Widows 7: Trojaner Befall Mitte August mit Anti-Malware entfernt system aber immernoch langsam

JK1900 · 07.09.2014, 12:23

Hallo,

vorwegnehmen möchte ich, dass ich aus 2 defekten Notebooks 1 intaktes gebastelt habe. Windows warnt mich seither das meine Version eine Fälschung sein könnte, was sie faktisch aber nicht ist.

Letzten Monat hatte ich einen Trojaner auf dem Rechner, den ich mit Anti-Malware (Malwarebytes) entfernt habe. Seither erscheint mir das System jedoch immer noch langsamer als vorher. Es wäre wirklich eine große Hilfe wenn jemand mit Sachverstand meine Logfiles prüfen könnte, damit ich Gewissheit habe ob der Rechner sicher ist.

Die Log Files sind in folgender Reihenfolge:

1. Anti-Malware (ACHTUNG: nicht aktuell sondern vom befall)
2. Avira Free Antivirus (ACHTUNG: nicht aktuell sondern vom befall)
3. FRST (aktuell)
4. Addition (aktuell)
5. GMER (aktuell)

Ich hoffe es ist alles angefügt was notwendig ist und bedanke mich vorweg für die Hilfe!

Anti-Malware

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 14.08.2014
Scan Time: 20:32:31
Logfile: Malwarebytes_Anti_Malware_Log.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.14.09
Rootkit Database: v2014.08.04.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Millefiori-Offenbach

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 291925
Time Elapsed: 14 min, 1 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 4
PUP.Optional.ELEX, C:\ProgramData\IePluginServices\PluginService.exe, 1236, Delete-on-Reboot, [522fdbebabd01026e5a1d0da0ef3e11f]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, 3016, Delete-on-Reboot, [2c5556705229142261aadff67f834db3]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader32.exe, 1524, Delete-on-Reboot, [2c5556705229142261aadff67f834db3]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader64.exe, 1492, Delete-on-Reboot, [2c5556705229142261aadff67f834db3]

Modules: 9
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 

Registry Keys: 14
PUP.Optional.ELEX, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, Quarantined, [522fdbebabd01026e5a1d0da0ef3e11f], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.SupTab.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Delete-on-Reboot, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.SupTab.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Delete-on-Reboot, [8af74e789ae1da5c5e052846a161946c], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [344d695d413ad165038e6ebea46044bc], 
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\istartsurfSoftware, Quarantined, [add451756b105cda4e4a29b35ea4c43c], 
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, Quarantined, [b0d12a9c502b3bfbf41e0a37b351f40c], 
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [e0a1cbfbb0cbbf77543d67c5c14350b0], 
PUP.Optional.WebSearches.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SupHpUISoft, Delete-on-Reboot, [dea35d69b4c73402187adc00c43e09f7], 
PUP.Optional.Qone8, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Delete-on-Reboot, [a2df76502b50e74f6927d6568381d22e], 

Registry Values: 0
(No malicious items detected)

Registry Data: 11
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[0a778541077460d650dc883ddc28ba46]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}),Replaced,[9ce5c9fd2259c86ed34fb1149b6938c8]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[bdc43d8988f38babea369e27cf35c53b]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[7908fccaef8c6fc774b05174966e738d]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[463bcdf90378a88e46f78b45659f53ad]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[077a4a7cd8a382b4e04c5f66669e8d73]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}),Replaced,[800182444932da5c7da58144f60eaf51]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[790816b0ed8ed2640e120db862a2a759]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[2958586eb0cbdf57c064ffc6dd2715eb]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[522fd5f1b6c530064fee10c09e6634cc]
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Delete-on-Reboot,[790812b469120b2bda476f567b898b75]

Folders: 28
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, Delete-on-Reboot, [f190616584f756e094de08c4ed15768a], 
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, Quarantined, [f190616584f756e094de08c4ed15768a], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, Quarantined, [2c5556705229142261aadff67f834db3], 

Files: 69
PUP.Optional.ELEX, C:\ProgramData\IePluginServices\PluginService.exe, Delete-on-Reboot, [522fdbebabd01026e5a1d0da0ef3e11f], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupTab.dll, Quarantined, [8af74e789ae1da5c5e052846a161946c], 
Trojan.FakeMS.ED, C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF\bnaqav.cpp, Quarantined, [6e13d7ef7704c76f2cb34f3ca45d8779], 
Trojan.FakeMS, C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF\vaqanb.dot, Quarantined, [98e98c3aa3d86bcb2a0f354bbb4620e0], 
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, Quarantined, [f190616584f756e094de08c4ed15768a], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface64.dll, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader32.exe, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader64.exe, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\RSHP.exe, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SearchProtect64.dll, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\bk_shadow.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\btn.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\close.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml.bak, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_box.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_check.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_bk.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_check.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, Quarantined, [2c5556705229142261aadff67f834db3], 
PUP.Optional.Spigot.A, C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (      "startup_urls": [ "https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ch" ],), Replaced,[7b06cbfb0378f640ab861de31fe627d9]
PUP.Optional.Spigot.A, C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (   "homepage": "https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ch",), Replaced,[f78a596d2e4de056af83d729c3420000]

Physical Sectors: 0
(No malicious items detected)


(end)

Avira Free Antivirus

Code:

ATTFilter

Die Datei 'D:\Download\imf13-setup.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen9' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '519bea05.qua' verschoben!

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-09-2014
Ran by Millefiori-Offenbach (administrator) on MILLEFIORI on 07-09-2014 12:35:38
Running from C:\Users\Millefiori-Offenbach\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files (x86)\Polar\Daemon\polard.exe
(Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Eyeo GmbH) C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_14_0_0_176_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-03-20] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-03-20] (Realtek Semiconductor)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-28] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3187200561-4197913244-2507983753-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll File Not Found
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => "C:\Windows\SysWOW64\nvinit.dll" File Not Found

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE4C58813F5B7CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Program Files (x86)\TVUPlayer\npTVUAx.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-09-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-09]

Chrome: 
=======
CHR Profile: C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-28] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 Polar Daemon; C:\Program Files (x86)\Polar\Daemon\polard.exe [419536 2012-12-12] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-28] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-28] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-21] ( )
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S4 nvpciflt; \SystemRoot\system32\DRIVERS\nvpciflt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-07 12:35 - 2014-09-07 12:36 - 00011399 _____ () C:\Users\Millefiori-Offenbach\Desktop\FRST.txt
2014-09-07 12:35 - 2014-09-07 12:35 - 00000502 _____ () C:\Users\Millefiori-Offenbach\Desktop\defogger_disable.log
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 ____D () C:\FRST
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 _____ () C:\Users\Millefiori-Offenbach\defogger_reenable
2014-09-07 12:32 - 2014-09-07 12:32 - 00380416 _____ () C:\Users\Millefiori-Offenbach\Desktop\nmhkwv5n.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 02104832 _____ (Farbar) C:\Users\Millefiori-Offenbach\Desktop\FRST64.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 00050477 _____ () C:\Users\Millefiori-Offenbach\Desktop\Defogger.exe
2014-09-07 12:21 - 2014-09-07 12:21 - 00000056 _____ () C:\Windows\setupact.log
2014-09-07 12:21 - 2014-09-07 12:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-07 12:20 - 2014-09-07 12:20 - 00000624 _____ () C:\Windows\PFRO.log
2014-08-31 22:36 - 2014-08-31 22:41 - 00722432 _____ () C:\Users\Millefiori-Offenbach\Desktop\Baufi - Haus.xls
2014-08-31 08:11 - 2014-08-31 08:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 08:06 - 2014-08-31 08:06 - 05952624 _____ ( ) C:\Users\Millefiori-Offenbach\Downloads\adblockplusie-1.2.exe
2014-08-29 17:40 - 2014-08-29 17:40 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-29 17:39 - 2014-08-29 17:39 - 04901352 _____ (Piriform Ltd) C:\Users\Millefiori-Offenbach\Downloads\ccsetup417.exe
2014-08-28 23:16 - 2014-08-28 23:16 - 00559784 _____ () C:\Users\Millefiori-Offenbach\Documents\Präsentation1.pptx
2014-08-28 19:06 - 2014-09-01 22:08 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Downloads\Lachwiesen
2014-08-28 14:56 - 2014-08-28 14:56 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 14:56 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 14:54 - 2014-08-28 14:52 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-08-28 14:51 - 2014-08-28 14:51 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 14:50 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 14:50 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Avira
2014-08-28 14:50 - 2014-08-28 14:52 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-28 14:50 - 2014-08-28 14:52 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-28 14:50 - 2014-02-25 11:41 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-08-28 08:33 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 08:33 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 08:33 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 08:06 - 2014-08-28 08:06 - 00002884 _____ () C:\Users\Millefiori-Offenbach\Desktop\HitmanPro_20140828_0806.log
2014-08-28 07:59 - 2014-08-28 08:06 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-08-28 03:59 - 2014-08-28 04:21 - 00000000 ____D () C:\ProgramData\OqiyFuba
2014-08-24 00:18 - 2014-08-25 18:37 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\DKB Bank
2014-08-22 01:43 - 2014-08-22 01:43 - 18439741 _____ (Bauskript Software) C:\Users\Millefiori-Offenbach\Downloads\bauskript.exe
2014-08-17 09:47 - 2014-08-21 20:53 - 00013536 _____ () C:\Users\Millefiori-Offenbach\Desktop\20140817 Investrechnung Immobilie.xlsx
2014-08-16 21:19 - 2014-08-20 15:05 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\D
2014-08-15 17:30 - 2014-08-15 17:30 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 09:19 - 2014-07-21 16:31 - 00763912 ____N (Hewlett-Packard Development Company, LP) C:\Windows\system32\HPDiscoPM7112.dll
2014-08-15 09:17 - 2014-08-15 09:17 - 40247720 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8610 Treiber.exe
2014-08-15 09:07 - 2014-08-15 09:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-15 09:07 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM5912.dll
2014-08-15 09:06 - 2014-08-15 09:06 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-08-15 09:05 - 2014-08-15 09:05 - 31455000 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8600 Treiber.exe
2014-08-14 21:39 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 21:39 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 21:39 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 21:39 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 21:39 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 21:39 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-14 21:38 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 21:38 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 21:37 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 21:37 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 21:37 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 21:37 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 21:37 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-14 21:37 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 21:37 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 21:37 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-14 21:37 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-14 21:37 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 21:37 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-14 21:37 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 21:37 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 21:37 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 21:37 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 21:37 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-14 21:37 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-14 21:37 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-14 21:37 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-14 21:37 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 21:37 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-14 21:37 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 21:37 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-14 21:37 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-14 21:37 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 21:37 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-14 21:37 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 21:37 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 21:37 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 21:37 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 21:37 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 21:37 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 21:37 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 21:37 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-14 21:37 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-14 21:37 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 21:37 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 21:37 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 21:37 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-14 21:37 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 21:37 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 21:37 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-14 21:37 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 21:37 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 21:37 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 21:37 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 21:37 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 21:37 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 21:37 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-14 21:37 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 21:37 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 21:37 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 21:37 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-14 21:37 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-14 21:37 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 21:37 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 21:36 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 21:36 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 21:36 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 21:36 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 21:36 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 21:36 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 21:36 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 21:36 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 21:36 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-14 21:08 - 2014-08-14 21:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-14 21:00 - 2014-08-28 04:56 - 00000000 ____D () C:\AdwCleaner
2014-08-14 21:00 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-14 20:31 - 2014-08-28 13:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-14 20:31 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-14 20:31 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-14 20:31 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-14 20:29 - 2014-08-14 20:29 - 00008833 _____ () C:\Users\Millefiori-Offenbach\Downloads\bookmark.htm
2014-08-14 20:14 - 2014-08-14 20:14 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-13 22:38 - 2014-08-14 20:17 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-13 22:38 - 2014-08-14 20:17 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-08-13 22:38 - 2014-08-14 19:59 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 20:31 - 2014-08-13 20:31 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-13 20:31 - 2014-08-13 20:31 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-08-13 19:42 - 2014-08-13 19:42 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-13 19:34 - 2014-08-14 20:20 - 00000000 ____D () C:\ProgramData\Nero
2014-08-13 19:33 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-08-13 19:32 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-08-13 19:14 - 2014-08-13 22:40 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-12 22:50 - 2014-08-12 22:50 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-08-12 22:49 - 2014-08-12 22:49 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 21:03 - 2014-08-10 21:03 - 38603216 _____ (Amazon) C:\Users\Millefiori-Offenbach\Downloads\AmazonMusicInstaller.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-07 12:36 - 2014-09-07 12:35 - 00011399 _____ () C:\Users\Millefiori-Offenbach\Desktop\FRST.txt
2014-09-07 12:35 - 2014-09-07 12:35 - 00000502 _____ () C:\Users\Millefiori-Offenbach\Desktop\defogger_disable.log
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 ____D () C:\FRST
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 _____ () C:\Users\Millefiori-Offenbach\defogger_reenable
2014-09-07 12:35 - 2011-05-21 18:32 - 00000000 ____D () C:\Users\Millefiori-Offenbach
2014-09-07 12:32 - 2014-09-07 12:32 - 00380416 _____ () C:\Users\Millefiori-Offenbach\Desktop\nmhkwv5n.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 02104832 _____ (Farbar) C:\Users\Millefiori-Offenbach\Desktop\FRST64.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 00050477 _____ () C:\Users\Millefiori-Offenbach\Desktop\Defogger.exe
2014-09-07 12:27 - 2011-03-20 01:26 - 01717026 _____ () C:\Windows\WindowsUpdate.log
2014-09-07 12:22 - 2012-07-13 16:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-07 12:21 - 2014-09-07 12:21 - 00000056 _____ () C:\Windows\setupact.log
2014-09-07 12:21 - 2014-09-07 12:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-07 12:21 - 2011-05-21 22:31 - 00058288 _____ (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.dll
2014-09-07 12:21 - 2011-03-20 01:20 - 00017920 _____ () C:\Windows\system32\rpcnetp.exe
2014-09-07 12:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-07 12:20 - 2014-09-07 12:20 - 00000624 _____ () C:\Windows\PFRO.log
2014-09-07 12:19 - 2009-07-14 06:45 - 00010336 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-07 12:19 - 2009-07-14 06:45 - 00010336 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-03 19:37 - 2014-04-29 11:41 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Bewerbung
2014-09-01 22:08 - 2014-08-28 19:06 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Downloads\Lachwiesen
2014-08-31 22:41 - 2014-08-31 22:36 - 00722432 _____ () C:\Users\Millefiori-Offenbach\Desktop\Baufi - Haus.xls
2014-08-31 08:11 - 2014-08-31 08:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 08:10 - 2012-01-20 21:32 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Desktop 20120120
2014-08-31 08:06 - 2014-08-31 08:06 - 05952624 _____ ( ) C:\Users\Millefiori-Offenbach\Downloads\adblockplusie-1.2.exe
2014-08-29 17:42 - 2012-07-13 10:52 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\CC_reg_clean
2014-08-29 17:40 - 2014-08-29 17:40 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-29 17:40 - 2012-07-13 10:38 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-29 17:39 - 2014-08-29 17:39 - 04901352 _____ (Piriform Ltd) C:\Users\Millefiori-Offenbach\Downloads\ccsetup417.exe
2014-08-28 23:16 - 2014-08-28 23:16 - 00559784 _____ () C:\Users\Millefiori-Offenbach\Documents\Präsentation1.pptx
2014-08-28 14:56 - 2014-08-28 14:56 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 14:56 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 14:56 - 2014-08-28 14:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 14:56 - 2014-08-28 14:50 - 00000000 ____D () C:\ProgramData\Avira
2014-08-28 14:56 - 2014-04-06 14:45 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-28 14:52 - 2014-08-28 14:54 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-08-28 14:52 - 2014-08-28 14:50 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-28 14:52 - 2014-08-28 14:50 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-28 14:51 - 2014-08-28 14:51 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 13:18 - 2014-08-14 20:31 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-28 08:38 - 2009-07-14 06:45 - 00353608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 08:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-28 08:22 - 2014-04-29 12:06 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Schriftstücke misc
2014-08-28 08:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-28 08:06 - 2014-08-28 08:06 - 00002884 _____ () C:\Users\Millefiori-Offenbach\Desktop\HitmanPro_20140828_0806.log
2014-08-28 08:06 - 2014-08-28 07:59 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-08-28 04:56 - 2014-08-14 21:00 - 00000000 ____D () C:\AdwCleaner
2014-08-28 04:33 - 2014-04-29 11:43 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\CCRM
2014-08-28 04:21 - 2014-08-28 03:59 - 00000000 ____D () C:\ProgramData\OqiyFuba
2014-08-25 18:37 - 2014-08-24 00:18 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\DKB Bank
2014-08-23 04:07 - 2014-08-28 08:33 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 08:33 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 08:33 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 10:18 - 2009-08-04 11:51 - 00714632 _____ () C:\Windows\system32\perfh007.dat
2014-08-22 10:18 - 2009-08-04 11:51 - 00154580 _____ () C:\Windows\system32\perfc007.dat
2014-08-22 10:18 - 2009-07-14 07:13 - 01660160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-22 01:43 - 2014-08-22 01:43 - 18439741 _____ (Bauskript Software) C:\Users\Millefiori-Offenbach\Downloads\bauskript.exe
2014-08-21 20:53 - 2014-08-17 09:47 - 00013536 _____ () C:\Users\Millefiori-Offenbach\Desktop\20140817 Investrechnung Immobilie.xlsx
2014-08-20 15:05 - 2014-08-16 21:19 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\D
2014-08-15 17:30 - 2014-08-15 17:30 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 09:19 - 2014-08-15 09:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-15 09:19 - 2014-07-21 19:20 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\HP
2014-08-15 09:17 - 2014-08-15 09:17 - 40247720 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8610 Treiber.exe
2014-08-15 09:06 - 2014-08-15 09:06 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\ProgramData\HP
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\Program Files\HP
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-15 09:05 - 2014-08-15 09:05 - 31455000 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8600 Treiber.exe
2014-08-15 08:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-14 22:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 21:47 - 2014-04-06 16:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 21:44 - 2011-05-21 23:04 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 21:30 - 2014-04-08 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-14 21:29 - 2014-08-14 21:29 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-14 21:08 - 2014-08-14 21:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-14 21:02 - 2014-08-07 21:58 - 00001009 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-14 20:51 - 2014-05-04 11:26 - 00000000 ____D () C:\Windows\pss
2014-08-14 20:50 - 2014-05-26 23:44 - 00000000 ____D () C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-14 20:29 - 2014-08-14 20:29 - 00008833 _____ () C:\Users\Millefiori-Offenbach\Downloads\bookmark.htm
2014-08-14 20:20 - 2014-08-13 19:34 - 00000000 ____D () C:\ProgramData\Nero
2014-08-14 20:17 - 2014-08-13 22:38 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-14 20:17 - 2014-08-13 22:38 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-08-14 20:14 - 2014-08-14 20:14 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-14 19:59 - 2014-08-13 22:38 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 22:40 - 2014-08-13 19:14 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-13 22:07 - 2012-07-13 16:42 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-13 22:07 - 2012-07-13 16:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-13 22:07 - 2012-07-13 16:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-13 20:31 - 2014-08-13 20:31 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-13 20:31 - 2014-08-13 20:31 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-08-13 19:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-13 19:42 - 2014-08-13 19:42 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-12 22:50 - 2014-08-12 22:50 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-08-12 22:49 - 2014-08-12 22:49 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 21:03 - 2014-08-10 21:03 - 38603216 _____ (Amazon) C:\Users\Millefiori-Offenbach\Downloads\AmazonMusicInstaller.exe

Some content of TEMP:
====================
C:\Users\Millefiori-Offenbach\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 10:42

==================== End Of Log ============================

--- --- ---

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-09-2014
Ran by Millefiori-Offenbach at 2014-09-07 12:37:15
Running from C:\Users\Millefiori-Offenbach\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adblock Plus für IE (32-Bit- und 64-Bit) (HKLM\...\{123A22CB-6D84-4135-A71F-886C9119E996}) (Version: 99.9 - Eyeo GmbH)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.176 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.2.0.591 - Amazon Services LLC)
Avira (HKLM-x32\...\{df495620-2ba9-412d-828d-b27f020d9fc8}) (Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5000 - CDBurnerXP)
Complément Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Complemento Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{C1586445-E3CA-45F0-A754-E6C2784CDDB7}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Messenger 分享元件 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
NVIDIA Install Application (Version: 2.1002.62.312 - NVIDIA Corporation) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Polar Daemon (HKLM-x32\...\{2BA9320D-E061-4C71-ACCB-AC0E9D4FC82B}) (Version: 2.2.20000 - Polar Electro Oy)
Polar WebSync (HKLM-x32\...\{320453EE-6AEA-4E1A-8E64-72F33C0C928F}) (Version: 2.8.10006 - Polar Electro Oy)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6294 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10001 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SimpleOCR 3.1 (HKLM-x32\...\SimpleOCR 3.1) (Version:  - )
Sonic Focus (HKLM-x32\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.00.0000 - Virage Logic, Corp.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
מסייע Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (HKLM-x32\...\{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}) (Version: 15.4.5722.2 - Microsoft Corporation)
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

31-08-2014 06:10:48 Installed Adblock Plus for IE (32-bit and 64-bit)
31-08-2014 17:00:36 Windows-Sicherung

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {16606EB5-9E8B-4157-BB49-6F32C2190A78} - System32\Tasks\Driver Booster SkipUAC (SYSTEM) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {61D6C28C-A253-40A9-9DF8-70D2862E5253} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)
Task: {6EDBAB98-36A8-415D-9A15-A60778B1CE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-13] (Adobe Systems Incorporated)
Task: {70F31E0D-5896-4A6A-9615-2E1F376D3485} - System32\Tasks\{F2B9DC56-F9FD-4DF8-930D-47973B25A5CA} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {BE45F46B-63AB-42C9-9BD5-C0523267E822} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-02-23 19:29 - 2005-03-12 02:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2012-12-12 15:20 - 2012-12-12 15:20 - 00419536 _____ () C:\Program Files (x86)\Polar\Daemon\polard.exe
2011-05-21 23:26 - 2011-03-02 12:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2014-01-10 07:26 - 2014-01-10 07:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2012-12-12 15:20 - 2012-12-12 15:20 - 03483856 _____ () C:\Program Files (x86)\Polar\Daemon\libpolar.dll
2014-07-14 16:49 - 2014-07-14 16:49 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-14 16:49 - 2014-07-14 16:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-01-10 07:28 - 2014-01-10 07:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-08-28 14:56 - 2014-07-14 16:49 - 00049744 _____ () C:\Users\Millefiori-Offenbach\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Polar WebSync (polargofit.com).lnk => C:\Windows\pss\Polar WebSync (polargofit.com).lnk.CommonStartup

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Massenspeichercontroller
Description: Massenspeichercontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (09/07/2014 00:22:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (09/07/2014 00:22:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (3104) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0005D.log.


System errors:
=============
Error: (09/07/2014 00:23:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/07/2014 00:23:34 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.


Microsoft Office Sessions:
=========================
Error: (06/30/2014 04:29:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 105790 seconds with 6300 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz
Percentage of memory in use: 37%
Total physical RAM: 4090.96 MB
Available physical RAM: 2553.41 MB
Total Pagefile: 8180.11 MB
Available Pagefile: 6430.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:74.52 GB) (Free:22.55 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:202.08 GB) (Free:42.4 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E0C5913D)
Partition 1: (Not Active) - (Size=21.5 GB) - (Type=1C)
Partition 2: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=202.1 GB) - (Type=OF Extended)

==================== End Of Log ============================

GMER

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-07 12:53:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.01.0 298,09GB
Running: nmhkwv5n.exe; Driver: C:\Users\MILLEF~1\AppData\Local\Temp\uxldypod.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                    fffff80003405000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594                                                                    fffff80003405042 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[1964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69   0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[1964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155  0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2
.text     C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                 0000000072bd1a22 2 bytes [BD, 72]
.text     C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                 0000000072bd1ad0 2 bytes [BD, 72]
.text     C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                 0000000072bd1b08 2 bytes [BD, 72]
.text     C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                 0000000072bd1bba 2 bytes [BD, 72]
.text     C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                 0000000072bd1bda 2 bytes [BD, 72]
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[1680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[1680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155         0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2
.text     C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69              0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155             0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2
.text     C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[3028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               0000000075a41465 2 bytes [A4, 75]
.text     C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[3028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              0000000075a414bb 2 bytes [A4, 75]
.text     ...                                                                                                                                   * 2

---- EOF - GMER 2.1 ----

schrauber · 07.09.2014, 12:24

hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

JK1900 · 07.09.2014, 23:33

Hallo,

hier die Logfile von Combofix;

Code:

ATTFilter

ComboFix 14-09-05.01 - Millefiori-Offenbach 08.09.2014   0:07.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4091.2531 [GMT 2:00]
ausgeführt von:: c:\users\Millefiori-Offenbach\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
c:\users\MILLEF~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Millefiori-Offenbach\4.0
c:\users\Millefiori-Offenbach\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-07 bis 2014-09-07  ))))))))))))))))))))))))))))))
.
.
2014-09-07 10:35 . 2014-09-07 10:37	--------	d-----w-	C:\FRST
2014-08-31 06:11 . 2014-08-31 06:11	--------	d-----w-	c:\program files\Adblock Plus for IE
2014-08-28 12:56 . 2014-08-28 12:56	--------	d-----w-	c:\programdata\Package Cache
2014-08-28 12:54 . 2014-08-28 12:52	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-08-28 12:51 . 2014-08-28 12:51	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 12:50 . 2014-08-28 12:52	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-08-28 12:50 . 2014-08-28 12:52	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-08-28 12:50 . 2014-02-25 09:41	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-08-28 12:50 . 2014-08-28 12:56	--------	d-----w-	c:\programdata\Avira
2014-08-28 06:33 . 2014-08-23 02:07	404480	----a-w-	c:\windows\system32\gdi32.dll
2014-08-28 06:33 . 2014-08-23 01:45	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2014-08-28 06:33 . 2014-08-23 00:59	3163648	----a-w-	c:\windows\system32\win32k.sys
2014-08-28 05:59 . 2014-08-28 06:06	--------	d-----w-	c:\programdata\HitmanPro
2014-08-28 01:59 . 2014-08-28 02:21	--------	d-----w-	c:\programdata\OqiyFuba
2014-08-15 15:30 . 2014-08-15 15:30	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 07:19 . 2014-07-21 14:31	763912	------w-	c:\windows\system32\HPDiscoPM7112.dll
2014-08-15 07:07 . 2012-10-17 02:31	741480	------w-	c:\windows\system32\HPDiscoPM5912.dll
2014-08-14 19:39 . 2014-03-09 21:48	171160	----a-w-	c:\windows\system32\infocardapi.dll
2014-08-14 19:39 . 2014-03-09 21:48	1389208	----a-w-	c:\windows\system32\icardagt.exe
2014-08-14 19:39 . 2014-03-09 21:47	99480	----a-w-	c:\windows\SysWow64\infocardapi.dll
2014-08-14 19:39 . 2014-03-09 21:47	619672	----a-w-	c:\windows\SysWow64\icardagt.exe
2014-08-14 19:39 . 2014-06-30 22:24	8856	----a-w-	c:\windows\system32\icardres.dll
2014-08-14 19:39 . 2014-06-30 22:14	8856	----a-w-	c:\windows\SysWow64\icardres.dll
2014-08-14 19:38 . 2014-06-06 06:16	35480	----a-w-	c:\windows\SysWow64\TsWpfWrp.exe
2014-08-14 19:38 . 2014-06-06 06:12	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2014-08-14 19:36 . 2014-06-03 10:02	3241984	----a-w-	c:\windows\system32\msi.dll
2014-08-14 19:36 . 2014-06-03 10:02	1941504	----a-w-	c:\windows\system32\authui.dll
2014-08-14 19:36 . 2014-06-03 09:29	2363392	----a-w-	c:\windows\SysWow64\msi.dll
2014-08-14 19:36 . 2014-06-03 09:29	1805824	----a-w-	c:\windows\SysWow64\authui.dll
2014-08-14 19:36 . 2014-06-03 10:02	112064	----a-w-	c:\windows\system32\consent.exe
2014-08-14 19:36 . 2014-06-03 10:02	504320	----a-w-	c:\windows\system32\msihnd.dll
2014-08-14 19:36 . 2014-06-03 09:29	337408	----a-w-	c:\windows\SysWow64\msihnd.dll
2014-08-14 19:36 . 2014-07-16 03:23	2048	----a-w-	c:\windows\system32\tzres.dll
2014-08-14 19:36 . 2014-07-16 02:46	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-08-14 19:36 . 2014-07-14 02:02	1216000	----a-w-	c:\windows\system32\rpcrt4.dll
2014-08-14 19:36 . 2014-07-14 01:40	664064	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2014-08-14 19:36 . 2014-06-16 02:10	985536	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2014-08-14 19:30 . 2014-08-14 19:30	--------	d-----w-	c:\program files (x86)\Common Files\Java
2014-08-14 19:29 . 2014-08-14 19:29	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-08-14 19:29 . 2014-08-14 19:29	--------	d-----w-	c:\program files (x86)\Java
2014-08-14 19:08 . 2014-08-14 19:08	--------	d-----w-	c:\windows\ERUNT
2014-08-14 19:00 . 2010-08-30 06:34	536576	----a-w-	c:\windows\SysWow64\sqlite3.dll
2014-08-14 19:00 . 2014-08-28 02:56	--------	d-----w-	C:\AdwCleaner
2014-08-14 18:31 . 2014-09-07 10:41	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-14 18:31 . 2014-08-14 18:31	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-08-14 18:31 . 2014-08-14 18:31	--------	d-----w-	c:\programdata\Malwarebytes
2014-08-14 18:31 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-08-14 18:31 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-08-14 18:31 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-08-14 18:14 . 2014-08-14 18:14	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-08-13 20:38 . 2014-08-14 18:17	--------	d-----w-	c:\programdata\GlarySoft
2014-08-13 20:38 . 2014-08-14 18:17	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-13 20:38 . 2014-08-14 17:59	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 18:31 . 2014-08-13 18:31	--------	d-----w-	c:\program files (x86)\CDBurnerXP
2014-08-13 17:42 . 2014-08-13 17:42	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-13 17:34 . 2014-08-14 18:20	--------	d-----w-	c:\programdata\Nero
2014-08-13 17:33 . 2010-05-26 09:41	248672	----a-w-	c:\windows\SysWow64\d3dx11_43.dll
2014-08-13 17:33 . 2010-05-26 09:41	470880	----a-w-	c:\windows\SysWow64\d3dx10_43.dll
2014-08-13 17:33 . 2010-05-26 09:41	1998168	----a-w-	c:\windows\SysWow64\D3DX9_43.dll
2014-08-13 17:33 . 2010-05-26 09:41	1868128	----a-w-	c:\windows\SysWow64\d3dcsx_43.dll
2014-08-13 17:32 . 2010-05-26 09:41	2106216	----a-w-	c:\windows\SysWow64\D3DCompiler_43.dll
2014-08-12 20:50 . 2014-08-12 20:50	--------	d-----w-	c:\programdata\Canneverbe Limited
2014-08-12 20:49 . 2014-08-12 20:49	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 19:05 . 2014-08-10 19:06	--------	d-----w-	c:\users\Millefiori-Offenbach\AppData\Local\Amazon Music
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-07 22:16 . 2011-03-19 23:20	17920	----a-w-	c:\windows\system32\rpcnetp.exe
2014-09-07 22:16 . 2011-05-21 20:31	58288	----a-w-	c:\windows\SysWow64\rpcnet.dll
2014-08-28 06:38 . 2010-06-24 18:33	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-14 19:44 . 2011-05-21 21:04	99218768	----a-w-	c:\windows\system32\MRT.exe
2014-08-13 20:07 . 2012-07-13 14:42	699568	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-13 20:07 . 2012-07-13 14:38	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 18:22 . 2014-07-09 18:22	11204096	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-06-18 02:18 . 2014-07-11 13:03	692736	----a-w-	c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-11 13:03	646144	----a-w-	c:\windows\SysWow64\osk.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"HP Officejet Pro 8610 (NET)"="c:\program files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe" [2014-07-21 3487240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2014-01-10 1861968]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-28 751184]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-14 190032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 Polar Daemon;Polar Daemon;c:\program files (x86)\Polar\Daemon\polard.exe;c:\program files (x86)\Polar\Daemon\polard.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 20:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-19 2188904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-19 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-19 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-19 439064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-19 11775592]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
Trusted Zone: hessen.de\hessenviewer
TCP: DhcpNameServer = 192.168.0.1
.
.
------- Dateityp-Verknüpfung -------
.
.reg=Regedit.Document
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_176_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_176_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_176_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_176_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_176.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_176.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_176.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_176.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\SysWOW64\rpcnet.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-08  00:27:13 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-09-07 22:27
.
Vor Suchlauf: 11 Verzeichnis(se), 23.847.165.952 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 23.682.674.688 Bytes frei
.
- - End Of File - - D2C7DD7FE69161DE67CB7D8267074EB5

schrauber · 08.09.2014, 19:04

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

JK1900 · 08.09.2014, 20:34

Hallo,

anbei die Logs:

MBAM

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 08.09.2014
Suchlauf-Zeit: 20:51:35
Logdatei: MBAM_Log.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.08.06
Rootkit Datenbank: v2014.08.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Millefiori-Offenbach

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 314706
Verstrichene Zeit: 14 Min, 46 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

ADWC
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.308 - Bericht erstellt am 28/08/2014 um 04:56:44
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Millefiori-Offenbach - MILLEFIORI
# Gestartet von : C:\Users\Millefiori-Offenbach\Downloads\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Google Chrome v

[ Datei : C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4235 octets] - [14/08/2014 21:00:10]
AdwCleaner[R1].txt - [1261 octets] - [28/08/2014 04:55:09]
AdwCleaner[S0].txt - [3476 octets] - [14/08/2014 21:02:55]
AdwCleaner[S1].txt - [1178 octets] - [28/08/2014 04:56:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1238 octets] ##########

--- --- ---
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.309 - Bericht erstellt am 08/09/2014 um 21:12:26
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Millefiori-Offenbach - MILLEFIORI
# Gestartet von : C:\Users\Millefiori-Offenbach\Desktop\adwcleaner_3.309.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Windows Genuine Advantage

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Google Chrome v37.0.2062.103

[ Datei : C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4235 octets] - [14/08/2014 21:00:10]
AdwCleaner[R1].txt - [2642 octets] - [28/08/2014 04:55:09]
AdwCleaner[S0].txt - [3476 octets] - [14/08/2014 21:02:55]
AdwCleaner[S1].txt - [2560 octets] - [28/08/2014 04:56:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2620 octets] ##########

--- --- ---

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Millefiori-Offenbach on 08.09.2014 at 21:20:04,75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.09.2014 at 21:25:53,16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRTS

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2014 01
Ran by Millefiori-Offenbach (administrator) on MILLEFIORI on 08-09-2014 21:26:41
Running from C:\Users\Millefiori-Offenbach\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files (x86)\Polar\Daemon\polard.exe
(Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-03-20] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-03-20] (Realtek Semiconductor)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-28] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3187200561-4197913244-2507983753-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE4C58813F5B7CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Program Files (x86)\TVUPlayer\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-09-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-09]

Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ch"
CHR DefaultSearchKeyword: Default -> C9DB8E8794956EA7CBF0DC075BAD8980086623FD6DDC2C6280AA4E613139DD31
CHR DefaultSearchProvider: Default -> 223D61478625299DC59F03D97043F98AD0658BA087D68017ECC84F7D0E30C0B3
CHR DefaultSearchURL: Default -> 449A75B9F3E97083D26A3C73D0E7897B67D8E40BB0E972FC9486FE28DDDFA140
CHR Profile: C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-08]
CHR Extension: (Google Docs) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-08]
CHR Extension: (Google Drive) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-08]
CHR Extension: (YouTube) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-08]
CHR Extension: (Google-Suche) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-08]
CHR Extension: (Google Tabellen) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-08]
CHR Extension: (Avira Browser Safety) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-08]
CHR Extension: (Google Wallet) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-08]
CHR Extension: (Google Mail) - C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-28] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 Polar Daemon; C:\Program Files (x86)\Polar\Daemon\polard.exe [419536 2012-12-12] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-28] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-28] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-21] ( )
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S4 nvpciflt; \SystemRoot\system32\DRIVERS\nvpciflt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-08 21:26 - 2014-09-08 21:26 - 00013790 _____ () C:\Users\Millefiori-Offenbach\Desktop\FRST.txt
2014-09-08 21:26 - 2014-09-08 21:26 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\FRST-OlderVersion
2014-09-08 21:25 - 2014-09-08 21:25 - 00000640 _____ () C:\Users\Millefiori-Offenbach\Desktop\JRT.txt
2014-09-08 21:15 - 2014-09-08 21:15 - 00002704 _____ () C:\Users\Millefiori-Offenbach\Desktop\AdwCleaner[S1].txt
2014-09-08 21:13 - 2014-09-08 21:13 - 00000522 _____ () C:\Windows\PFRO.log
2014-09-08 20:54 - 2014-09-08 20:55 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\old
2014-09-08 20:54 - 2014-09-08 20:54 - 01016261 _____ (Thisisu) C:\Users\Millefiori-Offenbach\Desktop\JRT.exe
2014-09-08 20:52 - 2014-09-08 20:52 - 01370483 _____ () C:\Users\Millefiori-Offenbach\Desktop\adwcleaner_3.309.exe
2014-09-08 19:16 - 2014-09-08 21:21 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-08 19:16 - 2014-09-08 19:16 - 00004134 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-09-08 19:16 - 2014-09-08 19:16 - 00002253 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-08 19:16 - 2014-09-08 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-09-08 19:15 - 2014-09-08 21:13 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-08 19:15 - 2014-09-08 19:15 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-09-08 19:14 - 2014-09-08 19:15 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Deployment
2014-09-08 19:14 - 2014-09-08 19:15 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Apps\2.0
2014-09-08 19:10 - 2014-09-08 21:13 - 00000112 _____ () C:\Windows\setupact.log
2014-09-08 19:10 - 2014-09-08 19:10 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-08 18:50 - 2014-09-08 18:50 - 00000000 _____ () C:\Users\Millefiori-Offenbach\defogger_reenable
2014-09-08 00:27 - 2014-09-08 00:27 - 00018621 _____ () C:\ComboFix.txt
2014-09-08 00:05 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-08 00:05 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-08 00:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-08 00:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-08 00:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-08 00:05 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-08 00:05 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-08 00:05 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-07 23:57 - 2014-09-08 00:27 - 00000000 ____D () C:\Qoobox
2014-09-07 23:56 - 2014-09-08 00:24 - 00000000 ____D () C:\Windows\erdnt
2014-09-07 23:49 - 2014-09-07 23:49 - 05576440 ____R (Swearware) C:\Users\Millefiori-Offenbach\Desktop\ComboFix.exe
2014-09-07 12:35 - 2014-09-08 21:26 - 00000000 ____D () C:\FRST
2014-09-07 12:32 - 2014-09-07 12:32 - 00380416 _____ () C:\Users\Millefiori-Offenbach\Desktop\nmhkwv5n.exe
2014-09-07 12:31 - 2014-09-08 21:26 - 02105344 _____ (Farbar) C:\Users\Millefiori-Offenbach\Desktop\FRST64.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 00050477 _____ () C:\Users\Millefiori-Offenbach\Desktop\Defogger.exe
2014-08-31 22:36 - 2014-08-31 22:41 - 00722432 _____ () C:\Users\Millefiori-Offenbach\Desktop\Baufi - Haus.xls
2014-08-31 08:11 - 2014-08-31 08:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 08:06 - 2014-08-31 08:06 - 05952624 _____ ( ) C:\Users\Millefiori-Offenbach\Downloads\adblockplusie-1.2.exe
2014-08-29 17:40 - 2014-08-29 17:40 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-29 17:39 - 2014-08-29 17:39 - 04901352 _____ (Piriform Ltd) C:\Users\Millefiori-Offenbach\Downloads\ccsetup417.exe
2014-08-28 23:16 - 2014-08-28 23:16 - 00559784 _____ () C:\Users\Millefiori-Offenbach\Documents\Präsentation1.pptx
2014-08-28 19:06 - 2014-09-01 22:08 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Downloads\Lachwiesen
2014-08-28 14:56 - 2014-08-28 14:56 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 14:56 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 14:54 - 2014-08-28 14:52 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-08-28 14:51 - 2014-08-28 14:51 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 14:50 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 14:50 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Avira
2014-08-28 14:50 - 2014-08-28 14:52 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-28 14:50 - 2014-08-28 14:52 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-28 14:50 - 2014-02-25 11:41 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-08-28 08:33 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 08:33 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 08:33 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 08:06 - 2014-08-28 08:06 - 00002884 _____ () C:\Users\Millefiori-Offenbach\Desktop\HitmanPro_20140828_0806.log
2014-08-28 07:59 - 2014-08-28 08:06 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-08-28 03:59 - 2014-08-28 04:21 - 00000000 ____D () C:\ProgramData\OqiyFuba
2014-08-24 00:18 - 2014-08-25 18:37 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\DKB Bank
2014-08-22 01:43 - 2014-08-22 01:43 - 18439741 _____ (Bauskript Software) C:\Users\Millefiori-Offenbach\Downloads\bauskript.exe
2014-08-17 09:47 - 2014-08-21 20:53 - 00013536 _____ () C:\Users\Millefiori-Offenbach\Desktop\20140817 Investrechnung Immobilie.xlsx
2014-08-16 21:19 - 2014-08-20 15:05 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\D
2014-08-15 17:30 - 2014-08-15 17:30 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 09:19 - 2014-07-21 16:31 - 00763912 ____N (Hewlett-Packard Development Company, LP) C:\Windows\system32\HPDiscoPM7112.dll
2014-08-15 09:17 - 2014-08-15 09:17 - 40247720 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8610 Treiber.exe
2014-08-15 09:07 - 2014-08-15 09:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-15 09:07 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM5912.dll
2014-08-15 09:06 - 2014-08-15 09:06 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-08-15 09:05 - 2014-08-15 09:05 - 31455000 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8600 Treiber.exe
2014-08-14 21:39 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 21:39 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 21:39 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 21:39 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 21:39 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 21:39 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-14 21:38 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 21:38 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 21:37 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 21:37 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 21:37 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 21:37 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 21:37 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-14 21:37 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 21:37 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 21:37 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-14 21:37 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-14 21:37 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 21:37 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-14 21:37 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 21:37 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 21:37 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 21:37 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 21:37 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-14 21:37 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-14 21:37 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-14 21:37 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-14 21:37 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 21:37 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-14 21:37 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 21:37 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-14 21:37 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-14 21:37 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 21:37 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-14 21:37 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 21:37 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 21:37 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 21:37 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 21:37 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 21:37 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 21:37 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 21:37 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-14 21:37 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-14 21:37 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 21:37 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 21:37 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 21:37 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-14 21:37 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 21:37 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 21:37 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-14 21:37 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 21:37 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 21:37 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 21:37 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 21:37 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 21:37 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 21:37 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-14 21:37 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 21:37 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 21:37 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 21:37 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-14 21:37 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-14 21:37 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 21:37 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 21:36 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 21:36 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 21:36 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 21:36 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 21:36 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 21:36 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 21:36 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 21:36 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 21:36 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-14 21:08 - 2014-08-14 21:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-14 21:00 - 2014-09-08 21:12 - 00000000 ____D () C:\AdwCleaner
2014-08-14 21:00 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-14 20:31 - 2014-09-08 20:51 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-14 20:31 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-14 20:31 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-14 20:31 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-14 20:29 - 2014-08-14 20:29 - 00008833 _____ () C:\Users\Millefiori-Offenbach\Downloads\bookmark.htm
2014-08-14 20:14 - 2014-08-14 20:14 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-13 22:38 - 2014-08-14 20:17 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-13 22:38 - 2014-08-14 20:17 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-08-13 22:38 - 2014-08-14 19:59 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 20:31 - 2014-08-13 20:31 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-13 20:31 - 2014-08-13 20:31 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-08-13 19:42 - 2014-08-13 19:42 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-13 19:34 - 2014-08-14 20:20 - 00000000 ____D () C:\ProgramData\Nero
2014-08-13 19:33 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-08-13 19:32 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-08-13 19:14 - 2014-08-13 22:40 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-12 22:50 - 2014-08-12 22:50 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-08-12 22:49 - 2014-08-12 22:49 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 21:03 - 2014-08-10 21:03 - 38603216 _____ (Amazon) C:\Users\Millefiori-Offenbach\Downloads\AmazonMusicInstaller.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-08 21:27 - 2014-09-08 21:26 - 00013790 _____ () C:\Users\Millefiori-Offenbach\Desktop\FRST.txt
2014-09-08 21:26 - 2014-09-08 21:26 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\FRST-OlderVersion
2014-09-08 21:26 - 2014-09-07 12:35 - 00000000 ____D () C:\FRST
2014-09-08 21:26 - 2014-09-07 12:31 - 02105344 _____ (Farbar) C:\Users\Millefiori-Offenbach\Desktop\FRST64.exe
2014-09-08 21:25 - 2014-09-08 21:25 - 00000640 _____ () C:\Users\Millefiori-Offenbach\Desktop\JRT.txt
2014-09-08 21:22 - 2012-07-13 16:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-08 21:21 - 2014-09-08 19:16 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-08 21:15 - 2014-09-08 21:15 - 00002704 _____ () C:\Users\Millefiori-Offenbach\Desktop\AdwCleaner[S1].txt
2014-09-08 21:13 - 2014-09-08 21:13 - 00000522 _____ () C:\Windows\PFRO.log
2014-09-08 21:13 - 2014-09-08 19:15 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-08 21:13 - 2014-09-08 19:10 - 00000112 _____ () C:\Windows\setupact.log
2014-09-08 21:13 - 2011-05-21 22:31 - 00058288 _____ (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.dll
2014-09-08 21:13 - 2011-03-20 01:20 - 00017920 _____ () C:\Windows\system32\rpcnetp.exe
2014-09-08 21:13 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-08 21:12 - 2014-08-14 21:00 - 00000000 ____D () C:\AdwCleaner
2014-09-08 21:12 - 2011-03-20 01:26 - 01758532 _____ () C:\Windows\WindowsUpdate.log
2014-09-08 21:12 - 2009-07-14 06:45 - 00010336 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-08 21:12 - 2009-07-14 06:45 - 00010336 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-08 20:55 - 2014-09-08 20:54 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\old
2014-09-08 20:54 - 2014-09-08 20:54 - 01016261 _____ (Thisisu) C:\Users\Millefiori-Offenbach\Desktop\JRT.exe
2014-09-08 20:52 - 2014-09-08 20:52 - 01370483 _____ () C:\Users\Millefiori-Offenbach\Desktop\adwcleaner_3.309.exe
2014-09-08 20:51 - 2014-08-14 20:31 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-08 19:16 - 2014-09-08 19:16 - 00004134 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-09-08 19:16 - 2014-09-08 19:16 - 00002253 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-08 19:16 - 2014-09-08 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-09-08 19:16 - 2011-03-20 02:01 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-08 19:15 - 2014-09-08 19:15 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-09-08 19:15 - 2014-09-08 19:14 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Deployment
2014-09-08 19:15 - 2014-09-08 19:14 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Apps\2.0
2014-09-08 19:15 - 2011-05-21 18:36 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Google
2014-09-08 19:10 - 2014-09-08 19:10 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-08 18:50 - 2014-09-08 18:50 - 00000000 _____ () C:\Users\Millefiori-Offenbach\defogger_reenable
2014-09-08 18:50 - 2011-05-21 18:32 - 00000000 ____D () C:\Users\Millefiori-Offenbach
2014-09-08 00:27 - 2014-09-08 00:27 - 00018621 _____ () C:\ComboFix.txt
2014-09-08 00:27 - 2014-09-07 23:57 - 00000000 ____D () C:\Qoobox
2014-09-08 00:24 - 2014-09-07 23:56 - 00000000 ____D () C:\Windows\erdnt
2014-09-08 00:18 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-07 23:49 - 2014-09-07 23:49 - 05576440 ____R (Swearware) C:\Users\Millefiori-Offenbach\Desktop\ComboFix.exe
2014-09-07 12:32 - 2014-09-07 12:32 - 00380416 _____ () C:\Users\Millefiori-Offenbach\Desktop\nmhkwv5n.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 00050477 _____ () C:\Users\Millefiori-Offenbach\Desktop\Defogger.exe
2014-09-03 19:37 - 2014-04-29 11:41 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Bewerbung
2014-09-01 22:08 - 2014-08-28 19:06 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Downloads\Lachwiesen
2014-08-31 22:41 - 2014-08-31 22:36 - 00722432 _____ () C:\Users\Millefiori-Offenbach\Desktop\Baufi - Haus.xls
2014-08-31 08:11 - 2014-08-31 08:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 08:10 - 2012-01-20 21:32 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Desktop 20120120
2014-08-31 08:06 - 2014-08-31 08:06 - 05952624 _____ ( ) C:\Users\Millefiori-Offenbach\Downloads\adblockplusie-1.2.exe
2014-08-29 17:42 - 2012-07-13 10:52 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\CC_reg_clean
2014-08-29 17:40 - 2014-08-29 17:40 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-29 17:40 - 2012-07-13 10:38 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-29 17:39 - 2014-08-29 17:39 - 04901352 _____ (Piriform Ltd) C:\Users\Millefiori-Offenbach\Downloads\ccsetup417.exe
2014-08-28 23:16 - 2014-08-28 23:16 - 00559784 _____ () C:\Users\Millefiori-Offenbach\Documents\Präsentation1.pptx
2014-08-28 14:56 - 2014-08-28 14:56 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 14:56 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 14:56 - 2014-08-28 14:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 14:56 - 2014-08-28 14:50 - 00000000 ____D () C:\ProgramData\Avira
2014-08-28 14:56 - 2014-04-06 14:45 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-28 14:52 - 2014-08-28 14:54 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-08-28 14:52 - 2014-08-28 14:50 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-28 14:52 - 2014-08-28 14:50 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-28 14:51 - 2014-08-28 14:51 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 08:38 - 2009-07-14 06:45 - 00353608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 08:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-28 08:22 - 2014-04-29 12:06 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Schriftstücke misc
2014-08-28 08:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-28 08:06 - 2014-08-28 08:06 - 00002884 _____ () C:\Users\Millefiori-Offenbach\Desktop\HitmanPro_20140828_0806.log
2014-08-28 08:06 - 2014-08-28 07:59 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-08-28 04:33 - 2014-04-29 11:43 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\CCRM
2014-08-28 04:21 - 2014-08-28 03:59 - 00000000 ____D () C:\ProgramData\OqiyFuba
2014-08-25 18:37 - 2014-08-24 00:18 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\DKB Bank
2014-08-23 04:07 - 2014-08-28 08:33 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 08:33 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 08:33 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 10:18 - 2009-08-04 11:51 - 00714632 _____ () C:\Windows\system32\perfh007.dat
2014-08-22 10:18 - 2009-08-04 11:51 - 00154580 _____ () C:\Windows\system32\perfc007.dat
2014-08-22 10:18 - 2009-07-14 07:13 - 01660160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-22 01:43 - 2014-08-22 01:43 - 18439741 _____ (Bauskript Software) C:\Users\Millefiori-Offenbach\Downloads\bauskript.exe
2014-08-21 20:53 - 2014-08-17 09:47 - 00013536 _____ () C:\Users\Millefiori-Offenbach\Desktop\20140817 Investrechnung Immobilie.xlsx
2014-08-20 15:05 - 2014-08-16 21:19 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\D
2014-08-15 17:30 - 2014-08-15 17:30 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 09:19 - 2014-08-15 09:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-15 09:19 - 2014-07-21 19:20 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\HP
2014-08-15 09:17 - 2014-08-15 09:17 - 40247720 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8610 Treiber.exe
2014-08-15 09:06 - 2014-08-15 09:06 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\ProgramData\HP
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\Program Files\HP
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-15 09:05 - 2014-08-15 09:05 - 31455000 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8600 Treiber.exe
2014-08-15 08:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-14 22:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 21:47 - 2014-04-06 16:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 21:44 - 2011-05-21 23:04 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 21:30 - 2014-04-08 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-14 21:29 - 2014-08-14 21:29 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-14 21:08 - 2014-08-14 21:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-14 20:51 - 2014-05-04 11:26 - 00000000 ____D () C:\Windows\pss
2014-08-14 20:50 - 2014-05-26 23:44 - 00000000 ____D () C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-14 20:29 - 2014-08-14 20:29 - 00008833 _____ () C:\Users\Millefiori-Offenbach\Downloads\bookmark.htm
2014-08-14 20:20 - 2014-08-13 19:34 - 00000000 ____D () C:\ProgramData\Nero
2014-08-14 20:17 - 2014-08-13 22:38 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-14 20:17 - 2014-08-13 22:38 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-08-14 20:14 - 2014-08-14 20:14 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-14 19:59 - 2014-08-13 22:38 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 22:40 - 2014-08-13 19:14 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-13 22:07 - 2012-07-13 16:42 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-13 22:07 - 2012-07-13 16:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-13 22:07 - 2012-07-13 16:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-13 20:31 - 2014-08-13 20:31 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-13 20:31 - 2014-08-13 20:31 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-08-13 19:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-13 19:42 - 2014-08-13 19:42 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-12 22:50 - 2014-08-12 22:50 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-08-12 22:49 - 2014-08-12 22:49 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 21:03 - 2014-08-10 21:03 - 38603216 _____ (Amazon) C:\Users\Millefiori-Offenbach\Downloads\AmazonMusicInstaller.exe

Some content of TEMP:
====================
C:\Users\Millefiori-Offenbach\AppData\Local\Temp\avgnt.exe
C:\Users\Millefiori-Offenbach\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 10:42

==================== End Of Log ============================

--- --- ---

Weiterhin vielen Dank!

schrauber · 09.09.2014, 20:32

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Widows 7: Trojaner Befall Mitte August mit Anti-Malware entfernt system aber immernoch langsam

Log-Analyse und Auswertung: Widows 7: Trojaner Befall Mitte August mit Anti-Malware entfernt system aber immernoch langsam