 7.0 (HKLM\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version:  - )
Garmin MapSource (HKLM\...\{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}) (Version: 6.16.3 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM\...\Google Chrome) (Version: 31.0.1650.63 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
HP Customer Experience Enhancements (Version: 6.0.1.3 - Hewlett-Packard) Hidden
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.08.717 - Hewlett-Packard Company)
HP ProtectTools Security Manager (Version: 5.08.717 - Hewlett-Packard Company) Hidden
HP Support Assistant (HKLM\...\{495A8A3C-8FD0-4C46-9979-95C26181A1AB}) (Version: 4.3.1.2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.2.2 - Hewlett-Packard) Hidden
HTC Driver Installer (HKLM\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.6.0.001 - HTC Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.1968 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
IPTInstaller (HKLM\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
IsuaveR (HKLM\...\{F1422DAA-0829-09A1-7536-73936CAB8FFA}) (Version:  - Isaver) <==== ATTENTION
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 21 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.210 - Oracle)
Java Auto Updater (Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
MAGIX Screenshare (HKLM\...\{6635B372-E2C5-4C2F-97FB-D1766E017CEE}) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (MSI) (HKLM\...\{BFD631C4-FBB5-4AC5-B807-9137B265628C}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Video deluxe MX Download-Version (HKLM\...\MAGIX_MSI_Videodeluxe18) (Version: 11.0.0.38 - MAGIX AG)
MAGIX Video deluxe MX Download-Version (Version: 11.0.0.38 - MAGIX AG) Hidden
MapSource Product Install (HKLM\...\{B8BFB69F-BBBA-48A9-A788-851222571C77}) (Version: 4.00 - )
Media Go (HKLM\...\{5C318BD3-BA72-43E4-9D16-A18210B4A5A5}) (Version: 1.5.312 - Sony)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x86) ENU  (HKLM\...\{FF63121D-91C6-42CC-B341-F1AA729728E7}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x86) ENU  (HKLM\...\{D3A80508-CD83-4CA3-8671-914A1BC78B61}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Music Editor Free (HKLM\...\Music Editor Free) (Version:  - FAE Inc.)
NetoCouPoon (HKLM\...\{317D8BB4-16C3-CFBD-3777-AED69667DA46}) (Version:  - NetoCouupoN) <==== ATTENTION
Norton Internet Security (HKLM\...\NIS) (Version: 19.9.1.14 - Symantec Corporation)
Norton Online Backup (HKLM\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.1 - Pando Networks Inc.)
PDF Complete Special Edition (HKLM\...\PDF Complete) (Version: 3.5.109 - PDF Complete, Inc)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Pinnacle Video Treiber (HKLM\...\{6DE721A5-5E89-4D74-994C-652BB3C0672E}) (Version: 12.1.0.030 - Pinnacle Systems)
Prism Video File Converter (HKLM\...\Prism) (Version:  - NCH Software)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6029 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Surf Protect (HKLM\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{f3dadae8}) (Version:  - Appdev Ltd) <==== ATTENTION
SyncroSoft Emu (Remove only) (HKLM\...\SyncroSoft Emu) (Version:  - )
Syncrosofts Lizenz Kontrolle (HKLM\...\Syncrosoft's License Control) (Version:  - Syncrosoft Hard- und Software GmbH)
SyncToy 2.1 (x86) (HKLM\...\{A066194B-DC8F-449A-8E0F-B57BDD3A2072}) (Version: 2.1.0 - Microsoft)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
TuobeIttAodBlockFar (HKLM\...\{94EEB800-E533-7AE1-5C31-0446E1C0537C}) (Version:  - TiubeItAdBloockkFr)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VLC media player 2.1.0 (HKLM\...\VLC media player) (Version: 2.1.0 - VideoLAN)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter: Treiberupdate (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinZip Malware Protector (HKLM\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)
Zinio Reader 4 (HKLM\...\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1) (Version: 4.0.2811 - Zinio LLC)
Zinio Reader 4 (Version: 4.0.2811 - Zinio LLC) Hidden

==================== Restore Points  =========================

20-04-2014 20:59:05 Windows Update
22-04-2014 21:29:44 Windows Update
26-04-2014 14:30:57 Windows Update
30-04-2014 06:58:01 Windows Update
03-05-2014 15:56:14 Windows Update
03-05-2014 17:32:38 Windows Update
06-05-2014 19:07:46 Windows Update
06-05-2014 23:08:26 Windows Update
11-05-2014 10:25:19 Windows Update
14-05-2014 17:33:16 Windows Update
21-05-2014 19:16:24 Windows Update
25-05-2014 17:18:42 Windows Update

==================== Scheduled Tasks (whitelisted) =============

Task: {0FA6409A-30F4-4F83-9182-D0BDE8A5A213} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-09-21] (Google Inc.)
Task: {0FDCC68A-3BF7-433E-8EBE-5490763BF6AB} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-11-10] (Hewlett-Packard)
Task: {0FF5401B-8394-4D23-B91F-C27E9A518455} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {1BF6892B-8296-48E6-9D16-F9D6E2E6F9A1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {2758E833-DB8C-4C2A-BE9D-92DCD9A32104} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {293CC323-7E7A-45D7-93DF-67AFDEBE0079} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-11-10] (Hewlett-Packard)
Task: {2DC9ACF8-2C50-4673-89A2-4787C9A83C16} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {2F83F01C-46CB-4FF9-B880-4D397D25C69A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2014-05-13] (Microsoft)
Task: {49422AC1-7112-4708-A445-81C836C53AE6} - System32\Tasks\{5C40BDCC-8118-4ECC-86D3-0783E93AF114} => C:\Users\Herms\Desktop\MapSource_6162.exe
Task: {7BEC8E26-3B68-4FC0-98A6-2999EAE3B182} - System32\Tasks\{2E5ECC61-6436-4938-8AC7-E5F08A9297CD} => C:\Windows\system32\msiexec.exe [2010-11-20] (Microsoft Corporation)
Task: {7E745A6A-2217-42F1-B963-ED27E19938AE} - System32\Tasks\{DEFC665F-716F-4AC5-84FD-5F57B963E178} => C:\Program Files\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {8025FB41-AE0E-4293-B21C-74C8D51D852B} - System32\Tasks\{B93FB489-48BB-4A9A-9CBE-6048F9D5B1E9} => C:\Program Files\Steinberg\WaveLab\WaveLab.exe
Task: {88376A33-4827-4BAB-A11C-875943096303} - System32\Tasks\{1A2EAD50-2CDA-4C16-9AC8-D000CD2D71A0} => E:\Backup\Software\Programme\Steinberg_Wavelab 4.0g_german.exe [2003-08-15] ()
Task: {A6880532-292D-45A0-AB32-EA7B70574AE5} - System32\Tasks\{D9B3EE17-51FB-4939-8CB4-FA7B1D96B6E6} => C:\Program Files\No23 Recorder\No23Recorder.exe [2005-12-28] (Ivan Bischof ©2003 - 2005)
Task: {BCA4022D-65E7-4D49-8217-CB2B65A50577} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {C686BB0A-F8DD-454E-B5B9-250E977C44CF} - System32\Tasks\{FDB76638-D565-46D1-9E0F-DE8AFB92D628} => C:\Windows\system32\msiexec.exe [2010-11-20] (Microsoft Corporation)
Task: {C75866A1-A471-4FDC-A1A6-E6B58DF61469} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\19.9.1.14\WSCStub.exe [2013-02-02] (Symantec Corporation)
Task: {D2861342-C985-4982-8E2D-66227F94D351} - System32\Tasks\{2D767A24-CAF5-4F63-A192-C7E7300FB9E9} => C:\Program Files\Steinberg\WaveLab\WaveLab.exe
Task: {E55BED5B-852F-462E-A83C-D4E8399FDA87} - System32\Tasks\HPCeeScheduleForCarmen => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07] (Hewlett-Packard)
Task: {EDF53551-165E-4497-B3D4-096A59FFB34C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-09-21] (Google Inc.)
Task: {F52A2FEF-AD18-452B-8CA9-86BB9523D311} - \CreateChoiceProcessTask No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForCarmen.job => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2011-12-29 19:53 - 2001-10-28 18:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2012-01-09 23:54 - 2010-06-17 22:56 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2011-09-27 07:22 - 2011-09-27 07:22 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-12-29 17:27 - 2013-12-29 17:27 - 04362752 _____ () C:\ProgramData\Surf Protect\SurfProtect.dll
2013-12-29 17:27 - 2013-12-29 17:27 - 00179024 _____ () C:\ProgramData\Surf Protect\SurfProtectSvc.dll
2010-04-28 10:39 - 2010-04-28 10:39 - 00329272 _____ () C:\Windows\system32\flcdlmsg.dll
2012-10-17 19:30 - 2012-10-17 19:30 - 00062968 _____ () C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2011-09-27 07:23 - 2011-09-27 07:23 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2013-12-24 16:15 - 2013-12-12 21:56 - 03145536 _____ () C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
2014-05-29 14:17 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files\WinZip Malware Protector\System.Data.SQLite.dll
2014-05-29 14:17 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files\WinZip Malware Protector\aspsys.dll
2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2009-02-26 14:46 - 2009-02-26 14:46 - 00064344 _____ () C:\Program Files\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 12:46 - 2011-06-22 12:46 - 00434016 _____ () C:\Program Files\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2014-05-11 14:52 - 2014-05-11 14:52 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-01-01 00:24 - 2014-01-01 00:24 - 00427008 _____ () C:\ProgramData\Isaavveur\LR6.dll
2014-02-28 21:24 - 2014-02-28 21:24 - 00425984 _____ () C:\ProgramData\NetoCouPoon\G_76xS4V.dll
2014-01-01 00:24 - 2014-01-01 00:24 - 00424448 _____ () C:\ProgramData\IsuaveR\OQP8.dll
2014-01-30 23:17 - 2014-01-30 23:17 - 00425984 _____ () C:\ProgramData\TuobeIttAodBlockFar\ebsac_.dll
2013-10-07 21:21 - 2013-10-07 21:21 - 01777664 _____ () C:\Program Files\Google\Google Earth\client\QtCore4.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 01224192 _____ () C:\Program Files\Google\Google Earth\client\IGCore.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 00290816 _____ () C:\Program Files\Google\Google Earth\client\IGUtils.DLL
2013-10-07 21:24 - 2013-10-07 21:24 - 00631808 _____ () C:\Program Files\Google\Google Earth\client\IGMath.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 01393664 _____ () C:\Program Files\Google\Google Earth\client\alchemy\ogles20\IGSg.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 00751104 _____ () C:\Program Files\Google\Google Earth\client\alchemy\ogles20\IGAttrs.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 03105280 _____ () C:\Program Files\Google\Google Earth\client\alchemy\ogles20\IGGfx.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 00059392 _____ () C:\Program Files\Google\Google Earth\client\alchemy\ogles20\libEGL.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 00519168 _____ () C:\Program Files\Google\Google Earth\client\alchemy\ogles20\libGLESv2.dll
2013-10-07 21:52 - 2013-10-07 21:52 - 17652224 _____ () C:\Program Files\Google\Google Earth\client\googleearth_free.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 00726016 _____ () C:\Program Files\Google\Google Earth\client\IGExportCommon.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 01050624 _____ () C:\Program Files\Google\Google Earth\client\IGOpt.dll
2013-10-07 21:32 - 2013-10-07 21:32 - 00015872 _____ () C:\Program Files\Google\Google Earth\client\alchemyext.dll
2013-10-07 21:21 - 2013-10-07 21:21 - 07877632 _____ () C:\Program Files\Google\Google Earth\client\QtWebKit4.dll
2013-10-07 21:21 - 2013-10-07 21:21 - 06174208 _____ () C:\Program Files\Google\Google Earth\client\QtGui4.dll
2013-10-07 21:21 - 2013-10-07 21:21 - 00518656 _____ () C:\Program Files\Google\Google Earth\client\QtNetwork4.dll
2013-10-07 21:28 - 2013-10-07 21:28 - 00086528 _____ () C:\Program Files\Google\Google Earth\client\ge_expat.dll
2013-10-07 21:21 - 2013-10-07 21:21 - 00018944 _____ () C:\Program Files\Google\Google Earth\client\imageformats\qgif4.dll
2013-10-07 21:21 - 2013-10-07 21:21 - 00158208 _____ () C:\Program Files\Google\Google Earth\client\imageformats\qjpeg4.dll
2013-10-07 21:24 - 2013-10-07 21:24 - 00145408 _____ () C:\Program Files\Google\Google Earth\client\alchemy\optimizations\IGOptExtension.dll
2013-10-01 12:08 - 2012-12-07 17:26 - 00167424 _____ () C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: NeroFilterCheck => C:\Windows\system32\NeroCheck.exe
MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
MSCONFIG\startupreg: openvpn-gui => C:\Program Files\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe
MSCONFIG\startupreg: svchospt => C:\Windows\system32\svchospt.exe

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/29/2014 08:57:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 25.5.2014.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 12ec

Startzeit: 01cf7b6fb0f8afcd

Endzeit: 8

Anwendungspfad: C:\Users\Carmen\Desktop\FRST.exe

Berichts-ID:

Error: (05/29/2014 08:57:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 25.5.2014.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 17cc

Startzeit: 01cf7b6f0e5fd6c1

Endzeit: 5

Anwendungspfad: C:\Users\Carmen\Desktop\FRST.exe

Berichts-ID:

Error: (05/29/2014 03:56:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: javaw.exe, Version: 7.0.210.11, Zeitstempel: 0x515d68ec
Name des fehlerhaften Moduls: msvcr100.dll, Version: 10.0.30319.1, Zeitstempel: 0x4ba1dbbe
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00014f47
ID des fehlerhaften Prozesses: 0x17c
Startzeit der fehlerhaften Anwendung: 0xjavaw.exe0
Pfad der fehlerhaften Anwendung: javaw.exe1
Pfad des fehlerhaften Moduls: javaw.exe2
Berichtskennung: javaw.exe3

Error: (05/28/2014 09:53:06 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (05/28/2014 09:50:13 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (05/28/2014 08:29:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 12.0.6691.5000, Zeitstempel: 0x52e8c57c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0x1150
Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0
Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1
Pfad des fehlerhaften Moduls: OUTLOOK.EXE2
Berichtskennung: OUTLOOK.EXE3

Error: (05/27/2014 02:06:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm OUTLOOK.EXE, Version 12.0.6691.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 13d8

Startzeit: 01cf79a0b11e73ca

Endzeit: 15

Anwendungspfad: C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

Berichts-ID: 3eda6baa-e597-11e3-b875-6c626d50f8f0

Error: (05/27/2014 08:54:15 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (05/27/2014 08:53:13 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (05/27/2014 08:50:08 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (05/29/2014 08:58:50 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 08:28:44 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 08:28:30 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 08:28:09 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 08:18:29 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 07:51:29 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 07:21:29 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 07:05:54 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 07:05:38 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.

Error: (05/29/2014 07:05:28 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT)
Description: Fehler beim Lesen der Datei für lokale Hosts.


Microsoft Office Sessions:
=========================
Error: (05/28/2014 08:29:34 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/27/2014 01:42:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (04/27/2014 02:43:27 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (04/20/2014 10:01:43 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 590 seconds with 540 seconds of active time.  This session ended with a crash.

Error: (03/16/2014 09:03:56 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1800 seconds with 240 seconds of active time.  This session ended with a crash.

Error: (01/08/2014 01:35:53 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 414 seconds with 300 seconds of active time.  This session ended with a crash.

Error: (09/15/2013 11:54:04 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6679.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 20046 seconds with 5760 seconds of active time.  This session ended with a crash.

Error: (09/09/2013 02:46:09 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9581 seconds with 6060 seconds of active time.  This session ended with a crash.

Error: (09/03/2013 03:18:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 14573 seconds with 780 seconds of active time.  This session ended with a crash.

Error: (09/02/2013 11:08:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 193 seconds with 120 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 81%
Total physical RAM: 1911.11 MB
Available physical RAM: 347.87 MB
Total Pagefile: 3822.23 MB
Available Pagefile: 1335.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1923.29 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:291.57 GB) (Free:124.54 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:4.51 GB) (Free:0.59 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Backup Intern) (Fixed) (Total:232.88 GB) (Free:59.55 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive l: (Wechseldatenträger) (Removable) (Total:7.46 GB) (Free:6.73 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: D832B9BF)
Partition 1: (Active) - (Size=2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=292 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: E80FDE1F)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 7 (MBR Code: Windows 7 or Vista) (Size: 7 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

--- --- ---

cosinus · 29.05.2014, 20:16

Zitat:

Platform: Microsoft Windows 7 Professional
Microsoft Office Enterprise 2007

Ist das ein gewerblich gentuztes System? Gerade das Enterprise Office ist nicht gerade für Home-User bestimmt.

Dawn007 · 29.05.2014, 20:21

nein, ist nicht gewerblich genutzt

cosinus · 29.05.2014, 20:25

Dann bitte erklären was ein Enterprise Office auf einem reinen Heim-PC macht. Enterprise-Editionen gibt es nur für große Einrichtungen oder Firmen, die rel. teure Volumenlizenzverträge mit MS haben.

Dawn007 · 29.05.2014, 20:34

Ich kann dir das leider nicht sagen, weil ich das nicht installiert habe, sondern ein Freund von mir. Ich nutze aber den Computer und noch zwei Laptops. Die Nutzung ist nicht gewerblich, aber wir vermieten Apartments und daher sind auch mehrer Pc's in Anwendung. Mehr weiß ich leider auch nicht.

Ich hoffe, ich habe jetzt keine Probleme.

cosinus · 29.05.2014, 23:15

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Dawn007 · 30.05.2014, 10:51

Combofix Logfile:

Code:

ATTFilter

ComboFix 14-05-29.01 - Carmen 30.05.2014  10:18:03.1.4 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.43.1031.18.1911.871 [GMT 2:00]
ausgeführt von:: c:\users\Carmen\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\AcRemoteUpdate.exe
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\TaskScheduler.dll
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd\4.6\background.html
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd\4.6\content.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd\4.6\lsdb.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd\4.6\manifest.json
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjibbcoeojaocojpdkkemgjodhbkdihd\4.6\v3eBs.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm\1\51ab80214ec6d1.98158322.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm\1\background.html
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm\1\content.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm\1\lsdb.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmbdnkeponnohdgdhpdkfkojfenmgakm\1\sqlite.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\1370194000.png
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\51ab8050737df5.32222238.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\background.html
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\content.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\lsdb.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\popup.html
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjhglojboafhldcdidcghhmbecmbgbga\1\sqlite.js
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\000005.ldb
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\000006.log
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\CURRENT
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\LOCK
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\LOG
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\LOG.old
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmbdnkeponnohdgdhpdkfkojfenmgakm\MANIFEST-000004
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\000005.ldb
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\000006.log
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\CURRENT
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\LOCK
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\LOG
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\LOG.old
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjhglojboafhldcdidcghhmbecmbgbga\MANIFEST-000004
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_hmbdnkeponnohdgdhpdkfkojfenmgakm_0.localstorage-journal
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_hmbdnkeponnohdgdhpdkfkojfenmgakm_0.localstorage
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kjhglojboafhldcdidcghhmbecmbgbga_0.localstorage-journal
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kjhglojboafhldcdidcghhmbecmbgbga_0.localstorage
c:\users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Carmen\AppData\Roaming\Microsoft\yvhboot.exe
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\aiv.ou@xqdoyu-.org
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\aiv.ou@xqdoyu-.org\bootstrap.js
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\aiv.ou@xqdoyu-.org\chrome.manifest
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\aiv.ou@xqdoyu-.org\content\bg.js
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\aiv.ou@xqdoyu-.org\install.rdf
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\c.ye@rtgr-jir.net
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\c.ye@rtgr-jir.net\bootstrap.js
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\c.ye@rtgr-jir.net\chrome.manifest
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\c.ye@rtgr-jir.net\content\bg.js
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\c.ye@rtgr-jir.net\install.rdf
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\qcvgssmbr@aooqrztag.net
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\qcvgssmbr@aooqrztag.net\bootstrap.js
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\qcvgssmbr@aooqrztag.net\chrome.manifest
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\qcvgssmbr@aooqrztag.net\content\bg.js
c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\extensions\qcvgssmbr@aooqrztag.net\install.rdf
c:\windows\system32\~GLH00e7.TMP
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-04-28 bis 2014-05-30  ))))))))))))))))))))))))))))))
.
.
2014-05-30 08:35 . 2014-05-30 08:35	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-05-30 08:11 . 2014-05-30 08:11	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EA4BDB47-F572-4B62-8170-2CEFA50C8A1B}\offreg.dll
2014-05-30 08:04 . 2014-04-30 23:37	8073384	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EA4BDB47-F572-4B62-8170-2CEFA50C8A1B}\mpengine.dll
2014-05-29 18:53 . 2014-05-29 19:00	--------	d-----w-	C:\FRST
2014-05-29 18:23 . 2014-05-29 18:23	--------	d-sh--w-	c:\users\Carmen\AppData\Local\EmieUserList
2014-05-29 18:23 . 2014-05-29 18:23	--------	d-sh--w-	c:\users\Carmen\AppData\Local\EmieSiteList
2014-05-29 12:18 . 2014-05-30 08:05	--------	d-----w-	c:\users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-14 17:34 . 2014-05-06 03:07	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-05-08 11:21 . 2014-05-08 11:21	188272	----a-w-	c:\program files\Internet Explorer\Plugins\nppdf32.dll
2014-05-06 23:09 . 2014-05-15 04:49	--------	d-s---w-	c:\windows\system32\CompatTel
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-14 16:12 . 2012-12-10 18:33	692400	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-05-14 16:12 . 2011-06-24 14:17	70832	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-31 20:46 . 2014-03-31 20:46	130712	----a-w-	c:\windows\system32\MSSTDFMT.DLL
2014-03-31 20:46 . 2014-03-31 20:46	1070232	----a-w-	c:\windows\system32\MSCOMCTL.OCX
2014-03-31 07:35 . 2010-10-14 18:16	231584	------w-	c:\windows\system32\MpSigStub.exe
2014-03-06 08:31 . 2014-04-22 21:30	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:02 . 2014-04-22 21:30	61952	----a-w-	c:\windows\system32\iesetup.dll
2014-03-06 08:02 . 2014-04-22 21:30	455168	----a-w-	c:\windows\system32\vbscript.dll
2014-03-06 08:01 . 2014-04-22 21:30	51200	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-03-06 07:46 . 2014-04-22 21:30	4254720	----a-w-	c:\windows\system32\jscript9.dll
2014-03-06 07:38 . 2014-04-22 21:30	112128	----a-w-	c:\windows\system32\ieUnatt.exe
2014-03-06 07:38 . 2014-04-22 21:30	108032	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-03-06 07:36 . 2014-04-22 21:30	592896	----a-w-	c:\windows\system32\jscript9diag.dll
2014-03-06 07:28 . 2014-04-22 21:30	646144	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 07:13 . 2014-04-22 21:30	32256	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 06:40 . 2014-04-22 21:30	1967104	----a-w-	c:\windows\system32\inetcpl.cpl
2014-03-06 05:41 . 2014-04-22 21:30	1789440	----a-w-	c:\windows\system32\wininet.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{012F9CB5-DE63-5FED-E274-A242A02DDF77}]
2013-12-31 22:24	427008	----a-w-	c:\programdata\Isaavveur\LR6.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{A5EBBE4A-BF8B-6AA9-AFB1-945D12A01B17}]
2014-02-28 19:24	425984	----a-w-	c:\programdata\NetoCouPoon\G_76xS4V.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{AAA00FFE-A528-48A2-0836-ADCF1449254D}]
2013-12-31 22:24	424448	----a-w-	c:\programdata\IsuaveR\OQP8.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{D06346B9-1B63-DD92-C021-06375480FEDA}]
2014-01-30 21:17	425984	----a-w-	c:\programdata\TuobeIttAodBlockFar\ebsac_.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmazonMP3DownloaderHelper"="c:\users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe" [2013-05-22 400704]
"Amazon Cloud Player"="c:\users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" [2013-12-12 3145536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-07 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-07 175128]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-07 166936]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-06-18 563736]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2010-05-06 11268096]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-05-11 200069]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_MX_Download-Version\TrayServer_de.exe" [2008-08-07 90112]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-10-17 684024]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-05-27 21720]
.
c:\users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-1-18 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2010-04-28 08:39	75320	----a-w-	c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 17:36	30040	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50	155648	----a-w-	c:\windows\System32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NortonOnlineBackupReminder]
2009-06-29 12:01	600936	----a-w-	c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchospt]
2010-06-19 07:13	995328	---ha-w-	c:\windows\System32\svchospt.exe
.
R2 f3dadae8;Surf Protect;c:\windows\system32\rundll32.exe [2009-07-14 44544]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R2 Update ResultsAlpha;Update ResultsAlpha;c:\program files\ResultsAlpha\updateResultsAlpha.exe [x]
R3 .neoli;.neoli; [x]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock.sys [2012-10-17 87976]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv.sys [2010-03-08 32312]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]
R3 FLCDLOCK;HP ProtectTools Gerätesperre/Überwachung;c:\windows\system32\flcdlock.exe [2010-04-28 362040]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-11-28 13224]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-10-26 25088]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2012-12-07 23040]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-12 125056]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [2011-10-05 564800]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-17 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1309010.00E\SYMDS.SYS [2011-05-16 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1309010.00E\SYMEFA.SYS [2012-05-22 924320]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [2013-05-31 1002072]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [2012-06-07 132768]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130705.001\IDSvix86.sys [2012-09-01 386720]
S1 RsvLock;RsvLock; [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [2012-04-18 149624]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [2012-04-18 318584]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]
S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2010-03-16 36864]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2010-02-01 281192]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2010-05-06 298496]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [2012-06-16 138272]
S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [2012-12-07 167424]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-06-18 635416]
S2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2014-02-17 4915040]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-10-17 544248]
S3 BCMH43XX;Treiber für Broadcom 802.11-USB-Netzwerkadapter;c:\windows\system32\DRIVERS\bcmwlhigh6.sys [2011-12-12 1093888]
S3 CLEDX;Team H2O CLEDX service;c:\windows\system32\DRIVERS\cledx.sys [2005-05-09 33792]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-04-02 106656]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-03-04 277536]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 15:57	1210320	----a-w-	c:\program files\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-10 16:12]
.
2014-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-21 20:28]
.
2014-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-21 20:28]
.
2014-05-30 c:\windows\Tasks\HPCeeScheduleForCarmen.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 02:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.gboxapp.com/
mStart Page = hxxp://search.gboxapp.com/
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: raiffeisen.at\banking
Trusted Zone: raiffeisen.at\mein
Trusted Zone: raiffeisen.at\portal
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de?hl=de&gl=de
FF - prefs.js: keyword.URL - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: browser.search.defaultenginename - Google
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.startup.homepage - hxxp://www.google.de?hl=de&gl=de
FF - user.js: browser.search.defaulturl - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: keyword.URL - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: browser.urlbar.autoFill - false//;
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{422f7661-9403-4da4-b4ef-cc3e268817b5} - c:\program files\RadioTotal1\prxtbRadi.dll
BHO-{422f7661-9403-4da4-b4ef-cc3e268817b5} - c:\program files\RadioTotal1\prxtbRadi.dll
Toolbar-{422f7661-9403-4da4-b4ef-cc3e268817b5} - c:\program files\RadioTotal1\prxtbRadi.dll
WebBrowser-{422F7661-9403-4DA4-B4EF-CC3E268817B5} - c:\program files\RadioTotal1\prxtbRadi.dll
HKCU-Run-yvhboot.exe - c:\users\Carmen\AppData\Roaming\Microsoft\yvhboot.exe
MSConfigStartUp-openvpn-gui - c:\program files\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe
AddRemove-AutocompletePro2_is1 - c:\program files\AutocompletePro\unins000.exe
AddRemove-{495A8A3C-8FD0-4C46-9979-95C26181A1AB} - c:\program files\InstallShield Installation Information\{495A8A3C-8FD0-4C46-9979-95C26181A1AB}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(684)
c:\windows\system32\DPFPApi.DLL
.
Zeit der Fertigstellung: 2014-05-30  10:39:51
ComboFix-quarantined-files.txt  2014-05-30 08:39
.
Vor Suchlauf: 9 Verzeichnis(se), 153.074.200.576 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 155.269.361.664 Bytes frei
.
- - End Of File - - 6D8634D39C37CC24D9BE6D515A2D01D6

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

cosinus · 30.05.2014, 13:00

Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
Code:
ATTFilter
Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{012F9CB5-DE63-5FED-E274-A242A02DDF77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{A5EBBE4A-BF8B-6AA9-AFB1-945D12A01B17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{AAA00FFE-A528-48A2-0836-ADCF1449254D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{D06346B9-1B63-DD92-C021-06375480FEDA}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchospt]

File::
c:\windows\System32\svchospt.exe

Folder::
c:\programdata\Isaavveur
c:\programdata\NetoCouPoon
c:\programdata\IsuaveR
c:\programdata\TuobeIttAodBlockFar

Driver::
f3dadae8
Surf Protect
.neoli
         
Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.
Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Dawn007 · 30.05.2014, 14:10

Code:

ATTFilter

ComboFix 14-05-29.01 - Carmen 30.05.2014  14:51:32.3.4 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.43.1031.18.1911.955 [GMT 2:00]
ausgeführt von:: c:\users\Carmen\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Carmen\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\System32\svchospt.exe"
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Isaavveur
c:\programdata\Isaavveur\LR6.dat
c:\programdata\Isaavveur\LR6.dll
c:\programdata\Isaavveur\LR6.exe
c:\programdata\Isaavveur\LR6.tlb
c:\programdata\IsuaveR
c:\programdata\IsuaveR\OQP8.dat
c:\programdata\IsuaveR\OQP8.dll
c:\programdata\IsuaveR\OQP8.exe
c:\programdata\IsuaveR\OQP8.tlb
c:\programdata\NetoCouPoon
c:\programdata\NetoCouPoon\G_76xS4V.dat
c:\programdata\NetoCouPoon\G_76xS4V.dll
c:\programdata\NetoCouPoon\G_76xS4V.exe
c:\programdata\NetoCouPoon\G_76xS4V.tlb
c:\programdata\TuobeIttAodBlockFar
c:\programdata\TuobeIttAodBlockFar\ebsac_.dat
c:\programdata\TuobeIttAodBlockFar\ebsac_.dll
c:\programdata\TuobeIttAodBlockFar\ebsac_.exe
c:\programdata\TuobeIttAodBlockFar\ebsac_.tlb
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_.neoli
-------\Service_f3dadae8
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-04-28 bis 2014-05-30  ))))))))))))))))))))))))))))))
.
.
2014-05-30 12:59 . 2014-05-30 12:59	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-05-30 12:34 . 2014-05-30 12:34	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EA4BDB47-F572-4B62-8170-2CEFA50C8A1B}\offreg.dll
2014-05-30 08:04 . 2014-04-30 23:37	8073384	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EA4BDB47-F572-4B62-8170-2CEFA50C8A1B}\mpengine.dll
2014-05-29 18:53 . 2014-05-29 19:00	--------	d-----w-	C:\FRST
2014-05-29 18:23 . 2014-05-29 18:23	--------	d-sh--w-	c:\users\Carmen\AppData\Local\EmieUserList
2014-05-29 18:23 . 2014-05-29 18:23	--------	d-sh--w-	c:\users\Carmen\AppData\Local\EmieSiteList
2014-05-29 12:18 . 2014-05-30 08:05	--------	d-----w-	c:\users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-14 17:34 . 2014-05-06 03:07	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-05-08 11:21 . 2014-05-08 11:21	188272	----a-w-	c:\program files\Internet Explorer\Plugins\nppdf32.dll
2014-05-06 23:09 . 2014-05-15 04:49	--------	d-s---w-	c:\windows\system32\CompatTel
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-14 16:12 . 2012-12-10 18:33	692400	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-05-14 16:12 . 2011-06-24 14:17	70832	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-31 20:46 . 2014-03-31 20:46	130712	----a-w-	c:\windows\system32\MSSTDFMT.DLL
2014-03-31 20:46 . 2014-03-31 20:46	1070232	----a-w-	c:\windows\system32\MSCOMCTL.OCX
2014-03-31 07:35 . 2010-10-14 18:16	231584	------w-	c:\windows\system32\MpSigStub.exe
2014-03-06 08:31 . 2014-04-22 21:30	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:02 . 2014-04-22 21:30	61952	----a-w-	c:\windows\system32\iesetup.dll
2014-03-06 08:02 . 2014-04-22 21:30	455168	----a-w-	c:\windows\system32\vbscript.dll
2014-03-06 08:01 . 2014-04-22 21:30	51200	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-03-06 07:46 . 2014-04-22 21:30	4254720	----a-w-	c:\windows\system32\jscript9.dll
2014-03-06 07:38 . 2014-04-22 21:30	112128	----a-w-	c:\windows\system32\ieUnatt.exe
2014-03-06 07:38 . 2014-04-22 21:30	108032	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-03-06 07:36 . 2014-04-22 21:30	592896	----a-w-	c:\windows\system32\jscript9diag.dll
2014-03-06 07:28 . 2014-04-22 21:30	646144	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 07:13 . 2014-04-22 21:30	32256	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 06:40 . 2014-04-22 21:30	1967104	----a-w-	c:\windows\system32\inetcpl.cpl
2014-03-06 05:41 . 2014-04-22 21:30	1789440	----a-w-	c:\windows\system32\wininet.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmazonMP3DownloaderHelper"="c:\users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe" [2013-05-22 400704]
"Amazon Cloud Player"="c:\users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" [2013-12-12 3145536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-07 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-07 175128]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-07 166936]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-06-18 563736]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2010-05-06 11268096]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-05-11 200069]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_MX_Download-Version\TrayServer_de.exe" [2008-08-07 90112]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-10-17 684024]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-05-27 21720]
.
c:\users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-1-18 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2010-04-28 08:39	75320	----a-w-	c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 17:36	30040	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50	155648	----a-w-	c:\windows\System32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NortonOnlineBackupReminder]
2009-06-29 12:01	600936	----a-w-	c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R2 Update ResultsAlpha;Update ResultsAlpha;c:\program files\ResultsAlpha\updateResultsAlpha.exe [x]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock.sys [2012-10-17 87976]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv.sys [2010-03-08 32312]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]
R3 FLCDLOCK;HP ProtectTools Gerätesperre/Überwachung;c:\windows\system32\flcdlock.exe [2010-04-28 362040]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-11-28 13224]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-10-26 25088]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2012-12-07 23040]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-12 125056]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [2011-10-05 564800]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-17 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1309010.00E\SYMDS.SYS [2011-05-16 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1309010.00E\SYMEFA.SYS [2012-05-22 924320]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [2013-05-31 1002072]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [2012-06-07 132768]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130705.001\IDSvix86.sys [2012-09-01 386720]
S1 RsvLock;RsvLock; [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [2012-04-18 149624]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [2012-04-18 318584]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]
S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2010-03-16 36864]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2010-02-01 281192]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2010-05-06 298496]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [2012-06-16 138272]
S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [2012-12-07 167424]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-06-18 635416]
S2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2014-02-17 4915040]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-10-17 544248]
S3 BCMH43XX;Treiber für Broadcom 802.11-USB-Netzwerkadapter;c:\windows\system32\DRIVERS\bcmwlhigh6.sys [2011-12-12 1093888]
S3 CLEDX;Team H2O CLEDX service;c:\windows\system32\DRIVERS\cledx.sys [2005-05-09 33792]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-04-02 106656]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-03-04 277536]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 15:57	1210320	----a-w-	c:\program files\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-10 16:12]
.
2014-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-21 20:28]
.
2014-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-21 20:28]
.
2014-05-30 c:\windows\Tasks\HPCeeScheduleForCarmen.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 02:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.gboxapp.com/
mStart Page = hxxp://search.gboxapp.com/
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: raiffeisen.at\banking
Trusted Zone: raiffeisen.at\mein
Trusted Zone: raiffeisen.at\portal
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de?hl=de&gl=de
FF - prefs.js: keyword.URL - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: browser.search.defaultenginename - Google
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.startup.homepage - hxxp://www.google.de?hl=de&gl=de
FF - user.js: browser.search.defaulturl - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: keyword.URL - hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF - user.js: browser.urlbar.autoFill - false//;
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-{317D8BB4-16C3-CFBD-3777-AED69667DA46} - c:\programdata\NetoCouPoon\G_76xS4V.exe
AddRemove-{94EEB800-E533-7AE1-5C31-0446E1C0537C} - c:\programdata\TuobeIttAodBlockFar\ebsac_.exe
AddRemove-{F1422DAA-0829-09A1-7536-73936CAB8FFA} - c:\programdata\IsuaveR\OQP8.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(668)
c:\windows\system32\DPFPApi.DLL
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-05-30  15:05:46 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-05-30 13:05
ComboFix2.txt  2014-05-30 12:45
.
Vor Suchlauf: 15 Verzeichnis(se), 155.853.074.432 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 155.581.796.352 Bytes frei
.
- - End Of File - - 84B0B614047E17FC754EEC6D148C879F
A36C5E4F47E84449FF07ED3517B43A31

cosinus · 30.05.2014, 22:07

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Dawn007 · 30.05.2014, 22:49

Code:

ATTFilter

# AdwCleaner v3.211 - Bericht erstellt am 30/05/2014 um 23:28:55
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Carmen - PC
# Gestartet von : C:\Users\Carmen\Desktop\adwcleaner_3.211.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : Update ResultsAlpha

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\StarApp
Ordner Gelöscht : C:\ProgramData\conTinueytossave
Ordner Gelöscht : C:\ProgramData\EboookBryowsie
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\conTinueytossave
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EboookBryowsie
Ordner Gelöscht : C:\Program Files\continuetosave
Ordner Gelöscht : C:\Program Files\Mein Gutscheincode Finder
Ordner Gelöscht : C:\Program Files\Optimizer Pro
Ordner Gelöscht : C:\Users\Carmen\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\Carmen\AppData\LocalLow\conTinueytossave
Ordner Gelöscht : C:\Users\Carmen\AppData\LocalLow\EboookBryowsie
Ordner Gelöscht : C:\Users\Carmen\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\system32\conduitEngine.tmp
Datei Gelöscht : C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk
Datei Gelöscht : C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\softonic.xml
Datei Gelöscht : C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [support@predictad.com]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\AutocompletePro.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\InstTracker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\InstTracker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{f3dadae8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3317892
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_music-editor-free[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_music-editor-free[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_undelete-360_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_undelete-360_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{442F13BC-2031-42D5-9520-437F65271153}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E93D3737-088D-C8C4-0AB4-959226420493}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F1AE2BA0-FBE1-A4F0-F40C-9CC8F719839C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ED8F1591-D34F-4B4A-B8BE-7FC3B55536D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{01BCB858-2F62-4F06-A8F4-48F927C15333}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E93D3737-088D-C8C4-0AB4-959226420493}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F1AE2BA0-FBE1-A4F0-F40C-9CC8F719839C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E93D3737-088D-C8C4-0AB4-959226420493}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F1AE2BA0-FBE1-A4F0-F40C-9CC8F719839C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ED8F1591-D34F-4B4A-B8BE-7FC3B55536D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9B7D113D-5D2D-4C1E-B759-D31DDC60DCD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78B34535-7229-4233-96BA-8841686A21C7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{422F7661-9403-4DA4-B4EF-CC3E268817B5}]
Schlüssel Gelöscht : HKCU\Software\AutocompleteProBHO
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\ResultsAlpha
Schlüssel Gelöscht : HKCU\Software\SearchProtect
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\ResultsAlpha
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\RadioTotal1
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\prefs.js ]

Zeile gelöscht : user_pref("CT3317892.FF19Solved", "true");
Zeile gelöscht : user_pref("CT3317892.UserID", "UN41368141562806617");
Zeile gelöscht : user_pref("CT3317892.browser.search.defaultthis.engineName", "true");
Zeile gelöscht : user_pref("CT3317892.fullUserID", "UN41368141562806617.IN.20140106184152");
Zeile gelöscht : user_pref("CT3317892.installDate", "06/01/2014 18:41:54");
Zeile gelöscht : user_pref("CT3317892.installSessionId", "{230AFD84-75D6-4B86-A97B-88D6FBB0890C}");
Zeile gelöscht : user_pref("CT3317892.installSp", "TRUE");
Zeile gelöscht : user_pref("CT3317892.installerVersion", "1.8.1.4");
Zeile gelöscht : user_pref("CT3317892.keyword", "true");
Zeile gelöscht : user_pref("CT3317892.originalHomepage", "hxxp://www.google.at/");
Zeile gelöscht : user_pref("CT3317892.originalSearchAddressUrl", "");
Zeile gelöscht : user_pref("CT3317892.originalSearchEngine", "SuchMaschine");
Zeile gelöscht : user_pref("CT3317892.originalSearchEngineName", "SuchMaschine");
Zeile gelöscht : user_pref("CT3317892.searchRevert", "true");
Zeile gelöscht : user_pref("CT3317892.searchUninstallUserMode", "2");
Zeile gelöscht : user_pref("CT3317892.searchUserMode", "2");
Zeile gelöscht : user_pref("CT3317892.smartbar.homepage", "true");
Zeile gelöscht : user_pref("CT3317892.toolbarInstallDate", "06-01-2014 18:41:53");
Zeile gelöscht : user_pref("CT3317892.versionFromInstaller", "10.23.0.722");
Zeile gelöscht : user_pref("CT3317892.xpeMode", "0");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource=61&CUI=UN41368141562806617&UM=2&UP=SP3BC33587-E320-4AB6-8276-94C8632FDE29");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gelöscht : user_pref("aol_toolbar.default.homepage.check", false);
Zeile gelöscht : user_pref("aol_toolbar.default.search.check", false);
Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "RadioTotal1 Customized Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine,S", "WebSearch");
Zeile gelöscht : user_pref("extensions.51ab80214edb6.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.location.hostname)>-1) return;}c[...]
Zeile gelöscht : user_pref("extensions.51ab80507393c.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self.location.hostname.indexOf('mail.')==-1)\r\n{try{for(i=0;i<5[...]
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gelöscht : user_pref("extensions.LrFxU6.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.match(/ressbar[...]
Zeile gelöscht : user_pref("extensions.NF1If.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.match(/ressbar.[...]
Zeile gelöscht : user_pref("extensions.Softonic.admin", false);
Zeile gelöscht : user_pref("extensions.Softonic.aflt", "OC");
Zeile gelöscht : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Zeile gelöscht : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.Softonic.dfltSrch", true);
Zeile gelöscht : user_pref("extensions.Softonic.dnsErr", true);
Zeile gelöscht : user_pref("extensions.Softonic.excTlbr", false);
Zeile gelöscht : user_pref("extensions.Softonic.ffxUnstlRst", false);
Zeile gelöscht : user_pref("extensions.Softonic.hmpg", true);
Zeile gelöscht : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=58a98c6f000000000000100d7f322c2f");
Zeile gelöscht : user_pref("extensions.Softonic.id", "58a98c6f000000000000100d7f322c2f");
Zeile gelöscht : user_pref("extensions.Softonic.instlDay", "16063");
Zeile gelöscht : user_pref("extensions.Softonic.instlRef", "MOY00621");
Zeile gelöscht : user_pref("extensions.Softonic.newTab", true);
Zeile gelöscht : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=58a98c6f000000000000100d7f322c2f");
Zeile gelöscht : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gelöscht : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gelöscht : user_pref("extensions.Softonic.rvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=58a98c6f000000000000100d7f322c2f&q=");
Zeile gelöscht : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Zeile gelöscht : user_pref("extensions.Softonic.vrsnTs", "1.8.21.1414:15:09");
Zeile gelöscht : user_pref("extensions.Softonic.vrsni", "1.8.21.14");
Zeile gelöscht : user_pref("extensions.UMWY3eUgVc.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\"sumorobo\")>-1||url.[...]
Zeile gelöscht : user_pref("extensions.dqcCFB1Q.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\"sumorobo\")>-1||url.in[...]
Zeile gelöscht : user_pref("extensions.y4YBLh.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumorobo.net\")>-1||url.index[...]
Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3317892");
Zeile gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3317892&CUI=UN41368141562806617&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource[...]
Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317892&SearchSource=2&CUI=UN41368141562806617&UM=2&q=");
Zeile gelöscht : user_pref("smartbar.defaultSearchOwnerCTID", "CT3317892");
Zeile gelöscht : user_pref("smartbar.homePageOwnerCTID", "CT3317892");
Zeile gelöscht : user_pref("smartbar.machineId", "2CASJBTHWR1CF8BDKPB40S4QNMQBDXV3IE/ECBSUXMJPS15SBEDACYUXILZYG5BE+GGWNHNEMIEWF6MSAXUHTW");
Zeile gelöscht : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3317892&CUI=UN41368141562806617&UM=2&SearchSource=13");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v31.0.1650.63

*************************

AdwCleaner[R0].txt - [16616 octets] - [30/05/2014 23:26:05]
AdwCleaner[S0].txt - [15999 octets] - [30/05/2014 23:28:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [16060 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x86
Ran by Carmen on 30.05.2014 at 23:39:58,97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8BD24955-F0CB-4C3C-A697-9A157DEB9A07}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AD8FB106-479B-45DF-87AE-AFF364B5017C}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D41A14C8-43E4-4464-9A05-A434CC01A2BA}



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Carmen\appdata\local\{79065086-A415-4DFA-B5CC-704EB8A45519}



~~~ FireFox

Emptied folder: C:\Users\Carmen\AppData\Roaming\mozilla\firefox\profiles\gyigun0z.default\minidumps [288 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.05.2014 at 23:42:41,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-05-2014
Ran by Carmen (administrator) on PC on 30-05-2014 23:46:25
Running from C:\Users\Carmen\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Team H2O) C:\Program Files\Syncrosoft\POS\H2O\cledx.exe
(Pinnacle Systems GmbH) C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
() C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11268096 2010-05-06] (Hewlett-Packard)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1983816 2009-07-27] (CANON INC.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [H2O] => C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [200069 2005-05-11] (Team H2O)
HKLM\...\Run: [USBToolTip] => C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe [199752 2007-02-20] (Pinnacle Systems GmbH)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Video_deluxe_MX_Download-Version\TrayServer_de.exe [90112 2008-08-07] (MAGIX AG)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [684024 2012-10-17] (Cisco Systems, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard)
Winlogon\Notify\DeviceNP: C:\Windows\system32\DeviceNP.dll (Hewlett-Packard Limited)
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [Amazon Cloud Player] => C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2013-12-12] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = hxxp://home.microsoft.com/access/autosearch.asp?p=%s
HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.99 - C:\Program Files\NOS\bin\np_gp.dll No File
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-25]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-05-11]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ []
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-10-01]

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2012-01-18] ()
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300808 2010-04-22] (DigitalPersona, Inc.)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®)
S3 FLCDLOCK; C:\Windows\system32\flcdlock.exe [362040 2010-04-28] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-16] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [298496 2010-05-06] (Hewlett-Packard)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [544248 2012-10-17] (Cisco Systems, Inc.)

==================== Drivers (Whitelisted) ====================

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [87976 2012-10-17] (Cisco Systems, Inc.)
R3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh6.sys [1093888 2011-12-12] (Broadcom Corporation)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation)
R3 CLEDX; C:\Windows\System32\DRIVERS\cledx.sys [33792 2005-05-09] (Team H2O)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2010-03-08] (Hewlett-Packard Development Company L.P.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2013-04-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-04-02] (Symantec Corporation)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130705.001\IDSvix86.sys [386720 2012-09-01] (Symantec Corporation)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVENG.SYS [93272 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVEX15.SYS [1611992 2013-05-22] (Symantec Corporation)
S2 Nsynas32; C:\Windows\system32\Drivers\Nsynas32.sys [17784 2001-04-09] (Syncrosoft Hard- und Software GmbH)
R1 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)
R1 RsvLock; C:\Windows\system32\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\system32\Drivers\SafeBoot.sys [110520 2010-02-01] ()
R0 SbAlg; C:\Windows\system32\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\system32\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309010.00E\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1309010.00E\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation)
S3 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R0 SymDS; C:\Windows\System32\drivers\NIS\1309010.00E\SYMDS.SYS [340088 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1309010.00E\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-03-29] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [149624 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [318584 2012-04-18] (Symantec Corporation)
S3 ASAPIW2K; \??\C:\Windows\system32\Drivers\asapiW2k.sys [X]
S3 catchme; \??\C:\Users\Carmen\AppData\Local\Temp\catchme.sys [X]
S3 grmnusb; system32\drivers\grmnusb.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-30 23:45 - 2014-05-30 23:45 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-30 23:42 - 2014-05-30 23:42 - 00001306 _____ () C:\Users\Carmen\Desktop\JRT.txt
2014-05-30 23:35 - 2014-05-30 23:35 - 01016261 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2014-05-30 23:35 - 2014-05-30 23:35 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 23:26 - 2014-05-30 23:28 - 00000000 ____D () C:\AdwCleaner
2014-05-30 23:26 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-30 23:24 - 2014-05-30 23:25 - 01327971 _____ () C:\Users\Carmen\Desktop\adwcleaner_3.211.exe
2014-05-30 15:05 - 2014-05-30 15:05 - 00017997 _____ () C:\ComboFix.txt
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-05-30 14:27 - 2014-05-30 14:28 - 05203398 ____R (Swearware) C:\Users\Carmen\Desktop\ComboFix.exe
2014-05-30 10:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-30 10:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-30 10:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-30 10:10 - 2014-05-30 15:05 - 00000000 ____D () C:\Qoobox
2014-05-30 10:09 - 2014-05-30 14:59 - 00000000 ____D () C:\Windows\erdnt
2014-05-29 20:58 - 2014-05-30 23:46 - 00019775 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-29 20:58 - 2014-05-29 21:00 - 00042058 _____ () C:\Users\Carmen\Desktop\Addition.txt
2014-05-29 20:53 - 2014-05-30 23:46 - 00000000 ____D () C:\FRST
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 14:18 - 2014-05-30 10:05 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-28 08:29 - 2014-05-29 13:39 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-27 13:57 - 2014-05-27 16:48 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:34 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 19:34 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 19:34 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 16:26 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 16:26 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 16:26 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 16:26 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 16:26 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 16:26 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 16:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-14 16:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-07 01:09 - 2014-05-15 06:49 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-05-30 23:46 - 2014-05-29 20:58 - 00019775 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-30 23:46 - 2014-05-29 20:53 - 00000000 ____D () C:\FRST
2014-05-30 23:46 - 2010-09-14 13:42 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Temp
2014-05-30 23:45 - 2014-05-30 23:45 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-30 23:42 - 2014-05-30 23:42 - 00001306 _____ () C:\Users\Carmen\Desktop\JRT.txt
2014-05-30 23:38 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-30 23:38 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-30 23:36 - 2009-07-25 14:54 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-30 23:35 - 2014-05-30 23:35 - 01016261 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2014-05-30 23:35 - 2014-05-30 23:35 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 23:31 - 2011-05-24 21:51 - 00159638 _____ () C:\Windows\setupact.log
2014-05-30 23:31 - 2010-09-21 22:28 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-30 23:31 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-05-30 23:31 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-30 23:30 - 2010-09-14 12:32 - 00398450 _____ () C:\Windows\PFRO.log
2014-05-30 23:29 - 2010-09-14 12:05 - 01642694 _____ () C:\Windows\WindowsUpdate.log
2014-05-30 23:28 - 2014-05-30 23:26 - 00000000 ____D () C:\AdwCleaner
2014-05-30 23:25 - 2014-05-30 23:24 - 01327971 _____ () C:\Users\Carmen\Desktop\adwcleaner_3.211.exe
2014-05-30 23:11 - 2013-04-07 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-30 22:57 - 2010-09-21 22:28 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-30 16:37 - 2010-09-14 13:45 - 00289792 _____ () C:\Users\Carmen\Desktop\Kalender Wohnungen.xls
2014-05-30 15:05 - 2014-05-30 15:05 - 00017997 _____ () C:\ComboFix.txt
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 10:10 - 00000000 ____D () C:\Qoobox
2014-05-30 15:01 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-05-30 15:00 - 2009-07-14 04:03 - 69468160 _____ () C:\Windows\system32\config\software.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 20447232 _____ () C:\Windows\system32\config\system.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 00524288 _____ () C:\Windows\system32\config\default.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-05-30 14:59 - 2014-05-30 10:09 - 00000000 ____D () C:\Windows\erdnt
2014-05-30 14:28 - 2014-05-30 14:27 - 05203398 ____R (Swearware) C:\Users\Carmen\Desktop\ComboFix.exe
2014-05-30 10:39 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-05-30 10:39 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-05-30 10:10 - 2010-10-12 19:09 - 00000000 ____D () C:\Users\Carmen\AppData\Local\CrashDumps
2014-05-30 10:05 - 2014-05-29 14:18 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-30 09:58 - 2012-11-15 22:47 - 00000324 _____ () C:\Windows\Tasks\HPCeeScheduleForCarmen.job
2014-05-29 21:37 - 2011-04-23 19:45 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2014-05-29 21:00 - 2014-05-29 20:58 - 00042058 _____ () C:\Users\Carmen\Desktop\Addition.txt
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-29 13:39 - 2014-05-28 08:29 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-29 13:14 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\PDFC
2014-05-28 09:13 - 2012-06-17 20:37 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Windows Live
2014-05-28 08:53 - 2012-10-15 21:25 - 00000000 ____D () C:\Users\Carmen\05 Pädagogik
2014-05-27 16:48 - 2014-05-27 13:57 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-26 22:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-22 01:14 - 2012-11-03 17:33 - 00000000 ____D () C:\Users\Carmen\Documents\My Digital Editions
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-21 21:41 - 2014-01-01 00:24 - 00000000 ____D () C:\ProgramData\7fa4f63c7c9d599c
2014-05-17 23:18 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-16 18:06 - 2011-06-18 10:09 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-15 07:39 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 06:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 06:49 - 2014-05-07 01:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 06:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-14 19:39 - 2013-08-21 22:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 19:39 - 2010-09-14 12:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:36 - 2010-09-14 22:08 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 18:12 - 2012-12-10 20:33 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-14 18:12 - 2011-06-24 16:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 06:45 - 2012-12-12 13:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 09:06 - 2014-05-14 16:26 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-14 16:26 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-07 19:13 - 2013-12-23 08:27 - 00016063 _____ () C:\Users\Carmen\Desktop\to do.xlsx
2014-05-06 05:25 - 2014-05-14 19:34 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-14 19:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-14 19:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

Files to move or delete:
====================
C:\Users\Carmen\SyncToy_84f5b4d1-9b77-4dbf-ba50-954d00c42e2d.dat
C:\Users\Carmen\SyncToy_87bd734d-5699-4c8a-b49e-4f3a3ea1cf1b.dat
C:\Users\Carmen\SyncToy_9fe00e05-472c-4ad6-9f82-d40b2ad88f87.dat


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-14 16:26] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67

C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-30 11:36

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-05-2014
Ran by Carmen (administrator) on PC on 30-05-2014 23:46:25
Running from C:\Users\Carmen\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Team H2O) C:\Program Files\Syncrosoft\POS\H2O\cledx.exe
(Pinnacle Systems GmbH) C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
() C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11268096 2010-05-06] (Hewlett-Packard)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1983816 2009-07-27] (CANON INC.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [H2O] => C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [200069 2005-05-11] (Team H2O)
HKLM\...\Run: [USBToolTip] => C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe [199752 2007-02-20] (Pinnacle Systems GmbH)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM\...\Run: [TrayServer] => C:\Program Files\MAGIX\Video_deluxe_MX_Download-Version\TrayServer_de.exe [90112 2008-08-07] (MAGIX AG)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [684024 2012-10-17] (Cisco Systems, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard)
Winlogon\Notify\DeviceNP: C:\Windows\system32\DeviceNP.dll (Hewlett-Packard Limited)
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-593068660-145275409-1981540980-1004\...\Run: [Amazon Cloud Player] => C:\Users\Carmen\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2013-12-12] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = hxxp://home.microsoft.com/access/autosearch.asp?p=%s
HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {395D1CC4-6B93-4869-B1F5-72A495F75F81} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.99 - C:\Program Files\NOS\bin\np_gp.dll No File
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Carmen\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\gyigun0z.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-25]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-05-11]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ []
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-10-01]

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2012-01-18] ()
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300808 2010-04-22] (DigitalPersona, Inc.)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®)
S3 FLCDLOCK; C:\Windows\system32\flcdlock.exe [362040 2010-04-28] (Hewlett-Packard Ltd)
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-16] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [298496 2010-05-06] (Hewlett-Packard)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [544248 2012-10-17] (Cisco Systems, Inc.)

==================== Drivers (Whitelisted) ====================

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [87976 2012-10-17] (Cisco Systems, Inc.)
R3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh6.sys [1093888 2011-12-12] (Broadcom Corporation)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation)
R3 CLEDX; C:\Windows\System32\DRIVERS\cledx.sys [33792 2005-05-09] (Team H2O)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2010-03-08] (Hewlett-Packard Development Company L.P.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2013-04-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-04-02] (Symantec Corporation)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130705.001\IDSvix86.sys [386720 2012-09-01] (Symantec Corporation)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVENG.SYS [93272 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130705.023\NAVEX15.SYS [1611992 2013-05-22] (Symantec Corporation)
S2 Nsynas32; C:\Windows\system32\Drivers\Nsynas32.sys [17784 2001-04-09] (Syncrosoft Hard- und Software GmbH)
R1 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)
R1 RsvLock; C:\Windows\system32\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\system32\Drivers\SafeBoot.sys [110520 2010-02-01] ()
R0 SbAlg; C:\Windows\system32\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\system32\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309010.00E\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1309010.00E\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation)
S3 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R0 SymDS; C:\Windows\System32\drivers\NIS\1309010.00E\SYMDS.SYS [340088 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1309010.00E\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-03-29] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-11-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [149624 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [318584 2012-04-18] (Symantec Corporation)
S3 ASAPIW2K; \??\C:\Windows\system32\Drivers\asapiW2k.sys [X]
S3 catchme; \??\C:\Users\Carmen\AppData\Local\Temp\catchme.sys [X]
S3 grmnusb; system32\drivers\grmnusb.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-30 23:45 - 2014-05-30 23:45 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-30 23:42 - 2014-05-30 23:42 - 00001306 _____ () C:\Users\Carmen\Desktop\JRT.txt
2014-05-30 23:35 - 2014-05-30 23:35 - 01016261 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2014-05-30 23:35 - 2014-05-30 23:35 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 23:26 - 2014-05-30 23:28 - 00000000 ____D () C:\AdwCleaner
2014-05-30 23:26 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-30 23:24 - 2014-05-30 23:25 - 01327971 _____ () C:\Users\Carmen\Desktop\adwcleaner_3.211.exe
2014-05-30 15:05 - 2014-05-30 15:05 - 00017997 _____ () C:\ComboFix.txt
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-05-30 14:27 - 2014-05-30 14:28 - 05203398 ____R (Swearware) C:\Users\Carmen\Desktop\ComboFix.exe
2014-05-30 10:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-30 10:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-30 10:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-30 10:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-30 10:10 - 2014-05-30 15:05 - 00000000 ____D () C:\Qoobox
2014-05-30 10:09 - 2014-05-30 14:59 - 00000000 ____D () C:\Windows\erdnt
2014-05-29 20:58 - 2014-05-30 23:46 - 00019775 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-29 20:58 - 2014-05-29 21:00 - 00042058 _____ () C:\Users\Carmen\Desktop\Addition.txt
2014-05-29 20:53 - 2014-05-30 23:46 - 00000000 ____D () C:\FRST
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 14:18 - 2014-05-30 10:05 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-28 08:29 - 2014-05-29 13:39 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-27 13:57 - 2014-05-27 16:48 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:34 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 19:34 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 19:34 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 16:26 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 16:26 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 16:26 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 16:26 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 16:26 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 16:26 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 16:26 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 16:26 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 16:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-14 16:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 16:26 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 16:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-07 01:09 - 2014-05-15 06:49 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-05-30 23:46 - 2014-05-29 20:58 - 00019775 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-05-30 23:46 - 2014-05-29 20:53 - 00000000 ____D () C:\FRST
2014-05-30 23:46 - 2010-09-14 13:42 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Temp
2014-05-30 23:45 - 2014-05-30 23:45 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-30 23:42 - 2014-05-30 23:42 - 00001306 _____ () C:\Users\Carmen\Desktop\JRT.txt
2014-05-30 23:38 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-30 23:38 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-30 23:36 - 2009-07-25 14:54 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-30 23:35 - 2014-05-30 23:35 - 01016261 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2014-05-30 23:35 - 2014-05-30 23:35 - 00000000 ____D () C:\Windows\ERUNT
2014-05-30 23:31 - 2011-05-24 21:51 - 00159638 _____ () C:\Windows\setupact.log
2014-05-30 23:31 - 2010-09-21 22:28 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-30 23:31 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-05-30 23:31 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-30 23:30 - 2010-09-14 12:32 - 00398450 _____ () C:\Windows\PFRO.log
2014-05-30 23:29 - 2010-09-14 12:05 - 01642694 _____ () C:\Windows\WindowsUpdate.log
2014-05-30 23:28 - 2014-05-30 23:26 - 00000000 ____D () C:\AdwCleaner
2014-05-30 23:25 - 2014-05-30 23:24 - 01327971 _____ () C:\Users\Carmen\Desktop\adwcleaner_3.211.exe
2014-05-30 23:11 - 2013-04-07 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-30 22:57 - 2010-09-21 22:28 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-30 16:37 - 2010-09-14 13:45 - 00289792 _____ () C:\Users\Carmen\Desktop\Kalender Wohnungen.xls
2014-05-30 15:05 - 2014-05-30 15:05 - 00017997 _____ () C:\ComboFix.txt
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 15:05 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-05-30 15:05 - 2014-05-30 10:10 - 00000000 ____D () C:\Qoobox
2014-05-30 15:01 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-05-30 15:00 - 2009-07-14 04:03 - 69468160 _____ () C:\Windows\system32\config\software.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 20447232 _____ () C:\Windows\system32\config\system.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 00524288 _____ () C:\Windows\system32\config\default.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-05-30 15:00 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-05-30 14:59 - 2014-05-30 10:09 - 00000000 ____D () C:\Windows\erdnt
2014-05-30 14:28 - 2014-05-30 14:27 - 05203398 ____R (Swearware) C:\Users\Carmen\Desktop\ComboFix.exe
2014-05-30 10:39 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-05-30 10:39 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-05-30 10:10 - 2010-10-12 19:09 - 00000000 ____D () C:\Users\Carmen\AppData\Local\CrashDumps
2014-05-30 10:05 - 2014-05-29 14:18 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Nico Mak Computing
2014-05-30 09:58 - 2012-11-15 22:47 - 00000324 _____ () C:\Windows\Tasks\HPCeeScheduleForCarmen.job
2014-05-29 21:37 - 2011-04-23 19:45 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2014-05-29 21:00 - 2014-05-29 20:58 - 00042058 _____ () C:\Users\Carmen\Desktop\Addition.txt
2014-05-29 20:23 - 2014-05-29 20:23 - 00148695 _____ () C:\Users\Carmen\Desktop\log.xml
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieUserList
2014-05-29 20:23 - 2014-05-29 20:23 - 00000000 __SHD () C:\Users\Carmen\AppData\Local\EmieSiteList
2014-05-29 14:17 - 2014-05-29 14:17 - 04892480 _____ (WinZip International LLC ) C:\Users\Carmen\Desktop\wzmp_8.exe
2014-05-29 13:39 - 2014-05-28 08:29 - 00002412 ____H () C:\Users\Carmen\AppData\Roaming\o2.html
2014-05-29 13:14 - 2010-09-14 12:11 - 00000000 ____D () C:\ProgramData\PDFC
2014-05-28 09:13 - 2012-06-17 20:37 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Windows Live
2014-05-28 08:53 - 2012-10-15 21:25 - 00000000 ____D () C:\Users\Carmen\05 Pädagogik
2014-05-27 16:48 - 2014-05-27 13:57 - 00012872 ____H () C:\Users\Carmen\AppData\Roaming\telekom.html
2014-05-26 22:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-22 01:14 - 2012-11-03 17:33 - 00000000 ____D () C:\Users\Carmen\Documents\My Digital Editions
2014-05-21 23:11 - 2014-05-21 23:11 - 00111893 _____ () C:\Users\Carmen\Desktop\gl3-00-stigma.zip
2014-05-21 23:09 - 2014-05-21 23:09 - 00026857 _____ () C:\Users\Carmen\Desktop\schoenwiese-alltag.zip
2014-05-21 21:41 - 2014-01-01 00:24 - 00000000 ____D () C:\ProgramData\7fa4f63c7c9d599c
2014-05-17 23:18 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-16 18:06 - 2011-06-18 10:09 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-15 07:39 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 06:58 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 06:49 - 2014-05-07 01:09 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 06:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-14 19:39 - 2013-08-21 22:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 19:39 - 2010-09-14 12:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 19:36 - 2014-05-14 19:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 19:36 - 2010-09-14 22:08 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 18:12 - 2012-12-10 20:33 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-14 18:12 - 2011-06-24 16:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 06:45 - 2012-12-12 13:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-11 14:52 - 2014-05-11 14:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 09:06 - 2014-05-14 16:26 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-14 16:26 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-07 19:13 - 2013-12-23 08:27 - 00016063 _____ () C:\Users\Carmen\Desktop\to do.xlsx
2014-05-06 05:25 - 2014-05-14 19:34 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-14 19:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-14 19:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

Files to move or delete:
====================
C:\Users\Carmen\SyncToy_84f5b4d1-9b77-4dbf-ba50-954d00c42e2d.dat
C:\Users\Carmen\SyncToy_87bd734d-5699-4c8a-b49e-4f3a3ea1cf1b.dat
C:\Users\Carmen\SyncToy_9fe00e05-472c-4ad6-9f82-d40b2ad88f87.dat


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-14 16:26] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67

C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-30 11:36

==================== End Of Log ============================

--- --- ---

--- --- ---

cosinus · 30.05.2014, 23:01

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Users\Carmen\SyncToy_84f5b4d1-9b77-4dbf-ba50-954d00c42e2d.dat
C:\Users\Carmen\SyncToy_87bd734d-5699-4c8a-b49e-4f3a3ea1cf1b.dat
C:\Users\Carmen\SyncToy_9fe00e05-472c-4ad6-9f82-d40b2ad88f87.da

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

29.05.2014, 20:25	#7
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Mailzugang gesperrt, weil Viren/Spam Mails verschickt werden Dann bitte erklären was ein Enterprise Office auf einem reinen Heim-PC macht. Enterprise-Editionen gibt es nur für große Einrichtungen oder Firmen, die rel. teure Volumenlizenzverträge mit MS haben. __________________ Logfiles bitte immer in CODE-Tags posten

Mailzugang gesperrt, weil Viren/Spam Mails verschickt werden

Plagegeister aller Art und deren Bekämpfung: Mailzugang gesperrt, weil Viren/Spam Mails verschickt werden