Virus, unerwünschte Werbung, .exe

Carolin.Abär · 31.07.2014, 19:33

Hallo zusammen,

ich habe ein Problem mit meinem Computer. Ich habe versehentlich irgendwo einen Virus mit heruntergeladen, zumindest hat Avira mir sofort einen Virus gemeldet. Seit dem bekomme ich ständig neue Werbung im Internet, wenn ich mich irgendwo verlinken lassen will, komme ich nur auf weitere Werbeseiten, die mir ebenfalls automatisch etwas herunterladen, das ebenfalls von Avria als Virus gekennzeichnet wird. Ich habe zwar einen Ad-Blocker, aber der reagiert auf die Werbungen nicht. Außerdem ist mein PC seit dem sehr viel langsamer. Die Datei, die höchstwahrscheinlich der Virus war, heißt Angry_Birds und war als Spiel gekennzeichnet. Leider habe ich erst später bemerkt, dass es sich dabei um eine .exe Datei handelt. Ich habe es versucht zu löschen, aber das ging leider auch nicht.

Ich bitte dringend um Hilfe.

Vielen Dank im Vorraus,

Carolin S.

schrauber · 31.07.2014, 19:36

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Carolin.Abär · 31.07.2014, 22:55

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 02
Ran by Carolin (administrator) on GUTEMINE on 31-07-2014 23:42:58
Running from C:\Users\Carolin\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Wajamu) C:\Program Files\V-bates\guardsvc.exe
(Wajamu) C:\Program Files\V-bates\notifier.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\pg_ctl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
() C:\Program Files\V-bates\ExtensionUpdaterService.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [V-bates] => C:\Program Files\V-bates\notifier.exe [418640 2014-07-21] (Wajamu)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-999138141-1912988859-3756178019-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2B35845349E4CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
BHO: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension64.dll ()
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension32.dll ()
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: omiga-plus
FF SelectedSearchEngine: omiga-plus
FF Homepage: hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fast Start - C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\Extensions\faststartff@gmail.com [2014-07-22]
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF Extension: V-bates - C:\Program Files\V-bates\Firefox [2014-07-22]
FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com
FF HKCU\...\Firefox\Extensions: [{8c46fde2-8f22-4b77-9d6b-47daa604b639}] - C:\Program Files (x86)\Re-markit Corp\158.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829

Chrome: 
=======
CHR HomePage: hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
CHR StartupUrls: "https://www.google.de/"
CHR Extension: (ProxFlow) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-05-31]
CHR Extension: (Google Docs) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-17]
CHR Extension: (Google Drive) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-17]
CHR Extension: (YouTube) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-17]
CHR Extension: (Adblock Plus) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-18]
CHR Extension: (Google-Suche) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-17]
CHR Extension: (Google Wallet) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-17]
CHR Extension: (Google Mail) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-17]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-11-21]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 Mext Guard; C:\Program Files\V-bates\guardsvc.exe [130384 2014-07-21] (Wajamu)
R2 postgresql-8.4; c:\postgreSQL\bin\pg_ctl.exe [66048 2014-02-18] (PostgreSQL Global Development Group) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 V-bates Updater; C:\Program Files\V-bates\ExtensionUpdaterService.exe [211792 2014-07-21] ()
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-22] (Fuyu LIMITED)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37760 2007-04-25] (SMSC)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-31 23:42 - 2014-07-31 23:44 - 00016386 _____ () C:\Users\Carolin\Downloads\FRST.txt
2014-07-31 23:42 - 2014-07-31 23:43 - 00000000 ____D () C:\FRST
2014-07-31 23:41 - 2014-07-31 23:42 - 02094080 _____ (Farbar) C:\Users\Carolin\Downloads\FRST64.exe
2014-07-25 11:44 - 2014-07-25 11:44 - 18665071 _____ () C:\Users\Carolin\Downloads\Victorian Cottage.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:40 - 51981640 _____ () C:\Users\Carolin\Downloads\The Moving Castle v14.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:38 - 04347284 _____ () C:\Users\Carolin\Downloads\Sweet Berry Victorian.Sims3Pack
2014-07-25 11:36 - 2014-07-25 11:37 - 01814550 _____ () C:\Users\Carolin\Downloads\MsBlue_BlueSummerVisor.sims3pack
2014-07-25 11:36 - 2014-07-25 11:37 - 01364717 _____ () C:\Users\Carolin\Downloads\Timebomb Earrings by LiKo.sims3pack
2014-07-25 11:30 - 2014-07-25 11:31 - 04854717 _____ () C:\Users\Carolin\Downloads\Cazy_c144_cf.sims3pack
2014-07-25 11:30 - 2014-07-25 11:30 - 01506274 _____ () C:\Users\Carolin\Downloads\1063236.zip
2014-07-25 11:29 - 2014-07-25 11:31 - 06642495 _____ () C:\Users\Carolin\Downloads\Alesso_Candle.sims3pack
2014-07-25 11:29 - 2014-07-25 11:31 - 05372972 _____ () C:\Users\Carolin\Downloads\Cazy_c144_af.sims3pack
2014-07-25 11:29 - 2014-07-25 11:30 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli (1).sims3pack
2014-07-25 11:29 - 2014-07-25 11:30 - 03269431 _____ () C:\Users\Carolin\Downloads\Skysims Hai Adult 223_H.sims3pack
2014-07-25 11:28 - 2014-07-25 11:30 - 06347701 _____ () C:\Users\Carolin\Downloads\Alesso_Candle_C.sims3pack
2014-07-25 11:28 - 2014-07-25 11:30 - 03890141 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 224.sims3pack
2014-07-25 11:28 - 2014-07-25 11:29 - 04328798 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles01v2.sims3pack
2014-07-25 11:28 - 2014-07-25 11:28 - 03846681 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02.sims3pack
2014-07-25 11:27 - 2014-07-25 11:29 - 07326083 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AM_Hair07.sims3pack
2014-07-25 11:27 - 2014-07-25 11:29 - 03873739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 224.sims3pack
2014-07-25 11:27 - 2014-07-25 11:28 - 04255285 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02v2.sims3pack
2014-07-25 11:27 - 2014-07-25 11:28 - 04231739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 225-F.sims3pack
2014-07-25 11:27 - 2014-07-25 11:27 - 07454063 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AF_Hair23.sims3pack
2014-07-25 11:26 - 2014-07-25 11:27 - 04046511 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles03v2.sims3pack
2014-07-24 20:59 - 2014-07-24 20:59 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 16:50 - 2014-07-24 16:50 - 00001270 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-23 17:00 - 2014-07-23 17:01 - 41171024 _____ (Google Inc.) C:\Users\Carolin\Downloads\ChromeStandaloneSetup-1985.125.exe
2014-07-23 10:09 - 2014-07-23 10:09 - 00000000 _____ () C:\autoexec.bat
2014-07-23 10:08 - 2014-07-23 11:28 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 10:08 - 2014-07-23 10:08 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-23 09:53 - 2014-07-23 09:53 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Carolin\Downloads\SpyHunter-installer.exe
2014-07-22 20:36 - 2014-07-22 20:36 - 00003154 _____ () C:\Windows\System32\Tasks\{CBA561BE-606A-4785-8DED-559920E59AFA}
2014-07-22 20:32 - 2014-07-22 20:32 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-07-22 20:32 - 2014-07-22 20:32 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-07-22 20:32 - 2014-07-22 20:32 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-22 20:31 - 2014-07-23 09:47 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\omiga-plus
2014-07-22 20:31 - 2014-07-22 20:33 - 00000004 _____ () C:\end
2014-07-22 20:31 - 2014-07-22 20:31 - 00003626 _____ () C:\Windows\System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2
2014-07-22 20:31 - 2014-07-22 20:31 - 00000000 ____D () C:\Program Files\V-bates
2014-07-22 20:30 - 2014-07-22 20:30 - 00001817 _____ () C:\Users\Carolin\Desktop\Angry_Birds.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Angry_Birds
2014-07-22 20:28 - 2014-07-22 20:28 - 00736792 _____ (Live Soft Action S. R. L. ) C:\Users\Carolin\Downloads\Angry Birds angeboten von Bluetrackmedia Network CPA.exe
2014-07-22 20:28 - 2014-07-22 20:28 - 00736792 _____ (Live Soft Action S. R. L. ) C:\Users\Carolin\Downloads\Angry Birds angeboten von Bluetrackmedia Network CPA (1).exe
2014-07-15 11:41 - 2014-07-15 11:41 - 00000000 __SHD () C:\found.000
2014-07-13 18:25 - 2014-07-13 18:25 - 02874307 _____ () C:\Users\Carolin\Downloads\963161.zip
2014-07-10 14:01 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 14:01 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 14:01 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 14:01 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 14:01 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 14:01 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 14:01 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 14:01 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 14:01 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 14:01 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 14:01 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 14:01 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 14:01 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 14:01 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 14:01 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 14:01 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 14:01 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 14:01 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 14:01 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 14:01 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 14:01 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 14:01 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 14:01 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 14:01 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 14:01 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 14:01 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 14:01 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 14:01 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 14:01 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 14:01 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 14:01 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 14:01 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 14:01 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 14:01 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 14:01 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 14:01 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 14:01 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 14:01 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 14:01 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 14:01 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 14:01 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 14:01 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 14:01 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 14:01 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 14:01 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 14:01 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 14:01 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 14:01 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 14:01 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 14:01 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 14:01 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 14:01 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 14:00 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 14:00 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 14:00 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 14:00 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 14:00 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 14:00 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 14:00 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 14:00 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 14:00 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 14:00 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 14:00 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 14:00 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 13:59 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 13:59 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 13:59 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 16:36 - 2014-07-09 16:36 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli.sims3pack
2014-07-09 16:36 - 2014-07-09 16:36 - 04606727 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli_C.sims3pack

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-31 23:44 - 2014-07-31 23:42 - 00016386 _____ () C:\Users\Carolin\Downloads\FRST.txt
2014-07-31 23:43 - 2014-07-31 23:42 - 00000000 ____D () C:\FRST
2014-07-31 23:43 - 2013-11-13 18:37 - 02026375 _____ () C:\Windows\WindowsUpdate.log
2014-07-31 23:42 - 2014-07-31 23:41 - 02094080 _____ (Farbar) C:\Users\Carolin\Downloads\FRST64.exe
2014-07-31 23:42 - 2013-11-18 12:27 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{FC49DE3F-D8F1-4471-A5A1-E3C1D3598505}
2014-07-31 23:39 - 2013-11-14 18:14 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-31 23:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-31 23:38 - 2009-07-14 06:51 - 00048973 _____ () C:\Windows\setupact.log
2014-07-31 23:02 - 2013-11-14 18:14 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-31 22:57 - 2014-03-28 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-31 20:15 - 2009-07-14 06:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-31 20:15 - 2009-07-14 06:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-31 20:06 - 2013-11-18 09:35 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Skype
2014-07-25 19:29 - 2013-12-07 00:47 - 00000000 ____D () C:\Users\Carolin\AppData\Local\PokerStars.EU
2014-07-25 11:44 - 2014-07-25 11:44 - 18665071 _____ () C:\Users\Carolin\Downloads\Victorian Cottage.Sims3Pack
2014-07-25 11:40 - 2014-07-25 11:37 - 51981640 _____ () C:\Users\Carolin\Downloads\The Moving Castle v14.Sims3Pack
2014-07-25 11:38 - 2014-07-25 11:37 - 04347284 _____ () C:\Users\Carolin\Downloads\Sweet Berry Victorian.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:36 - 01814550 _____ () C:\Users\Carolin\Downloads\MsBlue_BlueSummerVisor.sims3pack
2014-07-25 11:37 - 2014-07-25 11:36 - 01364717 _____ () C:\Users\Carolin\Downloads\Timebomb Earrings by LiKo.sims3pack
2014-07-25 11:31 - 2014-07-25 11:30 - 04854717 _____ () C:\Users\Carolin\Downloads\Cazy_c144_cf.sims3pack
2014-07-25 11:31 - 2014-07-25 11:29 - 06642495 _____ () C:\Users\Carolin\Downloads\Alesso_Candle.sims3pack
2014-07-25 11:31 - 2014-07-25 11:29 - 05372972 _____ () C:\Users\Carolin\Downloads\Cazy_c144_af.sims3pack
2014-07-25 11:30 - 2014-07-25 11:30 - 01506274 _____ () C:\Users\Carolin\Downloads\1063236.zip
2014-07-25 11:30 - 2014-07-25 11:29 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli (1).sims3pack
2014-07-25 11:30 - 2014-07-25 11:29 - 03269431 _____ () C:\Users\Carolin\Downloads\Skysims Hai Adult 223_H.sims3pack
2014-07-25 11:30 - 2014-07-25 11:28 - 06347701 _____ () C:\Users\Carolin\Downloads\Alesso_Candle_C.sims3pack
2014-07-25 11:30 - 2014-07-25 11:28 - 03890141 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 224.sims3pack
2014-07-25 11:29 - 2014-07-25 11:28 - 04328798 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles01v2.sims3pack
2014-07-25 11:29 - 2014-07-25 11:27 - 07326083 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AM_Hair07.sims3pack
2014-07-25 11:29 - 2014-07-25 11:27 - 03873739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 224.sims3pack
2014-07-25 11:28 - 2014-07-25 11:28 - 03846681 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02.sims3pack
2014-07-25 11:28 - 2014-07-25 11:27 - 04255285 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02v2.sims3pack
2014-07-25 11:28 - 2014-07-25 11:27 - 04231739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 225-F.sims3pack
2014-07-25 11:27 - 2014-07-25 11:27 - 07454063 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AF_Hair23.sims3pack
2014-07-25 11:27 - 2014-07-25 11:26 - 04046511 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles03v2.sims3pack
2014-07-24 23:26 - 2013-11-14 18:12 - 00001257 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-07-24 20:59 - 2014-07-24 20:59 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 18:32 - 2014-02-03 21:02 - 00000000 ____D () C:\ProgramData\Origin
2014-07-24 18:32 - 2014-02-03 20:58 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-07-24 16:50 - 2014-07-24 16:50 - 00001270 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 16:49 - 2014-02-03 21:06 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-07-24 16:43 - 2014-02-03 21:02 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-23 17:02 - 2013-11-14 18:15 - 00002247 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-23 17:01 - 2014-07-23 17:00 - 41171024 _____ (Google Inc.) C:\Users\Carolin\Downloads\ChromeStandaloneSetup-1985.125.exe
2014-07-23 11:28 - 2014-07-23 10:08 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 10:09 - 2014-07-23 10:09 - 00000000 _____ () C:\autoexec.bat
2014-07-23 10:08 - 2014-07-23 10:08 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-23 09:53 - 2014-07-23 09:53 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Carolin\Downloads\SpyHunter-installer.exe
2014-07-23 09:47 - 2014-07-22 20:31 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\omiga-plus
2014-07-22 23:02 - 2014-06-04 15:38 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1397054888
2014-07-22 23:02 - 2014-04-09 16:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-07-22 22:31 - 2010-11-21 05:47 - 00432486 _____ () C:\Windows\PFRO.log
2014-07-22 20:36 - 2014-07-22 20:36 - 00003154 _____ () C:\Windows\System32\Tasks\{CBA561BE-606A-4785-8DED-559920E59AFA}
2014-07-22 20:33 - 2014-07-22 20:31 - 00000004 _____ () C:\end
2014-07-22 20:32 - 2014-07-22 20:32 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-07-22 20:32 - 2014-07-22 20:32 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-07-22 20:32 - 2014-07-22 20:32 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-22 20:31 - 2014-07-22 20:31 - 00003626 _____ () C:\Windows\System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2
2014-07-22 20:31 - 2014-07-22 20:31 - 00000000 ____D () C:\Program Files\V-bates
2014-07-22 20:31 - 2013-11-14 18:12 - 00001293 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00001817 _____ () C:\Users\Carolin\Desktop\Angry_Birds.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Angry_Birds
2014-07-22 20:28 - 2014-07-22 20:28 - 00736792 _____ (Live Soft Action S. R. L. ) C:\Users\Carolin\Downloads\Angry Birds angeboten von Bluetrackmedia Network CPA.exe
2014-07-22 20:28 - 2014-07-22 20:28 - 00736792 _____ (Live Soft Action S. R. L. ) C:\Users\Carolin\Downloads\Angry Birds angeboten von Bluetrackmedia Network CPA (1).exe
2014-07-20 15:22 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-17 21:34 - 2014-03-28 22:02 - 00000000 ____D () C:\Users\postgres
2014-07-17 14:09 - 2013-11-16 11:54 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-15 11:41 - 2014-07-15 11:41 - 00000000 __SHD () C:\found.000
2014-07-13 18:25 - 2014-07-13 18:25 - 02874307 _____ () C:\Users\Carolin\Downloads\963161.zip
2014-07-11 10:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 18:32 - 2009-07-14 06:45 - 00405280 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 18:30 - 2014-05-06 18:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 18:30 - 2010-11-21 09:16 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 18:14 - 2013-11-16 15:04 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 18:11 - 2013-11-13 19:36 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 18:09 - 2013-11-13 19:36 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 13:58 - 2014-03-28 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-10 13:57 - 2013-11-16 11:43 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-10 13:57 - 2013-11-16 11:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 16:36 - 2014-07-09 16:36 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli.sims3pack
2014-07-09 16:36 - 2014-07-09 16:36 - 04606727 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli_C.sims3pack
2014-07-06 23:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-05 11:38 - 2013-11-14 03:32 - 00699342 _____ () C:\Windows\system32\perfh007.dat
2014-07-05 11:38 - 2013-11-14 03:32 - 00149450 _____ () C:\Windows\system32\perfc007.dat
2014-07-05 11:38 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-04 21:32 - 2014-01-05 23:29 - 00000000 ____D () C:\Windows\System32\Tasks\Games

Some content of TEMP:
====================
C:\Users\Carolin\AppData\Local\Temp\avgnt.exe
C:\Users\Carolin\AppData\Local\Temp\ElexTech_setup.exe
C:\Users\Carolin\AppData\Local\Temp\SHSetup.exe
C:\Users\Carolin\AppData\Local\Temp\v-bates.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-18 16:13

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

[/CODE]

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2014 02
Ran by Carolin at 2014-07-31 23:44:23
Running from C:\Users\Carolin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
LibreOffice 4.1.5.3 (HKLM-x32\...\{E77773E5-944A-453F-97F3-46767AE0A253}) (Version: 4.1.5.3 - The Document Foundation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837B34E3-7C30-493C-8F6A-2B0F04E2912C}) (Version:  - )
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Need For Speed™ World (HKLM-x32\...\{3AF1B16A-7DC9-4C80-BAEC-70B088A7C5B8}) (Version: 1.0.0.0 - Electronic Arts)
omiga-plus uninstall (HKLM-x32\...\omiga-plus uninstall) (Version:  - omiga-plus)
Opera Stable 23.0.1522.60 (HKLM-x32\...\Opera 23.0.1522.60) (Version: 23.0.1522.60 - Opera Software ASA)
RollerCoaster Tycoon 3 (HKLM-x32\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
V-bates 2.0.0.443 (HKLM\...\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}_is1) (Version: 2.0.0.443 - Wajamu) <==== ATTENTION
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
WindowsMangerProtect20.0.0.502 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

23-07-2014 21:44:25 Windows Update
24-07-2014 16:00:16 Windows Update
24-07-2014 16:33:04 Windows Update
25-07-2014 16:04:38 Windows Update
26-07-2014 16:00:13 Windows Update
31-07-2014 18:06:03 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00A24921-B170-4BBB-B531-73CD2877E77B} - System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2 => C:\Program Files\V-bates\startsc.bat [2014-03-24] ()
Task: {3152CB30-EA16-4929-94B8-DB611B4A5254} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-14] (Google Inc.)
Task: {3E02BC1E-955D-43F0-942F-B2970EE6FA03} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-14] (Google Inc.)
Task: {3FF6F1B7-480E-48BE-A908-37DD20B1BBA0} - System32\Tasks\{63B75A4D-E45B-4A05-9D1C-44B05E71D4EA} => C:\Program Files (x86)\Samsung\Samsung PC Studio 3\Launcher.exe
Task: {4564F9EB-6BAB-494E-837A-9575DA718248} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10] (Adobe Systems Incorporated)
Task: {559A31A9-5028-4587-870F-AA12AD1954A5} - System32\Tasks\Opera scheduled Autoupdate 1397054888 => C:\Program Files (x86)\Opera\launcher.exe [2014-07-18] (Opera Software)
Task: {575F5FF0-955C-45BD-B16D-8C9E36ECC147} - System32\Tasks\{CF7C20EC-4B4B-443C-85FA-C0233D04E90F} => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe [2014-05-08] (Adobe Systems Incorporated)
Task: {7ABC8E6D-E337-47A5-98A7-9551CC2D6D63} - System32\Tasks\{9C57DF12-FF9E-4EB0-B686-BAE1CCE0F034} => C:\Program Files (x86)\Samsung\Samsung PC Studio 3\Launcher.exe
Task: {9624BB95-1194-428F-B3E1-68F79203F3C4} - System32\Tasks\{0609E5A5-5A78-499E-95B5-C24D728AB914} => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe [2014-05-08] (Adobe Systems Incorporated)
Task: {B7448FD4-2D9F-4EB8-AC7C-6E766C3A07C0} - System32\Tasks\Games\UpdateCheck_S-1-5-21-999138141-1912988859-3756178019-1001
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-11-16 18:54 - 2005-04-22 14:36 - 00143360 ____N () C:\Windows\system32\BrSNMP64.dll
2014-07-22 20:31 - 2014-07-21 17:40 - 00211792 _____ () C:\Program Files\V-bates\ExtensionUpdaterService.exe
2014-07-22 20:31 - 2014-07-21 17:40 - 00089424 _____ () C:\Program Files\V-bates\libwinhook.dll
2014-07-22 20:31 - 2014-07-21 17:40 - 00390480 _____ () C:\Program Files\V-bates\libredir2.dll
2014-07-22 20:31 - 2014-07-21 17:40 - 00190800 _____ () C:\Program Files\V-bates\libapi2hook.dll
2014-07-22 20:31 - 2014-07-21 17:40 - 00300368 _____ () C:\Program Files\V-bates\libinject2.dll
2014-03-28 22:01 - 2014-02-18 10:11 - 00172032 _____ () c:\postgreSQL\bin\LIBPQ.dll
2013-11-16 18:54 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-03-28 22:01 - 2012-08-14 15:19 - 00999424 _____ () c:\postgreSQL\bin\libxml2.dll
2014-07-19 10:05 - 2014-07-15 11:24 - 00718664 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libglesv2.dll
2014-07-19 10:05 - 2014-07-15 11:24 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libegl.dll
2014-07-19 10:05 - 2014-07-15 11:24 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll
2014-07-19 10:05 - 2014-07-15 11:24 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll
2014-07-19 10:05 - 2014-07-15 11:24 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll
2014-07-19 10:05 - 2014-07-15 11:24 - 14664008 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Massenspeichercontroller
Description: Massenspeichercontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Mini Card
Description: Mini Card
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/31/2014 11:40:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/31/2014 11:39:37 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-31 23:39:37 CESTFATAL:  the database system is starting up

Error: (07/31/2014 11:39:36 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-31 23:39:36 CESTFATAL:  the database system is starting up

Error: (07/31/2014 11:39:35 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-31 23:39:35 CESTFATAL:  the database system is starting up

Error: (07/25/2014 07:30:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 07:29:56 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-25 19:29:56 CESTFATAL:  the database system is starting up

Error: (07/25/2014 06:01:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 05:59:50 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-25 17:59:50 CESTFATAL:  the database system is starting up

Error: (07/25/2014 05:42:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm TS3W.exe, Version 0.2.0.209 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 910

Startzeit: 01cfa81e5bb11d6f

Endzeit: 16

Anwendungspfad: C:\Program Files (x86)\Electronic Arts\Die Sims 3\Game\Bin\TS3W.exe

Berichts-ID: 3c5713d0-1412-11e4-8702-00037a7ccc37

Error: (07/24/2014 10:10:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/31/2014 11:40:05 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
StarOpen

Error: (07/31/2014 11:38:40 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎31.‎07.‎2014 um 23:37:43 unerwartet heruntergefahren.

Error: (07/31/2014 11:38:32 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (07/31/2014 08:13:31 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2966583)

Error: (07/26/2014 06:02:30 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2966583)

Error: (07/25/2014 07:30:42 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
StarOpen

Error: (07/25/2014 07:29:05 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎25.‎07.‎2014 um 19:12:53 unerwartet heruntergefahren.

Error: (07/25/2014 07:28:58 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (07/25/2014 06:09:33 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2966583)

Error: (07/25/2014 06:00:13 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
StarOpen


Microsoft Office Sessions:
=========================
Error: (07/31/2014 11:40:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/31/2014 11:39:37 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-31 23:39:37 CESTFATAL:  the database system is starting up

Error: (07/31/2014 11:39:36 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-31 23:39:36 CESTFATAL:  the database system is starting up

Error: (07/31/2014 11:39:35 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-31 23:39:35 CESTFATAL:  the database system is starting up

Error: (07/25/2014 07:30:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 07:29:56 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-25 19:29:56 CESTFATAL:  the database system is starting up

Error: (07/25/2014 06:01:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 05:59:50 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2014-07-25 17:59:50 CESTFATAL:  the database system is starting up

Error: (07/25/2014 05:42:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: TS3W.exe0.2.0.20991001cfa81e5bb11d6f16C:\Program Files (x86)\Electronic Arts\Die Sims 3\Game\Bin\TS3W.exe3c5713d0-1412-11e4-8702-00037a7ccc37

Error: (07/24/2014 10:10:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-04-17 19:14:36.560
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-17 19:14:36.520
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 4049.8 MB
Available physical RAM: 2228.57 MB
Total Pagefile: 8097.78 MB
Available Pagefile: 5933.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:292.87 GB) (Free:187.26 GB) NTFS
Drive d: () (Fixed) (Total:172.79 GB) (Free:147.48 GB) NTFS
Drive e: (RCT3) (CDROM) (Total:0.61 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 141D0EAC)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=293 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=173 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Vielen Dank für die schnelle Antwort.

FRST und Addition befinden sich oben.
Was ist im ersten Post vergessen hab ist ein weiteres Programm, das mir Probleme bereitet. Momentan habe ich seit ein paar Tagen omiga plus als Starteite, das sich ebenfalls nicht deinstallieren lässt und mich zumüllt. Ich habe bereits vergeblich versucht, meine ursprüngliche Startseite Google wieder herzustellen. Diese öffnet sich seitdem nur bei neuen Tabs, nicht aber wie bisher beim Öffenen des Browsers. Gibt es eine Möglichkeit, dieses Progamm loszuwerden? Es existiert zwar ein Progamm names omiga plus uninstall, aber egal wie oft ich es deinstalliere, es klappt nicht.

MfG,

Carolin S.

schrauber · 01.08.2014, 18:03

Adware & Co. deinstallieren

Lade Dir bitte von hier Revo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:

diesen Zusatz haben:
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Carolin.Abär · 01.08.2014, 19:04

Leider habe ich ein Problem mit Revo uninstaller. Beim Additional Scan wurden 2 Programme mit Attention versehen, die ich mit Revo entfernen sollte. Allerdings befindet sich im Uninstallerfeld nur eines dieser Progamme (Windows Manager Project), diese habe ich dann wie beschrieben gelöscht. V-bates 2.0.0.443 taucht darin nicht auf. Wie entferne ich dieses? Kann ich trotzdem mit Combofix weiter machen?

MfG,

Carolin S.

schrauber · 02.08.2014, 20:12

JEtzt einfach Combofix

Carolin.Abär · 02.08.2014, 21:18

Code:

ATTFilter

Combofix Logfile:

	Code: 

 ATTFilter

  
	ComboFix 14-08-02.02 - Carolin 02.08.2014  21:49:27.1.2 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.4050.2519 [GMT 2:00]
ausgeführt von:: c:\users\Carolin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-07-02 bis 2014-08-02  ))))))))))))))))))))))))))))))
.
.
2014-08-01 17:48 . 2014-08-01 17:48	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-07-31 21:42 . 2014-07-31 21:44	--------	d-----w-	C:\FRST
2014-07-24 18:59 . 2014-07-24 18:59	--------	d-----w-	c:\users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 16:32 . 2014-07-24 16:32	--------	d-----w-	c:\users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 14:50 . 2014-07-24 14:50	--------	d--h--w-	c:\program files (x86)\Common Files\EAInstaller
2014-07-23 08:08 . 2014-07-23 08:08	--------	d-----w-	c:\program files\Enigma Software Group
2014-07-23 08:08 . 2014-07-23 09:28	--------	d-----w-	c:\windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 08:07 . 2014-07-23 08:07	--------	d-----w-	c:\program files (x86)\Common Files\Wise Installation Wizard
2014-07-22 18:32 . 2014-07-22 18:32	--------	d-----w-	c:\programdata\IePluginServices
2014-07-22 18:32 . 2014-07-22 18:32	--------	d-----w-	c:\program files (x86)\SupTab
2014-07-22 18:31 . 2014-07-23 07:47	--------	d-----w-	c:\users\Carolin\AppData\Roaming\omiga-plus
2014-07-22 18:31 . 2014-07-22 18:31	--------	d-----w-	c:\program files\V-bates
2014-07-22 18:30 . 2014-07-22 18:30	--------	d-----w-	c:\users\Carolin\AppData\Roaming\Angry_Birds
2014-07-15 09:41 . 2014-07-15 09:41	--------	d-----w-	C:\found.000
2014-07-10 12:09 . 2014-06-03 10:02	1719296	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2014-07-10 12:09 . 2014-06-03 10:02	1389568	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2014-07-10 12:09 . 2014-06-03 10:02	1380864	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2014-07-10 12:09 . 2014-06-03 10:02	1354240	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-10 12:09 . 2014-06-03 09:29	936960	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2014-07-10 12:00 . 2014-06-19 00:42	548352	----a-w-	c:\windows\system32\vbscript.dll
2014-07-10 11:59 . 2014-06-05 14:45	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-07-10 11:59 . 2014-06-05 14:26	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-07-10 11:59 . 2014-06-05 14:25	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-17 12:09 . 2013-11-16 09:54	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-07-10 16:09 . 2013-11-13 17:36	96441528	----a-w-	c:\windows\system32\MRT.exe
2014-07-10 11:57 . 2013-11-16 09:43	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-10 11:57 . 2013-11-16 09:43	699056	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-24 12:45 . 2013-11-16 09:54	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-06-03 15:49 . 2013-11-16 09:54	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-05-08 09:32 . 2014-06-11 18:24	16384	----a-w-	c:\windows\system32\RdpGroupPolicyExtension.dll
2014-05-08 09:32 . 2014-06-11 18:24	3178496	----a-w-	c:\windows\system32\rdpcorets.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
2014-07-21 15:40	197456	----a-w-	c:\program files\V-bates\Extension32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2014-07-22 18:32	515464	----a-w-	c:\program files (x86)\SupTab\SupTab.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-14 20584608]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-06-24 750160]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-12-6 565464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 postgresql-8.4;postgresql-8.4 - PostgreSQL Server 8.4;c:\postgresql\bin\pg_ctl.exe runservice -N postgresql-8.4 -D c:/postgreSQL/data -w;c:\postgresql\bin\pg_ctl.exe runservice -N postgresql-8.4 -D c:/postgreSQL/data -w [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Mext Guard;Mext Guard;c:\program files\V-bates\guardsvc.exe;c:\program files\V-bates\guardsvc.exe [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S2 V-bates Updater;V-bates Updater;c:\program files\V-bates\ExtensionUpdaterService.exe;c:\program files\V-bates\ExtensionUpdaterService.exe [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\DRIVERS\SMSCir64.sys;c:\windows\SYSNATIVE\DRIVERS\SMSCir64.sys [x]
S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-23 15:02	1104200	----a-w-	c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-16 11:58]
.
2014-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-14 16:14]
.
2014-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-14 16:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
2014-07-21 15:40	238416	----a-w-	c:\program files\V-bates\Extension64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
"V-bates"="c:\program files\V-bates\notifier.exe" [2014-07-21 418640]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
mDefault_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
mStart Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}
uSearchAssistant = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\
FF - prefs.js: browser.search.selectedEngine - omiga-plus
FF - prefs.js: browser.startup.homepage - hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
FF - ExtSQL: !HIDDEN! 2014-04-09 16:33; quick_start@gmail.com; c:\users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\quick_start@gmail.com
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="\"c:\postgresql\bin\pg_ctl.exe\" runservice -N \"postgresql-8.4\" -D \"c:/postgreSQL/data\" -w"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-999138141-1912988859-3756178019-1001\Software\SecuROM\License information*]
"datasecu"=hex:56,4f,45,65,e1,be,20,a5,e6,d5,2d,f3,cc,17,e7,23,44,bd,7c,07,bb,
   ed,53,8f,22,20,2e,a9,56,9b,45,32,dc,64,1a,a3,5a,9b,1c,af,d1,4a,3e,52,7b,27,\
"rkeysecu"=hex:34,ed,80,42,80,67,39,e0,88,ec,1b,29,20,0b,48,47
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-02  21:57:22
ComboFix-quarantined-files.txt  2014-08-02 19:57
.
Vor Suchlauf: 17 Verzeichnis(se), 203.672.240.128 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 203.657.064.448 Bytes frei
.
- - End Of File - - 0AAC2B607BBC939A862C84AE10554E12
         
 --- --- ---
A36C5E4F47E84449FF07ED3517B43A31

Ich habe Combofix durchlaufen lassen. Tut mir Leid, dass das mit dem Posten des Logfiles etwas schief gelaufen ist...

MfG,

Carolin S.

schrauber · 03.08.2014, 07:05

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Carolin.Abär · 03.08.2014, 22:07

Hallo,

ich habe alles durchlaufen lassen. Protokolle folgen

MfG,

Carolin S.

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 03.08.2014
Suchlauf-Zeit: 21:07:26
Logdatei: mbam..txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.08.03.06
Rootkit Datenbank: v2014.08.01.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Carolin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 372673
Verstrichene Zeit: 21 Min, 36 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 3
PUP.Optional.SweetPacks.A, C:\Program Files\V-bates\ExtensionUpdaterService.exe, 456, Löschen bei Neustart, [6cfe952ca2d9ae88da68d23eaf5231cf]
PUP.Optional.VBates.A, C:\Program Files\V-bates\notifier.exe, 3096, Löschen bei Neustart, [0961eed3abd084b2bb72e1fc0ff3956b]
PUP.Optional.Vbates.A, C:\Program Files\V-bates\guardsvc.exe, 1572, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a]

Module: 7
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 

Registrierungsschlüssel: 46
PUP.Optional.SweetPacks.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\V-bates Updater, In Quarantäne, [6cfe952ca2d9ae88da68d23eaf5231cf], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\CLSID\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}\INPROCSERVER32, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\TYPELIB\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\INTERFACE\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\Extension.ExtensionHelperObject.1, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\Extension.ExtensionHelperObject, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Extension.ExtensionHelperObject, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Extension.ExtensionHelperObject.1, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, Löschen bei Neustart, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, Löschen bei Neustart, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Löschen bei Neustart, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.SupTab.A, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Löschen bei Neustart, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, In Quarantäne, [f9714e73324934025063fe69d32fe41c], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, In Quarantäne, [f9714e73324934025063fe69d32fe41c], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, In Quarantäne, [f9714e73324934025063fe69d32fe41c], 
PUP.Optional.GetNow.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, In Quarantäne, [f9714e73324934025063fe69d32fe41c], 
PUP.Optional.Snapdo.T, HKU\S-1-5-21-999138141-1912988859-3756178019-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, Löschen bei Neustart, [7bef3c85bac14de9b160ddc13fc325db], 
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\omiga-plus uninstall, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.VbatesHelper.A, HKLM\SOFTWARE\V-bates, In Quarantäne, [1b4f8c35c0bb82b4244edd20a95924dc], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [600a932eb0cb4de9e5b6071634d006fa], 
PUP.Optional.VBates, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}_IS1, In Quarantäne, [7ded2a9779020333b01a89aaf90b18e8], 
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\omiga-plusSoftware, In Quarantäne, [8ddd5f624d2e132328e202282ed67c84], 
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, In Quarantäne, [92d89031384395a17aa22b07818306fa], 
PUP.Optional.VbatesHelper.A, HKLM\SOFTWARE\WOW6432NODE\V-bates, In Quarantäne, [9bcf5d64c9b211252b477b8245bd4ab6], 
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [6604dee3c3b887af69324ecfe91b8b75], 
PUP.Optional.SuperFish.A, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, Löschen bei Neustart, [2941d2ef91ea71c51de9d1071ee450b0], 
PUP.Optional.Qone8, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Löschen bei Neustart, [fa70a021106bf442eab0b4699470f60a], 
PUP.Optional.Vbates.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{D067E3E4-354F-4F8A-8668-1AA03D22CBA1}, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{82C1E22B-0B13-4959-8E7D-FDACCBCC4391}, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A516C81D-0FB7-4306-BBAE-9E42DA16B804}, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{82C1E22B-0B13-4959-8E7D-FDACCBCC4391}, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A516C81D-0FB7-4306-BBAE-9E42DA16B804}, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{D067E3E4-354F-4F8A-8668-1AA03D22CBA1}, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Mext Guard, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 

Registrierungswerte: 8
PUP.Optional.VBates, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, C:\Program Files\V-bates\Firefox, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14]
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}, C:\Program Files\V-bates\Firefox, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14]
PUP.Optional.VBates, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}, In Quarantäne, [aebc14ad81fa999d38ee2f3817ebd42c], 
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}, In Quarantäne, [a8c2dde492e986b07da96106669c24dc], 
PUP.Optional.VBates.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|V-bates, C:\Program Files\V-bates\notifier.exe, In Quarantäne, [0961eed3abd084b2bb72e1fc0ff3956b]
PUP.Optional.VBates, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}_IS1|UninstallString, "C:\Program Files\V-bates\unins000.exe", In Quarantäne, [7ded2a9779020333b01a89aaf90b18e8]
PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com, In Quarantäne, [b1b94c75df9c92a4ee45c968d72d3bc5]
PUP.Optional.FastStart.A, HKU\S-1-5-21-999138141-1912988859-3756178019-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, Löschen bei Neustart, [6cfe922f5922211538136473c53dc53b]

Registrierungsdaten: 9
PUP.Optional.ISearch.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://isearch.omiga-plus.com/?type=sc&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://isearch.omiga-plus.com/?type=sc&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829),Ersetzt,[d496348db5c671c56fae6b49798bc33d]
PUP.Optional.ISearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829),Ersetzt,[c4a6be034536ec4a1a07c5efae569b65]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[90da58697b00b77fb31af4ca7292847c]
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://isearch.omiga-plus.com/?type=sc&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://isearch.omiga-plus.com/?type=sc&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829),Ersetzt,[d09affc2c0bb8caa1b02bbf99a6aaf51]
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}),Ersetzt,[a7c305bc38430f2767b9635183811be5]
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829),Ersetzt,[9bcffdc4d6a58fa739e6cde7ad57867a]
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829),Ersetzt,[b6b43a87e59664d21809456f25dff50b]
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829&q={searchTerms}),Ersetzt,[c7a312af423989ad21032d87dd277a86]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[95d5427f097223130cc1318d15efd927]

Ordner: 76
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\log, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, In Quarantäne, [a0cad3eef289b68076473b8814eeb44c], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include\tools, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\lib, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\module, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\pack, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\en, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\en-US, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\es, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\es-419, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\it, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\it-CH, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\pl, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\ru, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\tr, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\vi, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\defaults, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\defaults\preferences, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content\libraries, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content\resources, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\locale, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\locale\en-US, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\skin, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\defaults, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\defaults\preferences, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libraries, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\resources, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 

Dateien: 199
PUP.Optional.SweetPacks.A, C:\Program Files\V-bates\ExtensionUpdaterService.exe, Löschen bei Neustart, [6cfe952ca2d9ae88da68d23eaf5231cf], 
PUP.Optional.VBates, C:\Program Files\V-bates\Extension64.dll, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.VBates, C:\Program Files\V-bates\Extension32.dll, In Quarantäne, [b6b4a120e596da5c4cda72f534ceec14], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupTab.dll, In Quarantäne, [51198e33c5b6d165f8b5a9bc4ab8e41c], 
PUP.Optional.GetNow.A, C:\Users\Carolin\Downloads\Angry Birds angeboten von Bluetrackmedia Network CPA.exe, In Quarantäne, [f9714e73324934025063fe69d32fe41c], 
PUP.Optional.LiveSoftAction, C:\Users\Carolin\Downloads\Angry Birds angeboten von Bluetrackmedia Network CPA (1).exe, In Quarantäne, [9dcd13ae76052016f63f1dd0ea1a916f], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\MessageBox.xml, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\183.json, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\uninstallDlg2.xml, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\uninstalled2.ini, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\UninstallManager.exe, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\bg.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\bg1.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\bk_shadow.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\button.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\button1.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\checkbox.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\checkbox_select.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\checked.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\close.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\loading_bg.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\loading_light.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\min.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\scrollbar.bmp, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\Thumbs.db, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\unchecked.png, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\code1.jpg, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\code2.jpg, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\code3.jpg, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\code4.jpg, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\code5.jpg, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\code6.jpg, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\images\code\Thumbs.db, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\log\UninstallManager_2014-07-22[20-35-44-237].log, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\log\UninstallManager_2014-07-22[20-36-31-335].log, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\log\UninstallManager_2014-07-22[20-38-06-175].log, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\log\UninstallManager_2014-07-23[09-46-59-021].log, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.OmigaPlus.A, C:\Users\Carolin\AppData\Roaming\omiga-plus\log\UninstallManager_2014-07-23[09-51-20-917].log, In Quarantäne, [4525ac1599e2e15512337760ee1435cb], 
PUP.Optional.Ciuvo.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage, In Quarantäne, [24466a575e1d3ef8794dcc107d859f61], 
PUP.Optional.Ciuvo.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_api.ciuvo.com_0.localstorage-journal, In Quarantäne, [0961dfe27efd62d4745253899969b54b], 
PUP.Optional.Softonic.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.softonic.com_0.localstorage, In Quarantäne, [8ae06a5706751224a7fdebf526dcaf51], 
PUP.Optional.Softonic.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.softonic.com_0.localstorage-journal, In Quarantäne, [1654467b81faae88dbc9a23ead550af6], 
PUP.Optional.LiveLyrics.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.livelyrics00.live-lyrics.com_0.localstorage, In Quarantäne, [3139fbc6e794be78803d80617989f30d], 
PUP.Optional.LiveLyrics.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.livelyrics00.live-lyrics.com_0.localstorage-journal, In Quarantäne, [2d3d368b0774c76f9e1f845d14ee2cd4], 
PUP.Optional.ShoppingGate.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, In Quarantäne, [1555b30ea8d3072ff476cf1458aa9769], 
PUP.Optional.ShoppingGate.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, In Quarantäne, [b7b3863b1a618caa1f4b5e8560a25da3], 
PUP.Optional.LiveLyrics.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.livelyrics00.live-lyrics.com_0.localstorage, In Quarantäne, [95d510b13c3f81b54d7318cb9d6535cb], 
PUP.Optional.LiveLyrics.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.livelyrics00.live-lyrics.com_0.localstorage-journal, In Quarantäne, [4921d9e83c3ff44270507d66788afb05], 
PUP.Optional.Superfish.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, In Quarantäne, [4d1de7da1c5fa294e9d8eef57b877789], 
PUP.Optional.Superfish.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, In Quarantäne, [3d2d9031b7c4d26498292db6c93945bb], 
PUP.Optional.ISearch.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\omiga-plus.xml, In Quarantäne, [f4762b96542796a0bb7acc55778d5ba5], 
PUP.Optional.VBates, C:\Windows\System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2, In Quarantäne, [0169c001c5b650e6d1fe250eb054e21e], 
PUP.Optional.VBates.A, C:\Program Files\V-bates\notifier.exe, Löschen bei Neustart, [0961eed3abd084b2bb72e1fc0ff3956b], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome.manifest, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\install.rdf, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\index.html, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\quick_start.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\js.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\module\other.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\default_add_logo.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\default_add_logo_hover.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\icon.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\loading.gif, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\logo.ico, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\logo.png, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\logo32.ico, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\simple.css, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\chrome\skin\style.css, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\addonmanager.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\aes.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\config.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\dialogs.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\last_tab.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\misc.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\properties.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\remoterequest.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\restoreprefs.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.FastStart.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\extensions\faststartff@gmail.com\modules\settings.js, In Quarantäne, [6ffb5071ea91a98df2fdf3d1cc3619e7], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\guardsvc.exe, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\InstallerHelper.dll, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\IssSurvey.dll, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\IssSurvey.ini, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libapi2hook.dll, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libinject.dll, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libinject2.dll, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libredir2.dll, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libwinhook.dll, Löschen bei Neustart, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\NMHClient.exe, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\PrefHelper.exe, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\startsc.bat, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\unins000.dat, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\unins000.exe, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome.manifest, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\icon.png, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\install.rdf, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.xpi, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content\main.js, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content\main.xul, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content\libraries\DataExchangeScript.js, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\content\resources\LocalScript.js, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\locale\en-US\overlay.dtd, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\chrome\skin\overlay.css, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\Firefox\defaults\preferences\defaults.js, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\libraries\DataExchangeScript.js, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.Vbates.A, C:\Program Files\V-bates\resources\LocalScript.js, In Quarantäne, [0e5cc2ff7704280e15854c7b976b966a], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface64.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SearchProtect64.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\btn.png, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\close.png, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, In Quarantäne, [49214b76cead4aecb3a5e1eb847e36ca], 
PUP.Optional.ISearch.A, C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: (   "homepage": "hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829",), Ersetzt,[5f0bc8f99dde89ad276ac82710f47c84]
PUP.Optional.ISearch.A, C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829");), Ersetzt,[ce9cdde4d9a256e0f731a24db94b8779]

Physische Sektoren: 0
(No malicious items detected)


(end)

JRT Logfile:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by Carolin on 03.08.2014 at 22:10:00,31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.08.2014 at 22:15:35,58
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- --- ---

[/CODE]

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.302 - Bericht erstellt am 03/08/2014 um 21:53:34
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Carolin - GUTEMINE
# Gestartet von : C:\Users\Carolin\Desktop\adwcleaner_3.302.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Carolin\daemonprocess.txt
Datei Gelöscht : C:\Users\Carolin\AppData\Roaming\aps.uninstall.scan.results
Datei Gelöscht : C:\Users\Papa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Startfenster.lnk
Datei Gelöscht : C:\Users\Papa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Startfenster.lnk
Datei Gelöscht : C:\Users\Papa\Favorites\Startfenster.lnk

***** [ Tasks ] *****

Task Gelöscht : Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Carolin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Carolin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{8c46fde2-8f22-4b77-9d6b-47daa604b639}]
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BrowseMark_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BrowseMark_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBrowseMark_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBrowseMark_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\SupHpUISoft
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWPM

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v29.0 (de)

[ Datei : C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "omiga-plus");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "omiga-plus");
Zeile gelöscht : user_pref("{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.ScriptData_VBATES_partn_time_isearch.omiga-plus.com", "not set");
Zeile gelöscht : user_pref("{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.ScriptData_whiteListSearch", "{\"isearch.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"se[...]

[ Datei : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\7u51zsgt.default\prefs.js ]


-\\ Google Chrome v36.0.1985.125

[ Datei : C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Homepage] : hxxp://isearch.omiga-plus.com/?type=hp&ts=1406053903&from=ium&uid=ST500LM012XHN-M500MBB_S2ZYJ9GD903829
Gelöscht [Extension] : deghekbbihbapplmbffglehkdhkeibbm
Gelöscht [Extension] : majjphhgppkndjjkmhhnbgafooenebhd
Gelöscht [Extension] : nikpibnbobmbdbheedjfogjlikpgpnhp

[ Datei : C:\Users\Papa\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5gf5bOvNfqXrfn-k9ji_fLiX24j_bO4bUiaErpUrJrLE_6CpZTQWUGYnHkHqT7oJ2nBKXwA1luW-w1xc7ETyEOOCLOVT28BdNpdtucnndKarXxBeZNUX--jI6HHsVfgM,&q={searchTerms}

*************************

AdwCleaner[R0].txt - [4738 octets] - [03/08/2014 21:46:19]
AdwCleaner[S0].txt - [4243 octets] - [03/08/2014 21:53:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4303 octets] ##########

--- --- ---

[/CODE]

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Carolin (administrator) on GUTEMINE on 03-08-2014 23:05:29
Running from C:\Users\Carolin\Desktop\Trojanerboard
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\pg_ctl.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-999138141-1912988859-3756178019-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2B35845349E4CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default
FF NewTab: chrome://quick_start/content/index.html
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/"
CHR Extension: (ProxFlow) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-05-31]
CHR Extension: (Google Docs) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-17]
CHR Extension: (Google Drive) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-17]
CHR Extension: (YouTube) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-17]
CHR Extension: (Adblock Plus) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-18]
CHR Extension: (Google-Suche) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-17]
CHR Extension: (Google Wallet) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-17]
CHR Extension: (Google Mail) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 postgresql-8.4; c:\postgreSQL\bin\pg_ctl.exe [66048 2014-02-18] (PostgreSQL Global Development Group) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-03] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37760 2007-04-25] (SMSC)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-03 22:15 - 2014-08-03 22:15 - 00000623 _____ () C:\Users\Carolin\Desktop\JRT.txt
2014-08-03 22:08 - 2014-08-03 22:05 - 01016261 _____ (Thisisu) C:\Users\Carolin\Desktop\JRT.exe
2014-08-03 22:07 - 2014-08-03 22:08 - 04557995 _____ () C:\Users\Carolin\Downloads\Cazy_c151_af.sims3pack
2014-08-03 22:04 - 2014-08-03 22:05 - 01016261 _____ (Thisisu) C:\Users\Carolin\Downloads\JRT.exe
2014-08-03 21:55 - 2014-08-03 21:55 - 00004383 _____ () C:\Users\Carolin\Desktop\AdwCleaner[S0].txt
2014-08-03 21:46 - 2014-08-03 21:53 - 00000000 ____D () C:\AdwCleaner
2014-08-03 21:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Downloads\adwcleaner_3.302.exe
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Desktop\adwcleaner_3.302.exe
2014-08-03 21:43 - 2014-08-03 21:43 - 00060681 _____ () C:\Users\Carolin\Desktop\mbam.txt
2014-08-03 21:06 - 2014-08-03 21:06 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-03 21:06 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-03 21:06 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-03 21:06 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-03 21:05 - 2014-08-03 21:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Carolin\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-02 23:33 - 2014-08-02 23:34 - 37880514 _____ () C:\Users\Carolin\Downloads\Classic White Villa.Sims3Pack
2014-08-02 23:33 - 2014-08-02 23:33 - 04727706 _____ () C:\Users\Carolin\Downloads\UlkerHairFashionista15_Adult.sims3pack
2014-08-02 23:33 - 2014-08-02 23:33 - 03199644 _____ () C:\Users\Carolin\Downloads\[ZaumaTSR] s3-hair042-Crush-f.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03634184 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 195.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03426481 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 195.sims3pack
2014-08-02 23:24 - 2014-08-02 23:24 - 12696805 _____ () C:\Users\Carolin\Downloads\Tinsely Villa.Sims3Pack
2014-08-02 23:24 - 2014-08-02 23:24 - 01147365 _____ () C:\Users\Carolin\Downloads\Sweet Summer Teen Dress-Mh75.sims3pack
2014-08-02 23:23 - 2014-08-02 23:23 - 00199697 _____ () C:\Users\Carolin\Downloads\fergiehairrs.sims3pack
2014-08-02 23:22 - 2014-08-02 23:22 - 01418161 _____ () C:\Users\Carolin\Downloads\1197438.zip
2014-08-02 23:21 - 2014-08-02 23:21 - 34748927 _____ () C:\Users\Carolin\Downloads\One Step Ahead.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 05956924 _____ () C:\Users\Carolin\Downloads\Windermere Cottage.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 00574196 _____ () C:\Users\Carolin\Downloads\1228532.zip
2014-08-02 23:19 - 2014-08-02 23:20 - 09270579 _____ () C:\Users\Carolin\Downloads\Rivendell Mill.Sims3Pack
2014-08-02 23:19 - 2014-08-02 23:19 - 03762268 _____ () C:\Users\Carolin\Downloads\1228756.zip
2014-08-02 23:19 - 2014-08-02 23:19 - 01613957 _____ () C:\Users\Carolin\Downloads\Maternity Outfit ~ Simple Provocation.sims3pack
2014-08-02 23:18 - 2014-08-02 23:19 - 04559284 _____ () C:\Users\Carolin\Downloads\Cleo_GradientDress_Full.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03220629 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-034-TSR Skysims3.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03005795 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-f.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05350468 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03b.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05174084 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03c.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 03001978 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-c.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 04240354 _____ () C:\Users\Carolin\Downloads\ulkerhair005.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 03339705 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J013-Labyrinth-f.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 00113854 _____ () C:\Users\Carolin\Downloads\MeshElenaTSRfloppyhat.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 04013960 _____ () C:\Users\Carolin\Downloads\1180785.zip
2014-08-02 23:15 - 2014-08-02 23:15 - 02974553 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 190.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02843071 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_child-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02759424 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02008649 _____ () C:\Users\Carolin\Downloads\Skysims3-f-adult-hat-001.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 01430900 _____ () C:\Users\Carolin\Downloads\Chelia Earrings - By Metens.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 00886080 _____ () C:\Users\Carolin\Downloads\NataliS Apples Childs earrings CF.sims3pack
2014-08-02 23:14 - 2014-08-02 23:14 - 02712595 _____ () C:\Users\Carolin\Downloads\by bukovka_am accessory glasses_dude.sims3pack
2014-08-02 22:58 - 2014-08-02 22:58 - 01061121 _____ () C:\Users\Carolin\Downloads\Metens - Country Song.sims3pack
2014-08-02 22:56 - 2014-08-02 22:58 - 29383248 _____ () C:\Users\Carolin\Downloads\The Lake Manor.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:58 - 29122458 _____ () C:\Users\Carolin\Downloads\The Old Homestead.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:57 - 18091923 _____ () C:\Users\Carolin\Downloads\Haus  Isla I.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:56 - 00861046 _____ () C:\Users\Carolin\Downloads\curbs cats eye glasses 02.sims3pack
2014-08-02 22:55 - 2014-08-02 22:55 - 07872196 _____ () C:\Users\Carolin\Downloads\1228932.zip
2014-08-02 22:54 - 2014-08-02 22:54 - 01473989 _____ () C:\Users\Carolin\Downloads\CharmingDress - Paogae.sims3pack
2014-08-02 22:49 - 2014-08-02 22:50 - 04080584 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles05v1.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 03307712 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles06.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 00668241 _____ () C:\Users\Carolin\Downloads\NataliS Diamond Engagement Ring 002 FA-FE.sims3pack
2014-08-02 21:59 - 2014-08-02 21:59 - 00018729 _____ () C:\Users\Carolin\Desktop\ComboFix.txt
2014-08-02 21:57 - 2014-08-02 21:57 - 00018729 _____ () C:\ComboFix.txt
2014-08-02 21:47 - 2014-08-02 21:57 - 00000000 ____D () C:\Qoobox
2014-08-02 21:47 - 2014-08-02 21:44 - 05566616 ____R (Swearware) C:\Users\Carolin\Desktop\ComboFix.exe
2014-08-02 21:47 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-02 21:47 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-02 21:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-02 21:44 - 2014-08-02 21:44 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix (1).exe
2014-08-02 21:43 - 2014-08-02 21:44 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix.exe
2014-08-01 19:48 - 2014-08-01 19:48 - 00001264 _____ () C:\Users\Carolin\Desktop\Revo Uninstaller.lnk
2014-08-01 19:48 - 2014-08-01 19:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-01 19:47 - 2014-08-01 19:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Carolin\Downloads\revosetup95.exe
2014-07-31 23:44 - 2014-07-31 23:44 - 00022657 _____ () C:\Users\Carolin\Downloads\Addition.txt
2014-07-31 23:42 - 2014-08-03 23:05 - 00000000 ____D () C:\FRST
2014-07-31 23:42 - 2014-07-31 23:44 - 00041905 _____ () C:\Users\Carolin\Downloads\FRST.txt
2014-07-31 23:41 - 2014-07-31 23:42 - 02094080 _____ (Farbar) C:\Users\Carolin\Downloads\FRST64.exe
2014-07-25 11:44 - 2014-07-25 11:44 - 18665071 _____ () C:\Users\Carolin\Downloads\Victorian Cottage.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:40 - 51981640 _____ () C:\Users\Carolin\Downloads\The Moving Castle v14.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:38 - 04347284 _____ () C:\Users\Carolin\Downloads\Sweet Berry Victorian.Sims3Pack
2014-07-25 11:36 - 2014-07-25 11:37 - 01814550 _____ () C:\Users\Carolin\Downloads\MsBlue_BlueSummerVisor.sims3pack
2014-07-25 11:36 - 2014-07-25 11:37 - 01364717 _____ () C:\Users\Carolin\Downloads\Timebomb Earrings by LiKo.sims3pack
2014-07-25 11:30 - 2014-07-25 11:31 - 04854717 _____ () C:\Users\Carolin\Downloads\Cazy_c144_cf.sims3pack
2014-07-25 11:30 - 2014-07-25 11:30 - 01506274 _____ () C:\Users\Carolin\Downloads\1063236.zip
2014-07-25 11:29 - 2014-07-25 11:31 - 06642495 _____ () C:\Users\Carolin\Downloads\Alesso_Candle.sims3pack
2014-07-25 11:29 - 2014-07-25 11:31 - 05372972 _____ () C:\Users\Carolin\Downloads\Cazy_c144_af.sims3pack
2014-07-25 11:29 - 2014-07-25 11:30 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli (1).sims3pack
2014-07-25 11:29 - 2014-07-25 11:30 - 03269431 _____ () C:\Users\Carolin\Downloads\Skysims Hai Adult 223_H.sims3pack
2014-07-25 11:28 - 2014-07-25 11:30 - 06347701 _____ () C:\Users\Carolin\Downloads\Alesso_Candle_C.sims3pack
2014-07-25 11:28 - 2014-07-25 11:30 - 03890141 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 224.sims3pack
2014-07-25 11:28 - 2014-07-25 11:29 - 04328798 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles01v2.sims3pack
2014-07-25 11:28 - 2014-07-25 11:28 - 03846681 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02.sims3pack
2014-07-25 11:27 - 2014-07-25 11:29 - 07326083 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AM_Hair07.sims3pack
2014-07-25 11:27 - 2014-07-25 11:29 - 03873739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 224.sims3pack
2014-07-25 11:27 - 2014-07-25 11:28 - 04255285 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02v2.sims3pack
2014-07-25 11:27 - 2014-07-25 11:28 - 04231739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 225-F.sims3pack
2014-07-25 11:27 - 2014-07-25 11:27 - 07454063 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AF_Hair23.sims3pack
2014-07-25 11:26 - 2014-07-25 11:27 - 04046511 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles03v2.sims3pack
2014-07-24 20:59 - 2014-07-24 20:59 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 16:50 - 2014-07-24 16:50 - 00001270 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-23 17:00 - 2014-07-23 17:01 - 41171024 _____ (Google Inc.) C:\Users\Carolin\Downloads\ChromeStandaloneSetup-1985.125.exe
2014-07-23 10:09 - 2014-07-23 10:09 - 00000000 _____ () C:\autoexec.bat
2014-07-23 10:08 - 2014-07-23 11:28 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 10:08 - 2014-07-23 10:08 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-23 09:53 - 2014-07-23 09:53 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Carolin\Downloads\SpyHunter-installer.exe
2014-07-22 20:36 - 2014-07-22 20:36 - 00003154 _____ () C:\Windows\System32\Tasks\{CBA561BE-606A-4785-8DED-559920E59AFA}
2014-07-22 20:30 - 2014-07-22 20:30 - 00001817 _____ () C:\Users\Carolin\Desktop\Angry_Birds.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Angry_Birds
2014-07-15 11:41 - 2014-07-15 11:41 - 00000000 ____D () C:\found.000
2014-07-13 18:25 - 2014-07-13 18:25 - 02874307 _____ () C:\Users\Carolin\Downloads\963161.zip
2014-07-10 14:01 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 14:01 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 14:01 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 14:01 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 14:01 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 14:01 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 14:01 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 14:01 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 14:01 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 14:01 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 14:01 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 14:01 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 14:01 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 14:01 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 14:01 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 14:01 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 14:01 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 14:01 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 14:01 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 14:01 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 14:01 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 14:01 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 14:01 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 14:01 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 14:01 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 14:01 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 14:01 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 14:01 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 14:01 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 14:01 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 14:01 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 14:01 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 14:01 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 14:01 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 14:01 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 14:01 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 14:01 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 14:01 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 14:01 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 14:01 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 14:01 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 14:01 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 14:01 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 14:01 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 14:01 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 14:01 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 14:01 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 14:01 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 14:01 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 14:01 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 14:01 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 14:01 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 14:00 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 14:00 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 14:00 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 14:00 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 14:00 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 14:00 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 14:00 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 14:00 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 14:00 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 14:00 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 14:00 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 14:00 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 13:59 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 13:59 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 13:59 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 16:36 - 2014-07-09 16:36 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli.sims3pack
2014-07-09 16:36 - 2014-07-09 16:36 - 04606727 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli_C.sims3pack

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-03 23:05 - 2014-07-31 23:42 - 00000000 ____D () C:\FRST
2014-08-03 23:05 - 2014-04-18 19:54 - 00000000 ____D () C:\Users\Carolin\Desktop\Trojanerboard
2014-08-03 23:02 - 2013-11-14 18:14 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-03 22:57 - 2014-03-28 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-03 22:25 - 2009-07-14 06:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-03 22:25 - 2009-07-14 06:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-03 22:17 - 2013-11-14 18:14 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-03 22:17 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-03 22:17 - 2009-07-14 06:51 - 00049869 _____ () C:\Windows\setupact.log
2014-08-03 22:16 - 2013-11-13 18:37 - 01210863 _____ () C:\Windows\WindowsUpdate.log
2014-08-03 22:15 - 2014-08-03 22:15 - 00000623 _____ () C:\Users\Carolin\Desktop\JRT.txt
2014-08-03 22:08 - 2014-08-03 22:07 - 04557995 _____ () C:\Users\Carolin\Downloads\Cazy_c151_af.sims3pack
2014-08-03 22:05 - 2014-08-03 22:08 - 01016261 _____ (Thisisu) C:\Users\Carolin\Desktop\JRT.exe
2014-08-03 22:05 - 2014-08-03 22:04 - 01016261 _____ (Thisisu) C:\Users\Carolin\Downloads\JRT.exe
2014-08-03 21:55 - 2014-08-03 21:55 - 00004383 _____ () C:\Users\Carolin\Desktop\AdwCleaner[S0].txt
2014-08-03 21:54 - 2010-11-21 05:47 - 00518290 _____ () C:\Windows\PFRO.log
2014-08-03 21:53 - 2014-08-03 21:46 - 00000000 ____D () C:\AdwCleaner
2014-08-03 21:53 - 2013-11-17 19:33 - 00000000 ____D () C:\Users\Carolin
2014-08-03 21:53 - 2013-11-14 18:12 - 00001061 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Downloads\adwcleaner_3.302.exe
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Desktop\adwcleaner_3.302.exe
2014-08-03 21:43 - 2014-08-03 21:43 - 00060681 _____ () C:\Users\Carolin\Desktop\mbam.txt
2014-08-03 21:42 - 2014-04-18 18:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-03 21:06 - 2014-08-03 21:06 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-03 21:05 - 2014-08-03 21:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Carolin\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-03 07:57 - 2013-11-18 09:35 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Skype
2014-08-03 01:26 - 2013-11-18 12:27 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{FC49DE3F-D8F1-4471-A5A1-E3C1D3598505}
2014-08-02 23:34 - 2014-08-02 23:33 - 37880514 _____ () C:\Users\Carolin\Downloads\Classic White Villa.Sims3Pack
2014-08-02 23:33 - 2014-08-02 23:33 - 04727706 _____ () C:\Users\Carolin\Downloads\UlkerHairFashionista15_Adult.sims3pack
2014-08-02 23:33 - 2014-08-02 23:33 - 03199644 _____ () C:\Users\Carolin\Downloads\[ZaumaTSR] s3-hair042-Crush-f.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03634184 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 195.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03426481 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 195.sims3pack
2014-08-02 23:24 - 2014-08-02 23:24 - 12696805 _____ () C:\Users\Carolin\Downloads\Tinsely Villa.Sims3Pack
2014-08-02 23:24 - 2014-08-02 23:24 - 01147365 _____ () C:\Users\Carolin\Downloads\Sweet Summer Teen Dress-Mh75.sims3pack
2014-08-02 23:23 - 2014-08-02 23:23 - 00199697 _____ () C:\Users\Carolin\Downloads\fergiehairrs.sims3pack
2014-08-02 23:22 - 2014-08-02 23:22 - 01418161 _____ () C:\Users\Carolin\Downloads\1197438.zip
2014-08-02 23:21 - 2014-08-02 23:21 - 34748927 _____ () C:\Users\Carolin\Downloads\One Step Ahead.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 05956924 _____ () C:\Users\Carolin\Downloads\Windermere Cottage.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 00574196 _____ () C:\Users\Carolin\Downloads\1228532.zip
2014-08-02 23:20 - 2014-08-02 23:19 - 09270579 _____ () C:\Users\Carolin\Downloads\Rivendell Mill.Sims3Pack
2014-08-02 23:19 - 2014-08-02 23:19 - 03762268 _____ () C:\Users\Carolin\Downloads\1228756.zip
2014-08-02 23:19 - 2014-08-02 23:19 - 01613957 _____ () C:\Users\Carolin\Downloads\Maternity Outfit ~ Simple Provocation.sims3pack
2014-08-02 23:19 - 2014-08-02 23:18 - 04559284 _____ () C:\Users\Carolin\Downloads\Cleo_GradientDress_Full.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03220629 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-034-TSR Skysims3.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03005795 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-f.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05350468 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03b.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05174084 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03c.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 03001978 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-c.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 04240354 _____ () C:\Users\Carolin\Downloads\ulkerhair005.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 03339705 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J013-Labyrinth-f.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 00113854 _____ () C:\Users\Carolin\Downloads\MeshElenaTSRfloppyhat.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 04013960 _____ () C:\Users\Carolin\Downloads\1180785.zip
2014-08-02 23:15 - 2014-08-02 23:15 - 02974553 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 190.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02843071 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_child-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02759424 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02008649 _____ () C:\Users\Carolin\Downloads\Skysims3-f-adult-hat-001.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 01430900 _____ () C:\Users\Carolin\Downloads\Chelia Earrings - By Metens.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 00886080 _____ () C:\Users\Carolin\Downloads\NataliS Apples Childs earrings CF.sims3pack
2014-08-02 23:14 - 2014-08-02 23:14 - 02712595 _____ () C:\Users\Carolin\Downloads\by bukovka_am accessory glasses_dude.sims3pack
2014-08-02 22:58 - 2014-08-02 22:58 - 01061121 _____ () C:\Users\Carolin\Downloads\Metens - Country Song.sims3pack
2014-08-02 22:58 - 2014-08-02 22:56 - 29383248 _____ () C:\Users\Carolin\Downloads\The Lake Manor.Sims3Pack
2014-08-02 22:58 - 2014-08-02 22:56 - 29122458 _____ () C:\Users\Carolin\Downloads\The Old Homestead.Sims3Pack
2014-08-02 22:57 - 2014-08-02 22:56 - 18091923 _____ () C:\Users\Carolin\Downloads\Haus  Isla I.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:56 - 00861046 _____ () C:\Users\Carolin\Downloads\curbs cats eye glasses 02.sims3pack
2014-08-02 22:55 - 2014-08-02 22:55 - 07872196 _____ () C:\Users\Carolin\Downloads\1228932.zip
2014-08-02 22:54 - 2014-08-02 22:54 - 01473989 _____ () C:\Users\Carolin\Downloads\CharmingDress - Paogae.sims3pack
2014-08-02 22:50 - 2014-08-02 22:49 - 04080584 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles05v1.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 03307712 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles06.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 00668241 _____ () C:\Users\Carolin\Downloads\NataliS Diamond Engagement Ring 002 FA-FE.sims3pack
2014-08-02 21:59 - 2014-08-02 21:59 - 00018729 _____ () C:\Users\Carolin\Desktop\ComboFix.txt
2014-08-02 21:57 - 2014-08-02 21:57 - 00018729 _____ () C:\ComboFix.txt
2014-08-02 21:57 - 2014-08-02 21:47 - 00000000 ____D () C:\Qoobox
2014-08-02 21:55 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-02 21:47 - 2014-04-17 18:06 - 00000000 ____D () C:\Windows\erdnt
2014-08-02 21:44 - 2014-08-02 21:47 - 05566616 ____R (Swearware) C:\Users\Carolin\Desktop\ComboFix.exe
2014-08-02 21:44 - 2014-08-02 21:44 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix (1).exe
2014-08-02 21:44 - 2014-08-02 21:43 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix.exe
2014-08-02 20:51 - 2013-12-07 00:47 - 00000000 ____D () C:\Users\Carolin\AppData\Local\PokerStars.EU
2014-08-01 19:48 - 2014-08-01 19:48 - 00001264 _____ () C:\Users\Carolin\Desktop\Revo Uninstaller.lnk
2014-08-01 19:48 - 2014-08-01 19:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-01 19:47 - 2014-08-01 19:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Carolin\Downloads\revosetup95.exe
2014-08-01 01:08 - 2014-02-03 21:02 - 00000000 ____D () C:\ProgramData\Origin
2014-08-01 00:42 - 2013-12-07 00:46 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU
2014-08-01 00:35 - 2014-02-03 21:02 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-31 23:44 - 2014-07-31 23:44 - 00022657 _____ () C:\Users\Carolin\Downloads\Addition.txt
2014-07-31 23:44 - 2014-07-31 23:42 - 00041905 _____ () C:\Users\Carolin\Downloads\FRST.txt
2014-07-31 23:42 - 2014-07-31 23:41 - 02094080 _____ (Farbar) C:\Users\Carolin\Downloads\FRST64.exe
2014-07-25 11:44 - 2014-07-25 11:44 - 18665071 _____ () C:\Users\Carolin\Downloads\Victorian Cottage.Sims3Pack
2014-07-25 11:40 - 2014-07-25 11:37 - 51981640 _____ () C:\Users\Carolin\Downloads\The Moving Castle v14.Sims3Pack
2014-07-25 11:38 - 2014-07-25 11:37 - 04347284 _____ () C:\Users\Carolin\Downloads\Sweet Berry Victorian.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:36 - 01814550 _____ () C:\Users\Carolin\Downloads\MsBlue_BlueSummerVisor.sims3pack
2014-07-25 11:37 - 2014-07-25 11:36 - 01364717 _____ () C:\Users\Carolin\Downloads\Timebomb Earrings by LiKo.sims3pack
2014-07-25 11:31 - 2014-07-25 11:30 - 04854717 _____ () C:\Users\Carolin\Downloads\Cazy_c144_cf.sims3pack
2014-07-25 11:31 - 2014-07-25 11:29 - 06642495 _____ () C:\Users\Carolin\Downloads\Alesso_Candle.sims3pack
2014-07-25 11:31 - 2014-07-25 11:29 - 05372972 _____ () C:\Users\Carolin\Downloads\Cazy_c144_af.sims3pack
2014-07-25 11:30 - 2014-07-25 11:30 - 01506274 _____ () C:\Users\Carolin\Downloads\1063236.zip
2014-07-25 11:30 - 2014-07-25 11:29 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli (1).sims3pack
2014-07-25 11:30 - 2014-07-25 11:29 - 03269431 _____ () C:\Users\Carolin\Downloads\Skysims Hai Adult 223_H.sims3pack
2014-07-25 11:30 - 2014-07-25 11:28 - 06347701 _____ () C:\Users\Carolin\Downloads\Alesso_Candle_C.sims3pack
2014-07-25 11:30 - 2014-07-25 11:28 - 03890141 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 224.sims3pack
2014-07-25 11:29 - 2014-07-25 11:28 - 04328798 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles01v2.sims3pack
2014-07-25 11:29 - 2014-07-25 11:27 - 07326083 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AM_Hair07.sims3pack
2014-07-25 11:29 - 2014-07-25 11:27 - 03873739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 224.sims3pack
2014-07-25 11:28 - 2014-07-25 11:28 - 03846681 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02.sims3pack
2014-07-25 11:28 - 2014-07-25 11:27 - 04255285 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02v2.sims3pack
2014-07-25 11:28 - 2014-07-25 11:27 - 04231739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 225-F.sims3pack
2014-07-25 11:27 - 2014-07-25 11:27 - 07454063 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AF_Hair23.sims3pack
2014-07-25 11:27 - 2014-07-25 11:26 - 04046511 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles03v2.sims3pack
2014-07-24 23:26 - 2013-11-14 18:12 - 00001257 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-07-24 20:59 - 2014-07-24 20:59 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 18:32 - 2014-02-03 20:58 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-07-24 16:50 - 2014-07-24 16:50 - 00001270 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 16:49 - 2014-02-03 21:06 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-07-23 17:02 - 2013-11-14 18:15 - 00002247 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-23 17:01 - 2014-07-23 17:00 - 41171024 _____ (Google Inc.) C:\Users\Carolin\Downloads\ChromeStandaloneSetup-1985.125.exe
2014-07-23 11:28 - 2014-07-23 10:08 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 10:09 - 2014-07-23 10:09 - 00000000 _____ () C:\autoexec.bat
2014-07-23 10:08 - 2014-07-23 10:08 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-23 09:53 - 2014-07-23 09:53 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Carolin\Downloads\SpyHunter-installer.exe
2014-07-22 23:02 - 2014-06-04 15:38 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1397054888
2014-07-22 23:02 - 2014-04-09 16:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-07-22 20:36 - 2014-07-22 20:36 - 00003154 _____ () C:\Windows\System32\Tasks\{CBA561BE-606A-4785-8DED-559920E59AFA}
2014-07-22 20:30 - 2014-07-22 20:30 - 00001817 _____ () C:\Users\Carolin\Desktop\Angry_Birds.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Angry_Birds
2014-07-20 15:22 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-17 21:34 - 2014-03-28 22:02 - 00000000 ____D () C:\Users\postgres
2014-07-17 14:09 - 2013-11-16 11:54 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-15 11:41 - 2014-07-15 11:41 - 00000000 ____D () C:\found.000
2014-07-13 18:25 - 2014-07-13 18:25 - 02874307 _____ () C:\Users\Carolin\Downloads\963161.zip
2014-07-11 10:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 18:32 - 2009-07-14 06:45 - 00405280 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 18:30 - 2014-05-06 18:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 18:30 - 2010-11-21 09:16 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 18:14 - 2013-11-16 15:04 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 18:11 - 2013-11-13 19:36 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 18:09 - 2013-11-13 19:36 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 13:58 - 2014-03-28 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-10 13:57 - 2013-11-16 11:43 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-10 13:57 - 2013-11-16 11:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 16:36 - 2014-07-09 16:36 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli.sims3pack
2014-07-09 16:36 - 2014-07-09 16:36 - 04606727 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli_C.sims3pack
2014-07-06 23:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-05 11:38 - 2013-11-14 03:32 - 00699342 _____ () C:\Windows\system32\perfh007.dat
2014-07-05 11:38 - 2013-11-14 03:32 - 00149450 _____ () C:\Windows\system32\perfc007.dat
2014-07-05 11:38 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-04 21:32 - 2014-01-05 23:29 - 00000000 ____D () C:\Windows\System32\Tasks\Games

Some content of TEMP:
====================
C:\Users\Carolin\AppData\Local\Temp\avgnt.exe
C:\Users\Carolin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-01 16:49

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 04.08.2014, 15:56

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Carolin.Abär · 05.08.2014, 22:01

Hallo,

hier sind das FRST, ESET und Security Scan.

MfG,

Carolin S.

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Carolin (administrator) on GUTEMINE on 05-08-2014 22:55:10
Running from C:\Users\Carolin\Desktop\Trojanerboard
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-999138141-1912988859-3756178019-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2B35845349E4CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Carolin\AppData\Roaming\Mozilla\Firefox\Profiles\1sjrbwez.default
FF NewTab: chrome://quick_start/content/index.html
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/"
CHR Extension: (ProxFlow) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-05-31]
CHR Extension: (Google Docs) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-17]
CHR Extension: (Google Drive) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-17]
CHR Extension: (YouTube) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-17]
CHR Extension: (Adblock Plus) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-18]
CHR Extension: (Google-Suche) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-17]
CHR Extension: (Google Wallet) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-17]
CHR Extension: (Google Mail) - C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 postgresql-8.4; c:\postgreSQL\bin\pg_ctl.exe [66048 2014-02-18] (PostgreSQL Global Development Group) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-03] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37760 2007-04-25] (SMSC)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 22:54 - 2014-08-05 22:54 - 00000000 ___SD () C:\ComboFix
2014-08-05 22:53 - 2014-08-05 22:53 - 00000875 _____ () C:\Users\Carolin\Desktop\checkup.txt
2014-08-05 22:50 - 2014-08-05 22:51 - 00854410 _____ () C:\Users\Carolin\Downloads\SecurityCheck.exe
2014-08-05 19:24 - 2014-08-05 19:24 - 29081246 _____ () C:\Users\Carolin\Downloads\Guardgian and Jindann - Mayang.Sims3Pack
2014-08-05 19:24 - 2014-08-05 19:24 - 00180249 _____ () C:\Users\Carolin\Downloads\Pilar_BistrotClockDeco.sims3pack
2014-08-05 19:23 - 2014-08-05 19:24 - 00321868 _____ () C:\Users\Carolin\Downloads\Pilar_BistrotDecoWall.sims3pack
2014-08-05 19:23 - 2014-08-05 19:23 - 00243382 _____ () C:\Users\Carolin\Downloads\SIMc-TSR-BathCharms-MakeupBrush.sims3pack
2014-08-05 19:23 - 2014-08-05 19:23 - 00097345 _____ () C:\Users\Carolin\Downloads\SIMc-TSR-BathCharms-HairBrushes.sims3pack
2014-08-05 19:18 - 2014-08-05 19:18 - 00756204 _____ () C:\Users\Carolin\Downloads\BS_Kilox Relax Livingchair.sims3pack
2014-08-05 19:17 - 2014-08-05 19:17 - 01272967 _____ () C:\Users\Carolin\Downloads\Les Fleurs-Mh75.sims3pack
2014-08-05 19:17 - 2014-08-05 19:17 - 00544050 _____ () C:\Users\Carolin\Downloads\BS_Kilox Relax Flower Arrangement.sims3pack
2014-08-05 19:17 - 2014-08-05 19:17 - 00511554 _____ () C:\Users\Carolin\Downloads\BS_Kilox Relax Plate w Rose.sims3pack
2014-08-05 19:16 - 2014-08-05 19:17 - 14813719 _____ () C:\Users\Carolin\Downloads\1148337.zip
2014-08-05 19:14 - 2014-08-05 19:16 - 61976596 _____ () C:\Users\Carolin\Downloads\Anshin.Sims3Pack
2014-08-05 19:14 - 2014-08-05 19:14 - 04287472 _____ () C:\Users\Carolin\Downloads\curbs retro hairstyles08.sims3pack
2014-08-05 19:14 - 2014-08-05 19:14 - 00405380 _____ () C:\Users\Carolin\Downloads\TwS3_earrings10_TF - EF.sims3pack
2014-08-05 19:13 - 2014-08-05 19:13 - 04264815 _____ () C:\Users\Carolin\Downloads\coloresurbanos hairstyles09.sims3pack
2014-08-05 19:11 - 2014-08-05 19:12 - 06478505 _____ () C:\Users\Carolin\Downloads\953034.zip
2014-08-05 19:11 - 2014-08-05 19:11 - 01742192 _____ () C:\Users\Carolin\Downloads\1095179 (1).zip
2014-08-05 18:38 - 2014-08-05 18:38 - 02347384 _____ (ESET) C:\Users\Carolin\Downloads\esetsmartinstaller_deu.exe
2014-08-03 22:15 - 2014-08-03 22:15 - 00000623 _____ () C:\Users\Carolin\Desktop\JRT.txt
2014-08-03 22:08 - 2014-08-03 22:05 - 01016261 _____ (Thisisu) C:\Users\Carolin\Desktop\JRT.exe
2014-08-03 22:07 - 2014-08-03 22:08 - 04557995 _____ () C:\Users\Carolin\Downloads\Cazy_c151_af.sims3pack
2014-08-03 22:04 - 2014-08-03 22:05 - 01016261 _____ (Thisisu) C:\Users\Carolin\Downloads\JRT.exe
2014-08-03 21:55 - 2014-08-03 21:55 - 00004383 _____ () C:\Users\Carolin\Desktop\AdwCleaner[S0].txt
2014-08-03 21:46 - 2014-08-03 21:53 - 00000000 ____D () C:\AdwCleaner
2014-08-03 21:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Downloads\adwcleaner_3.302.exe
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Desktop\adwcleaner_3.302.exe
2014-08-03 21:43 - 2014-08-03 21:43 - 00060681 _____ () C:\Users\Carolin\Desktop\mbam.txt
2014-08-03 21:06 - 2014-08-03 21:06 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-03 21:06 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-03 21:06 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-03 21:06 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-03 21:05 - 2014-08-03 21:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Carolin\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-02 23:33 - 2014-08-02 23:34 - 37880514 _____ () C:\Users\Carolin\Downloads\Classic White Villa.Sims3Pack
2014-08-02 23:33 - 2014-08-02 23:33 - 04727706 _____ () C:\Users\Carolin\Downloads\UlkerHairFashionista15_Adult.sims3pack
2014-08-02 23:33 - 2014-08-02 23:33 - 03199644 _____ () C:\Users\Carolin\Downloads\[ZaumaTSR] s3-hair042-Crush-f.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03634184 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 195.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03426481 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 195.sims3pack
2014-08-02 23:24 - 2014-08-02 23:24 - 12696805 _____ () C:\Users\Carolin\Downloads\Tinsely Villa.Sims3Pack
2014-08-02 23:24 - 2014-08-02 23:24 - 01147365 _____ () C:\Users\Carolin\Downloads\Sweet Summer Teen Dress-Mh75.sims3pack
2014-08-02 23:23 - 2014-08-02 23:23 - 00199697 _____ () C:\Users\Carolin\Downloads\fergiehairrs.sims3pack
2014-08-02 23:22 - 2014-08-02 23:22 - 01418161 _____ () C:\Users\Carolin\Downloads\1197438.zip
2014-08-02 23:21 - 2014-08-02 23:21 - 34748927 _____ () C:\Users\Carolin\Downloads\One Step Ahead.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 05956924 _____ () C:\Users\Carolin\Downloads\Windermere Cottage.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 00574196 _____ () C:\Users\Carolin\Downloads\1228532.zip
2014-08-02 23:19 - 2014-08-02 23:20 - 09270579 _____ () C:\Users\Carolin\Downloads\Rivendell Mill.Sims3Pack
2014-08-02 23:19 - 2014-08-02 23:19 - 03762268 _____ () C:\Users\Carolin\Downloads\1228756.zip
2014-08-02 23:19 - 2014-08-02 23:19 - 01613957 _____ () C:\Users\Carolin\Downloads\Maternity Outfit ~ Simple Provocation.sims3pack
2014-08-02 23:18 - 2014-08-02 23:19 - 04559284 _____ () C:\Users\Carolin\Downloads\Cleo_GradientDress_Full.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03220629 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-034-TSR Skysims3.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03005795 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-f.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05350468 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03b.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05174084 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03c.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 03001978 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-c.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 04240354 _____ () C:\Users\Carolin\Downloads\ulkerhair005.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 03339705 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J013-Labyrinth-f.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 00113854 _____ () C:\Users\Carolin\Downloads\MeshElenaTSRfloppyhat.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 04013960 _____ () C:\Users\Carolin\Downloads\1180785.zip
2014-08-02 23:15 - 2014-08-02 23:15 - 02974553 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 190.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02843071 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_child-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02759424 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02008649 _____ () C:\Users\Carolin\Downloads\Skysims3-f-adult-hat-001.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 01430900 _____ () C:\Users\Carolin\Downloads\Chelia Earrings - By Metens.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 00886080 _____ () C:\Users\Carolin\Downloads\NataliS Apples Childs earrings CF.sims3pack
2014-08-02 23:14 - 2014-08-02 23:14 - 02712595 _____ () C:\Users\Carolin\Downloads\by bukovka_am accessory glasses_dude.sims3pack
2014-08-02 22:58 - 2014-08-02 22:58 - 01061121 _____ () C:\Users\Carolin\Downloads\Metens - Country Song.sims3pack
2014-08-02 22:56 - 2014-08-02 22:58 - 29383248 _____ () C:\Users\Carolin\Downloads\The Lake Manor.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:58 - 29122458 _____ () C:\Users\Carolin\Downloads\The Old Homestead.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:57 - 18091923 _____ () C:\Users\Carolin\Downloads\Haus  Isla I.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:56 - 00861046 _____ () C:\Users\Carolin\Downloads\curbs cats eye glasses 02.sims3pack
2014-08-02 22:55 - 2014-08-02 22:55 - 07872196 _____ () C:\Users\Carolin\Downloads\1228932.zip
2014-08-02 22:54 - 2014-08-02 22:54 - 01473989 _____ () C:\Users\Carolin\Downloads\CharmingDress - Paogae.sims3pack
2014-08-02 22:49 - 2014-08-02 22:50 - 04080584 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles05v1.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 03307712 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles06.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 00668241 _____ () C:\Users\Carolin\Downloads\NataliS Diamond Engagement Ring 002 FA-FE.sims3pack
2014-08-02 21:59 - 2014-08-02 21:59 - 00018729 _____ () C:\Users\Carolin\Desktop\ComboFix.txt
2014-08-02 21:57 - 2014-08-02 21:57 - 00018729 _____ () C:\ComboFix.txt
2014-08-02 21:47 - 2014-08-05 22:54 - 00000000 ____D () C:\Qoobox
2014-08-02 21:47 - 2014-08-02 21:44 - 05566616 ____R (Swearware) C:\Users\Carolin\Desktop\ComboFix.exe
2014-08-02 21:47 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-02 21:47 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-02 21:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-02 21:47 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-02 21:44 - 2014-08-02 21:44 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix (1).exe
2014-08-02 21:43 - 2014-08-02 21:44 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix.exe
2014-08-01 19:48 - 2014-08-01 19:48 - 00001264 _____ () C:\Users\Carolin\Desktop\Revo Uninstaller.lnk
2014-08-01 19:48 - 2014-08-01 19:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-01 19:47 - 2014-08-01 19:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Carolin\Downloads\revosetup95.exe
2014-07-31 23:44 - 2014-07-31 23:44 - 00022657 _____ () C:\Users\Carolin\Downloads\Addition.txt
2014-07-31 23:42 - 2014-08-05 22:55 - 00000000 ____D () C:\FRST
2014-07-31 23:42 - 2014-07-31 23:44 - 00041905 _____ () C:\Users\Carolin\Downloads\FRST.txt
2014-07-31 23:41 - 2014-07-31 23:42 - 02094080 _____ (Farbar) C:\Users\Carolin\Downloads\FRST64.exe
2014-07-25 11:44 - 2014-07-25 11:44 - 18665071 _____ () C:\Users\Carolin\Downloads\Victorian Cottage.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:40 - 51981640 _____ () C:\Users\Carolin\Downloads\The Moving Castle v14.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:38 - 04347284 _____ () C:\Users\Carolin\Downloads\Sweet Berry Victorian.Sims3Pack
2014-07-25 11:36 - 2014-07-25 11:37 - 01814550 _____ () C:\Users\Carolin\Downloads\MsBlue_BlueSummerVisor.sims3pack
2014-07-25 11:36 - 2014-07-25 11:37 - 01364717 _____ () C:\Users\Carolin\Downloads\Timebomb Earrings by LiKo.sims3pack
2014-07-25 11:30 - 2014-07-25 11:31 - 04854717 _____ () C:\Users\Carolin\Downloads\Cazy_c144_cf.sims3pack
2014-07-25 11:30 - 2014-07-25 11:30 - 01506274 _____ () C:\Users\Carolin\Downloads\1063236.zip
2014-07-25 11:29 - 2014-07-25 11:31 - 06642495 _____ () C:\Users\Carolin\Downloads\Alesso_Candle.sims3pack
2014-07-25 11:29 - 2014-07-25 11:31 - 05372972 _____ () C:\Users\Carolin\Downloads\Cazy_c144_af.sims3pack
2014-07-25 11:29 - 2014-07-25 11:30 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli (1).sims3pack
2014-07-25 11:29 - 2014-07-25 11:30 - 03269431 _____ () C:\Users\Carolin\Downloads\Skysims Hai Adult 223_H.sims3pack
2014-07-25 11:28 - 2014-07-25 11:30 - 06347701 _____ () C:\Users\Carolin\Downloads\Alesso_Candle_C.sims3pack
2014-07-25 11:28 - 2014-07-25 11:30 - 03890141 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 224.sims3pack
2014-07-25 11:28 - 2014-07-25 11:29 - 04328798 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles01v2.sims3pack
2014-07-25 11:28 - 2014-07-25 11:28 - 03846681 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02.sims3pack
2014-07-25 11:27 - 2014-07-25 11:29 - 07326083 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AM_Hair07.sims3pack
2014-07-25 11:27 - 2014-07-25 11:29 - 03873739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 224.sims3pack
2014-07-25 11:27 - 2014-07-25 11:28 - 04255285 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02v2.sims3pack
2014-07-25 11:27 - 2014-07-25 11:28 - 04231739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 225-F.sims3pack
2014-07-25 11:27 - 2014-07-25 11:27 - 07454063 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AF_Hair23.sims3pack
2014-07-25 11:26 - 2014-07-25 11:27 - 04046511 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles03v2.sims3pack
2014-07-24 20:59 - 2014-07-24 20:59 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 16:50 - 2014-07-24 16:50 - 00001270 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-23 17:00 - 2014-07-23 17:01 - 41171024 _____ (Google Inc.) C:\Users\Carolin\Downloads\ChromeStandaloneSetup-1985.125.exe
2014-07-23 10:09 - 2014-07-23 10:09 - 00000000 _____ () C:\autoexec.bat
2014-07-23 10:08 - 2014-07-23 11:28 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 10:08 - 2014-07-23 10:08 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-23 09:53 - 2014-07-23 09:53 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Carolin\Downloads\SpyHunter-installer.exe
2014-07-22 20:36 - 2014-07-22 20:36 - 00003154 _____ () C:\Windows\System32\Tasks\{CBA561BE-606A-4785-8DED-559920E59AFA}
2014-07-22 20:30 - 2014-07-22 20:30 - 00001817 _____ () C:\Users\Carolin\Desktop\Angry_Birds.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Angry_Birds
2014-07-15 11:41 - 2014-07-15 11:41 - 00000000 ____D () C:\found.000
2014-07-13 18:25 - 2014-07-13 18:25 - 02874307 _____ () C:\Users\Carolin\Downloads\963161.zip
2014-07-10 14:01 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 14:01 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 14:01 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 14:01 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 14:01 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 14:01 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 14:01 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 14:01 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 14:01 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 14:01 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 14:01 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 14:01 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 14:01 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 14:01 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 14:01 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 14:01 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 14:01 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 14:01 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 14:01 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 14:01 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 14:01 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 14:01 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 14:01 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 14:01 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 14:01 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 14:01 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 14:01 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 14:01 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 14:01 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 14:01 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 14:01 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 14:01 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 14:01 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 14:01 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 14:01 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 14:01 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 14:01 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 14:01 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 14:01 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 14:01 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 14:01 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 14:01 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 14:01 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 14:01 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 14:01 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 14:01 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 14:01 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 14:01 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 14:01 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 14:01 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 14:01 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 14:01 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 14:01 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 14:01 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 14:00 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 14:00 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 14:00 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 14:00 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 14:00 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 14:00 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 14:00 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 14:00 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 14:00 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 14:00 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 14:00 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 14:00 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 13:59 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 13:59 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 13:59 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 16:36 - 2014-07-09 16:36 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli.sims3pack
2014-07-09 16:36 - 2014-07-09 16:36 - 04606727 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli_C.sims3pack

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 22:55 - 2014-07-31 23:42 - 00000000 ____D () C:\FRST
2014-08-05 22:55 - 2014-04-18 19:54 - 00000000 ____D () C:\Users\Carolin\Desktop\Trojanerboard
2014-08-05 22:54 - 2014-08-05 22:54 - 00000000 ___SD () C:\ComboFix
2014-08-05 22:54 - 2014-08-02 21:47 - 00000000 ____D () C:\Qoobox
2014-08-05 22:53 - 2014-08-05 22:53 - 00000875 _____ () C:\Users\Carolin\Desktop\checkup.txt
2014-08-05 22:51 - 2014-08-05 22:50 - 00854410 _____ () C:\Users\Carolin\Downloads\SecurityCheck.exe
2014-08-05 22:36 - 2014-03-28 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-05 22:36 - 2013-11-18 09:35 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Skype
2014-08-05 22:36 - 2013-11-14 18:14 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-05 22:36 - 2013-11-13 18:37 - 01302171 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 19:24 - 2014-08-05 19:24 - 29081246 _____ () C:\Users\Carolin\Downloads\Guardgian and Jindann - Mayang.Sims3Pack
2014-08-05 19:24 - 2014-08-05 19:24 - 00180249 _____ () C:\Users\Carolin\Downloads\Pilar_BistrotClockDeco.sims3pack
2014-08-05 19:24 - 2014-08-05 19:23 - 00321868 _____ () C:\Users\Carolin\Downloads\Pilar_BistrotDecoWall.sims3pack
2014-08-05 19:23 - 2014-08-05 19:23 - 00243382 _____ () C:\Users\Carolin\Downloads\SIMc-TSR-BathCharms-MakeupBrush.sims3pack
2014-08-05 19:23 - 2014-08-05 19:23 - 00097345 _____ () C:\Users\Carolin\Downloads\SIMc-TSR-BathCharms-HairBrushes.sims3pack
2014-08-05 19:18 - 2014-08-05 19:18 - 00756204 _____ () C:\Users\Carolin\Downloads\BS_Kilox Relax Livingchair.sims3pack
2014-08-05 19:17 - 2014-08-05 19:17 - 01272967 _____ () C:\Users\Carolin\Downloads\Les Fleurs-Mh75.sims3pack
2014-08-05 19:17 - 2014-08-05 19:17 - 00544050 _____ () C:\Users\Carolin\Downloads\BS_Kilox Relax Flower Arrangement.sims3pack
2014-08-05 19:17 - 2014-08-05 19:17 - 00511554 _____ () C:\Users\Carolin\Downloads\BS_Kilox Relax Plate w Rose.sims3pack
2014-08-05 19:17 - 2014-08-05 19:16 - 14813719 _____ () C:\Users\Carolin\Downloads\1148337.zip
2014-08-05 19:16 - 2014-08-05 19:14 - 61976596 _____ () C:\Users\Carolin\Downloads\Anshin.Sims3Pack
2014-08-05 19:14 - 2014-08-05 19:14 - 04287472 _____ () C:\Users\Carolin\Downloads\curbs retro hairstyles08.sims3pack
2014-08-05 19:14 - 2014-08-05 19:14 - 00405380 _____ () C:\Users\Carolin\Downloads\TwS3_earrings10_TF - EF.sims3pack
2014-08-05 19:13 - 2014-08-05 19:13 - 04264815 _____ () C:\Users\Carolin\Downloads\coloresurbanos hairstyles09.sims3pack
2014-08-05 19:12 - 2014-08-05 19:11 - 06478505 _____ () C:\Users\Carolin\Downloads\953034.zip
2014-08-05 19:11 - 2014-08-05 19:11 - 01742192 _____ () C:\Users\Carolin\Downloads\1095179 (1).zip
2014-08-05 18:38 - 2014-08-05 18:38 - 02347384 _____ (ESET) C:\Users\Carolin\Downloads\esetsmartinstaller_deu.exe
2014-08-05 14:02 - 2013-11-14 18:14 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-04 14:13 - 2009-07-14 06:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-04 14:13 - 2009-07-14 06:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-04 14:04 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-04 14:03 - 2009-07-14 06:51 - 00050429 _____ () C:\Windows\setupact.log
2014-08-04 10:14 - 2013-11-18 12:27 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{FC49DE3F-D8F1-4471-A5A1-E3C1D3598505}
2014-08-04 10:00 - 2013-12-07 00:47 - 00000000 ____D () C:\Users\Carolin\AppData\Local\PokerStars.EU
2014-08-03 22:15 - 2014-08-03 22:15 - 00000623 _____ () C:\Users\Carolin\Desktop\JRT.txt
2014-08-03 22:08 - 2014-08-03 22:07 - 04557995 _____ () C:\Users\Carolin\Downloads\Cazy_c151_af.sims3pack
2014-08-03 22:05 - 2014-08-03 22:08 - 01016261 _____ (Thisisu) C:\Users\Carolin\Desktop\JRT.exe
2014-08-03 22:05 - 2014-08-03 22:04 - 01016261 _____ (Thisisu) C:\Users\Carolin\Downloads\JRT.exe
2014-08-03 21:55 - 2014-08-03 21:55 - 00004383 _____ () C:\Users\Carolin\Desktop\AdwCleaner[S0].txt
2014-08-03 21:54 - 2010-11-21 05:47 - 00518290 _____ () C:\Windows\PFRO.log
2014-08-03 21:53 - 2014-08-03 21:46 - 00000000 ____D () C:\AdwCleaner
2014-08-03 21:53 - 2013-11-17 19:33 - 00000000 ____D () C:\Users\Carolin
2014-08-03 21:53 - 2013-11-14 18:12 - 00001061 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Downloads\adwcleaner_3.302.exe
2014-08-03 21:45 - 2014-08-03 21:45 - 01361309 _____ () C:\Users\Carolin\Desktop\adwcleaner_3.302.exe
2014-08-03 21:43 - 2014-08-03 21:43 - 00060681 _____ () C:\Users\Carolin\Desktop\mbam.txt
2014-08-03 21:42 - 2014-04-18 18:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-03 21:06 - 2014-08-03 21:06 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-03 21:06 - 2014-08-03 21:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-03 21:05 - 2014-08-03 21:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Carolin\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-02 23:34 - 2014-08-02 23:33 - 37880514 _____ () C:\Users\Carolin\Downloads\Classic White Villa.Sims3Pack
2014-08-02 23:33 - 2014-08-02 23:33 - 04727706 _____ () C:\Users\Carolin\Downloads\UlkerHairFashionista15_Adult.sims3pack
2014-08-02 23:33 - 2014-08-02 23:33 - 03199644 _____ () C:\Users\Carolin\Downloads\[ZaumaTSR] s3-hair042-Crush-f.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03634184 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 195.sims3pack
2014-08-02 23:32 - 2014-08-02 23:32 - 03426481 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 195.sims3pack
2014-08-02 23:24 - 2014-08-02 23:24 - 12696805 _____ () C:\Users\Carolin\Downloads\Tinsely Villa.Sims3Pack
2014-08-02 23:24 - 2014-08-02 23:24 - 01147365 _____ () C:\Users\Carolin\Downloads\Sweet Summer Teen Dress-Mh75.sims3pack
2014-08-02 23:23 - 2014-08-02 23:23 - 00199697 _____ () C:\Users\Carolin\Downloads\fergiehairrs.sims3pack
2014-08-02 23:22 - 2014-08-02 23:22 - 01418161 _____ () C:\Users\Carolin\Downloads\1197438.zip
2014-08-02 23:21 - 2014-08-02 23:21 - 34748927 _____ () C:\Users\Carolin\Downloads\One Step Ahead.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 05956924 _____ () C:\Users\Carolin\Downloads\Windermere Cottage.Sims3Pack
2014-08-02 23:20 - 2014-08-02 23:20 - 00574196 _____ () C:\Users\Carolin\Downloads\1228532.zip
2014-08-02 23:20 - 2014-08-02 23:19 - 09270579 _____ () C:\Users\Carolin\Downloads\Rivendell Mill.Sims3Pack
2014-08-02 23:19 - 2014-08-02 23:19 - 03762268 _____ () C:\Users\Carolin\Downloads\1228756.zip
2014-08-02 23:19 - 2014-08-02 23:19 - 01613957 _____ () C:\Users\Carolin\Downloads\Maternity Outfit ~ Simple Provocation.sims3pack
2014-08-02 23:19 - 2014-08-02 23:18 - 04559284 _____ () C:\Users\Carolin\Downloads\Cleo_GradientDress_Full.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03220629 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-034-TSR Skysims3.sims3pack
2014-08-02 23:18 - 2014-08-02 23:18 - 03005795 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-f.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05350468 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03b.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 05174084 _____ () C:\Users\Carolin\Downloads\Tehmango_HairMesh03c.sims3pack
2014-08-02 23:17 - 2014-08-02 23:17 - 03001978 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J058-BabyFace-c.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 04240354 _____ () C:\Users\Carolin\Downloads\ulkerhair005.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 03339705 _____ () C:\Users\Carolin\Downloads\NewSea-SIMS3-hair-J013-Labyrinth-f.sims3pack
2014-08-02 23:16 - 2014-08-02 23:16 - 00113854 _____ () C:\Users\Carolin\Downloads\MeshElenaTSRfloppyhat.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 04013960 _____ () C:\Users\Carolin\Downloads\1180785.zip
2014-08-02 23:15 - 2014-08-02 23:15 - 02974553 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 190.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02843071 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_child-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02759424 _____ () C:\Users\Carolin\Downloads\Hairstyle_F_adult-174-TSR Skysims3.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 02008649 _____ () C:\Users\Carolin\Downloads\Skysims3-f-adult-hat-001.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 01430900 _____ () C:\Users\Carolin\Downloads\Chelia Earrings - By Metens.sims3pack
2014-08-02 23:15 - 2014-08-02 23:15 - 00886080 _____ () C:\Users\Carolin\Downloads\NataliS Apples Childs earrings CF.sims3pack
2014-08-02 23:14 - 2014-08-02 23:14 - 02712595 _____ () C:\Users\Carolin\Downloads\by bukovka_am accessory glasses_dude.sims3pack
2014-08-02 22:58 - 2014-08-02 22:58 - 01061121 _____ () C:\Users\Carolin\Downloads\Metens - Country Song.sims3pack
2014-08-02 22:58 - 2014-08-02 22:56 - 29383248 _____ () C:\Users\Carolin\Downloads\The Lake Manor.Sims3Pack
2014-08-02 22:58 - 2014-08-02 22:56 - 29122458 _____ () C:\Users\Carolin\Downloads\The Old Homestead.Sims3Pack
2014-08-02 22:57 - 2014-08-02 22:56 - 18091923 _____ () C:\Users\Carolin\Downloads\Haus  Isla I.Sims3Pack
2014-08-02 22:56 - 2014-08-02 22:56 - 00861046 _____ () C:\Users\Carolin\Downloads\curbs cats eye glasses 02.sims3pack
2014-08-02 22:55 - 2014-08-02 22:55 - 07872196 _____ () C:\Users\Carolin\Downloads\1228932.zip
2014-08-02 22:54 - 2014-08-02 22:54 - 01473989 _____ () C:\Users\Carolin\Downloads\CharmingDress - Paogae.sims3pack
2014-08-02 22:50 - 2014-08-02 22:49 - 04080584 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles05v1.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 03307712 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles06.sims3pack
2014-08-02 22:49 - 2014-08-02 22:49 - 00668241 _____ () C:\Users\Carolin\Downloads\NataliS Diamond Engagement Ring 002 FA-FE.sims3pack
2014-08-02 21:59 - 2014-08-02 21:59 - 00018729 _____ () C:\Users\Carolin\Desktop\ComboFix.txt
2014-08-02 21:57 - 2014-08-02 21:57 - 00018729 _____ () C:\ComboFix.txt
2014-08-02 21:55 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-02 21:47 - 2014-04-17 18:06 - 00000000 ____D () C:\Windows\erdnt
2014-08-02 21:44 - 2014-08-02 21:47 - 05566616 ____R (Swearware) C:\Users\Carolin\Desktop\ComboFix.exe
2014-08-02 21:44 - 2014-08-02 21:44 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix (1).exe
2014-08-02 21:44 - 2014-08-02 21:43 - 05566616 _____ (Swearware) C:\Users\Carolin\Downloads\ComboFix.exe
2014-08-01 19:48 - 2014-08-01 19:48 - 00001264 _____ () C:\Users\Carolin\Desktop\Revo Uninstaller.lnk
2014-08-01 19:48 - 2014-08-01 19:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-01 19:47 - 2014-08-01 19:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Carolin\Downloads\revosetup95.exe
2014-08-01 01:08 - 2014-02-03 21:02 - 00000000 ____D () C:\ProgramData\Origin
2014-08-01 00:42 - 2013-12-07 00:46 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU
2014-08-01 00:35 - 2014-02-03 21:02 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-31 23:44 - 2014-07-31 23:44 - 00022657 _____ () C:\Users\Carolin\Downloads\Addition.txt
2014-07-31 23:44 - 2014-07-31 23:42 - 00041905 _____ () C:\Users\Carolin\Downloads\FRST.txt
2014-07-31 23:42 - 2014-07-31 23:41 - 02094080 _____ (Farbar) C:\Users\Carolin\Downloads\FRST64.exe
2014-07-25 11:44 - 2014-07-25 11:44 - 18665071 _____ () C:\Users\Carolin\Downloads\Victorian Cottage.Sims3Pack
2014-07-25 11:40 - 2014-07-25 11:37 - 51981640 _____ () C:\Users\Carolin\Downloads\The Moving Castle v14.Sims3Pack
2014-07-25 11:38 - 2014-07-25 11:37 - 04347284 _____ () C:\Users\Carolin\Downloads\Sweet Berry Victorian.Sims3Pack
2014-07-25 11:37 - 2014-07-25 11:36 - 01814550 _____ () C:\Users\Carolin\Downloads\MsBlue_BlueSummerVisor.sims3pack
2014-07-25 11:37 - 2014-07-25 11:36 - 01364717 _____ () C:\Users\Carolin\Downloads\Timebomb Earrings by LiKo.sims3pack
2014-07-25 11:31 - 2014-07-25 11:30 - 04854717 _____ () C:\Users\Carolin\Downloads\Cazy_c144_cf.sims3pack
2014-07-25 11:31 - 2014-07-25 11:29 - 06642495 _____ () C:\Users\Carolin\Downloads\Alesso_Candle.sims3pack
2014-07-25 11:31 - 2014-07-25 11:29 - 05372972 _____ () C:\Users\Carolin\Downloads\Cazy_c144_af.sims3pack
2014-07-25 11:30 - 2014-07-25 11:30 - 01506274 _____ () C:\Users\Carolin\Downloads\1063236.zip
2014-07-25 11:30 - 2014-07-25 11:29 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli (1).sims3pack
2014-07-25 11:30 - 2014-07-25 11:29 - 03269431 _____ () C:\Users\Carolin\Downloads\Skysims Hai Adult 223_H.sims3pack
2014-07-25 11:30 - 2014-07-25 11:28 - 06347701 _____ () C:\Users\Carolin\Downloads\Alesso_Candle_C.sims3pack
2014-07-25 11:30 - 2014-07-25 11:28 - 03890141 _____ () C:\Users\Carolin\Downloads\Skysims Hair Child 224.sims3pack
2014-07-25 11:29 - 2014-07-25 11:28 - 04328798 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles01v2.sims3pack
2014-07-25 11:29 - 2014-07-25 11:27 - 07326083 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AM_Hair07.sims3pack
2014-07-25 11:29 - 2014-07-25 11:27 - 03873739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 224.sims3pack
2014-07-25 11:28 - 2014-07-25 11:28 - 03846681 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02.sims3pack
2014-07-25 11:28 - 2014-07-25 11:27 - 04255285 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles02v2.sims3pack
2014-07-25 11:28 - 2014-07-25 11:27 - 04231739 _____ () C:\Users\Carolin\Downloads\Skysims Hair Adult 225-F.sims3pack
2014-07-25 11:27 - 2014-07-25 11:27 - 07454063 _____ () C:\Users\Carolin\Downloads\Nightcrawler_AF_Hair23.sims3pack
2014-07-25 11:27 - 2014-07-25 11:26 - 04046511 _____ () C:\Users\Carolin\Downloads\coloresurbanos50s hairstyles03v2.sims3pack
2014-07-24 23:26 - 2013-11-14 18:12 - 00001257 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-07-24 20:59 - 2014-07-24 20:59 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Need for Speed World
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Carolin\AppData\Local\Electronic_Arts_Inc
2014-07-24 18:32 - 2014-02-03 20:58 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-07-24 16:50 - 2014-07-24 16:50 - 00001270 _____ () C:\Users\Public\Desktop\Need for Speed World.lnk
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed World
2014-07-24 16:50 - 2014-07-24 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 16:49 - 2014-02-03 21:06 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-07-23 17:02 - 2013-11-14 18:15 - 00002247 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-23 17:01 - 2014-07-23 17:00 - 41171024 _____ (Google Inc.) C:\Users\Carolin\Downloads\ChromeStandaloneSetup-1985.125.exe
2014-07-23 11:28 - 2014-07-23 10:08 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-07-23 10:09 - 2014-07-23 10:09 - 00000000 _____ () C:\autoexec.bat
2014-07-23 10:08 - 2014-07-23 10:08 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-23 09:53 - 2014-07-23 09:53 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Carolin\Downloads\SpyHunter-installer.exe
2014-07-22 23:02 - 2014-06-04 15:38 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1397054888
2014-07-22 23:02 - 2014-04-09 16:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-07-22 20:36 - 2014-07-22 20:36 - 00003154 _____ () C:\Windows\System32\Tasks\{CBA561BE-606A-4785-8DED-559920E59AFA}
2014-07-22 20:30 - 2014-07-22 20:30 - 00001817 _____ () C:\Users\Carolin\Desktop\Angry_Birds.lnk
2014-07-22 20:30 - 2014-07-22 20:30 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Angry_Birds
2014-07-20 15:22 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-17 21:34 - 2014-03-28 22:02 - 00000000 ____D () C:\Users\postgres
2014-07-17 14:09 - 2013-11-16 11:54 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-15 11:41 - 2014-07-15 11:41 - 00000000 ____D () C:\found.000
2014-07-13 18:25 - 2014-07-13 18:25 - 02874307 _____ () C:\Users\Carolin\Downloads\963161.zip
2014-07-11 10:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 18:32 - 2009-07-14 06:45 - 00405280 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 18:30 - 2014-05-06 18:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 18:30 - 2010-11-21 09:16 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 18:14 - 2013-11-16 15:04 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 18:11 - 2013-11-13 19:36 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 18:09 - 2013-11-13 19:36 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 13:58 - 2014-03-28 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-10 13:57 - 2013-11-16 11:43 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-10 13:57 - 2013-11-16 11:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 16:36 - 2014-07-09 16:36 - 04807618 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli.sims3pack
2014-07-09 16:36 - 2014-07-09 16:36 - 04606727 _____ () C:\Users\Carolin\Downloads\Alesso_Kerli_C.sims3pack
2014-07-06 23:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

Some content of TEMP:
====================
C:\Users\Carolin\AppData\Local\Temp\avgnt.exe
C:\Users\Carolin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-01 16:49

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.86  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Secunia PSI (3.0.0.9016)   
 Java 7 Update 55  
 Java version out of Date! 
 Adobe Flash Player 14.0.0.145  
 Adobe Reader XI  
 Mozilla Firefox (29.0) 
 Google Chrome 36.0.1985.125  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=58ccabc2ac8d1842936f3b44aa375081
# engine=19512
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-05 06:14:10
# local_time=2014-08-05 08:14:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 21129 24022132 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 22733550 158892300 0 0
# scanned=225804
# found=61
# cleaned=0
# scan_time=5364
sh=BB06DBF0509ECA84BA25A6173A81ABF7F7A4A483 ft=1 fh=ad7cdff0aef155c8 vn="Variante von Win32/DomaIQ.BF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000"
sh=36F8B74A44E636834FE41E655A2F6BAA8BE36B5A ft=1 fh=b18df3cd93dc40ff vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000"
sh=5CE634C5833E0CFC43E1A1537D7211F8370954C9 ft=1 fh=6549c88c2cafbd89 vn="Variante von Win32/DomaIQ.BK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Google\Chrome\User Data\Default\File System\004\t\00\00000000"
sh=4DD4C9E96657CD09388D9AC90A2FC9BEED5EFE8B ft=1 fh=1a2f06089882b7cc vn="Variante von Win32/ELEX.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P611UV6G\ElexTech(1)[1].exe"
sh=9F84FF1500CC1E32888A4DB3B2911B13AA770AC3 ft=1 fh=b6b527a993f91eb6 vn="Win32/BrowseFox.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P7EOHZP4\HypeNetSetup[1].exe"
sh=3DCE7D9D64D8EF26CEAE84B4DABFD1FE879FCF34 ft=1 fh=0df6a150ab0b1ff8 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P7EOHZP4\v-bates[1].exe"
sh=8EF332B90ED74BF69510CC7B43046E1CC10D2D44 ft=0 fh=0000000000000000 vn="JS/Kryptik.ARH Trojaner" ac=I fn="C:\Users\Carolin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RHSFWLF5\7cc8bebqf7[1].htm"
sh=3CC6DF16D640E12B9516B29C4FB861393E5F5702 ft=1 fh=ac3e87b10a9c8343 vn="Variante von Win32/Speedchecker.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSOZPTHB\pcspeedup[1].exe"
sh=689A306B716960C50E2B1BF2CBF5771383618C78 ft=1 fh=c742e518b062dd8f vn="Variante von Win32/Toolbar.Iminent.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Roaming\Angry_Birds\Angry_Birds.exe"
sh=3B3AAF99480E6146886B24A2609737D905B27205 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Roaming\Opera Software\Opera Stable\Extensions\adbpopomabpienjnifocifondadaogpj\1.26.17_0\extensionData\plugins\91.js"
sh=4F7228340F6D6AF77E12D431330776C96E3538A0 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Roaming\Opera Software\Opera Stable\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.35_0\extensionData\plugins\91.js"
sh=31ABAD435484431206E90C7C9444834FB1D9CB2B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\AppData\Roaming\Opera Software\Opera Stable\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.20_0\extensionData\plugins\91.js"
sh=35987E8A8AA932982D9CF0EA6DF502087644448E ft=1 fh=d82ceaa6d24562da vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\Desktop\Caro\Music\ab.exe"
sh=13327D24BF2229381907C3DE9AA40633677D9E86 ft=1 fh=7778ffa682325622 vn="Win32/Somoto.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carolin\Desktop\Caro\Music\youtube-to-mp3-converter.exe"
sh=A87DC5F3C99D2E494D8B7BEB4C8794A725FC4524 ft=1 fh=01f9b5519bd9f896 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Papa\Downloads\LibreOffice - CHIP-Downloader.exe"
sh=9C860E0B0EAFF9D2912642BC3940BA098C00BBCE ft=1 fh=41f2b86635803f1b vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Papa\Downloads\vlc-2.1.0-win64.exe"
sh=8A4CC20AFF196988CB6AE3890AD124A846EACC04 ft=1 fh=87f89f569b68d7e7 vn="Mehrere Bedrohungen" ac=I fn="D:\Carolin\Carolin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NA0KDKT6\SuperLyrics_1060-1134_v111[1]"
sh=0A0209D0147C0907989CBEC433E08A4503D4180D ft=1 fh=fa3197e3c49de9a6 vn="Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\DeltaTB.exe"
sh=8A4CC20AFF196988CB6AE3890AD124A846EACC04 ft=1 fh=87f89f569b68d7e7 vn="Mehrere Bedrohungen" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\SLUpdate.exe"
sh=58495F0458EDDC16D9A14A6E84CEE9C61AAE5E52 ft=1 fh=85d80dff1da9eafb vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\BabMaint.exe"
sh=DED201AE02FB9EA3646489AFEDA49270C4620D9C ft=1 fh=c71c001196f8c3ac vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\BExternal.dll"
sh=56371D74005B39D794FF8F30891F27BACECA56C8 ft=1 fh=c3e79ff37423ee01 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\BUSolution.dll"
sh=49085687DF46998B48742E67E5068A7704586508 ft=1 fh=c1b5b70527f93ad3 vn="Win32/Toolbar.Babylon.M evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\ccp.exe"
sh=B63A526551150E80C479E6F076E82DD5A7FB7FBE ft=1 fh=407239d3df8cef81 vn="Win32/Toolbar.Babylon.U evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\CrxInstaller.dll"
sh=C179EC7FD95F96DE417DF6954395F005930420A5 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\delta1.crx"
sh=7759A3318DE2ABC3755EBB7F50322C6D586B5286 ft=1 fh=e3d39714b3bfb2a0 vn="Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\IEHelper.dll"
sh=C93CCF890C1E509C8FCE0001F591EE542810BE4B ft=1 fh=1ba84391c3067840 vn="Win32/Toolbar.Montiera.I evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\MyBabylonTB.exe"
sh=935F58155F74B051F9123B6022B7D358B52B146F ft=1 fh=4132c7bb6eed2e50 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\6B999BE3-BAB0-7891-8D41-247C6157B09F\Latest\Setup.exe"
sh=91FD0C68DC46843917C8FEA976D8DDF7B941D897 ft=1 fh=fe05ab993baef410 vn="Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\bus96F9\BabMaint.x"
sh=43EAA89AE51391FE6219B415ED726FB621B354FE ft=1 fh=c71c00115a62a541 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\bus96F9\BUSolution.x"
sh=0010BEF8D6264E36442DD92F3ACA023F22FDADB0 ft=1 fh=411ba8348a9d4776 vn="Win32/Toolbar.Babylon.M evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\nsd7D3C.tmp\babylon.dll"
sh=F3B9567480B8A7031A9F14846146D272DA6E5506 ft=0 fh=0000000000000000 vn="Win32/bProtector.F evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\nsd7D3C.tmp\bprotector.xpi"
sh=743BF0B65B7B598A1BDDC54292AC2DD49C0DA953 ft=1 fh=0441718b8dcce300 vn="Win32/Toolbar.Babylon.M evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\nsd7D3C.tmp\installutils.dll"
sh=7021C512EAE4FD48F9D5978728218B0362B5B35D ft=1 fh=c71c001144a9c884 vn="Variante von Win32/bProtector.B evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\nsd7D3C.tmp\kerberos_bho.dll"
sh=5FCAD52F57E68EDEF6E898D20ADC12667ADC5FFC ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.NNF Trojaner" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\oracle\sawnBoons.class"
sh=B606AE0BDFFC46036B37386391347DC4BC30A9A0 ft=1 fh=e7e6ce3ed10bbdff vn="Variante von Win32/Kryptik.AXBN Trojaner" ac=I fn="D:\Carolin\Carolin\AppData\Local\Temp\tmpd67a025f\543.exe"
sh=91FD0C68DC46843917C8FEA976D8DDF7B941D897 ft=1 fh=fe05ab993baef410 vn="Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabMaint.exe"
sh=ECAD0BD6E1F0A2E321F674E209E660FFF3DE5D42 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.Q evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\CR\BabylonChrome1.crx"
sh=8F07EC7253BDAF252D6C621EC396BAB5FED3A72C ft=1 fh=c71c00111a05a605 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\CR\BUSolution.dll"
sh=C179EC7FD95F96DE417DF6954395F005930420A5 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\CR\delta1.crx"
sh=8F07EC7253BDAF252D6C621EC396BAB5FED3A72C ft=1 fh=c71c00111a05a605 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\FF\BUSolution.dll"
sh=8F07EC7253BDAF252D6C621EC396BAB5FED3A72C ft=1 fh=c71c00111a05a605 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\IE\BUSolution.dll"
sh=58495F0458EDDC16D9A14A6E84CEE9C61AAE5E52 ft=1 fh=85d80dff1da9eafb vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\Shared\BabMaint.exe"
sh=56371D74005B39D794FF8F30891F27BACECA56C8 ft=1 fh=c3e79ff37423ee01 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabSolution\Shared\BUSolution.dll"
sh=819DCBCC541924E7B98B6A6667188D451424BEB7 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.Q evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabylonToolbar\CR\BabylonChrome1.crx"
sh=E4B683EA0AC3CB316660D7A9796BA02ED3AD61F3 ft=1 fh=c71c001113bf6828 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabylonToolbar\CR\BUSolution.dll"
sh=E4B683EA0AC3CB316660D7A9796BA02ED3AD61F3 ft=1 fh=c71c001113bf6828 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabylonToolbar\FF\BUSolution.dll"
sh=E4B683EA0AC3CB316660D7A9796BA02ED3AD61F3 ft=1 fh=c71c001113bf6828 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabylonToolbar\IE\BUSolution.dll"
sh=43EAA89AE51391FE6219B415ED726FB621B354FE ft=1 fh=c71c00115a62a541 vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\BabylonToolbar\Shared\BUSolution.dll"
sh=7CD5E5C98B5DD015BAB5F76A7B54BDA2B7577E88 ft=1 fh=bd71bf7a50b91c00 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\AppData\Roaming\Opera\OpenCandy\CD317758DC5C4D068CAD17F119BBD106\HSS-2.52-install-p76-335-conduit.exe"
sh=457335C7D7CF3B76BDA5156BDFC9D2E55F5EB26E ft=1 fh=733834ea60493ef0 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Documents\Downloads\Integrated_CT2325506.exe"
sh=2FA4EDBF540322023CC0D8BBFD9BBE05A15973E0 ft=1 fh=fcc9b8f3a47542cc vn="Variante von Win32/Toolbar.Babylon.A evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Downloads\Babylon9_setup.exe"
sh=D07806F4FAEBB67947BF332BECD602FF0D9C4402 ft=1 fh=1bb1ae6faf1dd14e vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Downloads\Hilde_downloader_by_SchriftartenFontsde.exe"
sh=AE12DB84C34FB3BDF041D0AE568930D55972048F ft=1 fh=b666add8cadd85ce vn="Variante von Win32/InstallBrain.P evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Downloads\VideoPerformerSetup.exe"
sh=44A315AAA7F006AE8342751A3D01D3E0E2BD41E6 ft=1 fh=e23e3184587da44d vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Local Settings\Application Data\Bundled software uninstaller\bi_client.exe"
sh=35987E8A8AA932982D9CF0EA6DF502087644448E ft=1 fh=d82ceaa6d24562da vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Music\ab.exe"
sh=C8C223D0C1531717E2C64310252C3A366C8ED190 ft=1 fh=f58530445460dae7 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Music\video_downloader.exe"
sh=13327D24BF2229381907C3DE9AA40633677D9E86 ft=1 fh=7778ffa682325622 vn="Win32/Somoto.E evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Carolin\Music\youtube-to-mp3-converter.exe"
sh=35987E8A8AA932982D9CF0EA6DF502087644448E ft=1 fh=d82ceaa6d24562da vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Music\ab.exe"
sh=C8C223D0C1531717E2C64310252C3A366C8ED190 ft=1 fh=f58530445460dae7 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Music\video_downloader.exe"
sh=13327D24BF2229381907C3DE9AA40633677D9E86 ft=1 fh=7778ffa682325622 vn="Win32/Somoto.E evtl. unerwünschte Anwendung" ac=I fn="D:\Carolin\Music\youtube-to-mp3-converter.exe"

schrauber · 06.08.2014, 15:31

Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

D:\Carolin\Carolin\AppData\Roaming\BabSolution
D:\Carolin\Carolin\AppData\Roaming\Opera\OpenCandy
D:\Carolin\Carolin\Music\ab.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

Noch Probleme?

Carolin.Abär · 06.08.2014, 18:43

Hi, ich habe alles nach Anweisung durchgeführt. Allerdings habe ich noch immer die Angry_Birds.exe Datei, mit der alles angefangen hat. Ich habe den Ordner mittlerweile auf meinen Desktop verschoben. Gibt es eine Möglichkeit diese Datei ebenfalls zu entfernen, damit sie mir auch in Zukunft keinen Schaden anrichtet?
Fixlog folgt

MfG,
Carolin S.

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-07-2014 02
Ran by Carolin at 2014-08-06 19:23:43 Run:1
Running from C:\Users\Carolin\Desktop\Neuer Ordner
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
D:\Carolin\Carolin\AppData\Roaming\BabSolution
D:\Carolin\Carolin\AppData\Roaming\Opera\OpenCandy
D:\Carolin\Carolin\Music\ab.exe
*****************

D:\Carolin\Carolin\AppData\Roaming\BabSolution => Moved successfully.
D:\Carolin\Carolin\AppData\Roaming\Opera\OpenCandy => Moved successfully.
D:\Carolin\Carolin\Music\ab.exe => Moved successfully.

==== End of Fixlog ====

schrauber · 07.08.2014, 16:40

Einfach Löschen

Carolin.Abär · 07.08.2014, 18:54

Hat funktioniert, danke

MfG,

Carolin S.

02.08.2014, 20:12	#6
schrauber /// the machine /// TB-Ausbilder	Virus, unerwünschte Werbung, .exe JEtzt einfach Combofix __________________ --> Virus, unerwünschte Werbung, .exe

07.08.2014, 16:40	#14
schrauber /// the machine /// TB-Ausbilder	Virus, unerwünschte Werbung, .exe Einfach Löschen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Virus, unerwünschte Werbung, .exe

Plagegeister aller Art und deren Bekämpfung: Virus, unerwünschte Werbung, .exe