Virus eingefangen

illhardt · 25.09.2014, 20:35

Hallo,

habe mir sicherlich einen Virus eingefangen. Wenn ich eine Webseite aufrufe hinterlegt er verschiedene Wörter blau und wenn ich drauf gehe, macht er kleine fenster auf.

hier die beiden Dateien

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 25-09-2014 01
Ran by Rene at 2014-09-25 21:16:57
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adblock Plus für IE (32-Bit) (HKLM\...\{8CF6A3B1-8799-4F0C-AC2A-1F53D31B143F}) (Version: 99.9 - Eyeo GmbH)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Adobe Shockwave Player 11 (HKLM\...\Adobe Shockwave Player) (Version: 11 - Adobe Systems, Inc.)
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
Badaboom 1.1.1.194 (HKLM\...\Badaboom) (Version: 1.1.1.194 - Elemental Technologies)
Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden
Corel Home Office - IPM (Version: 5.0 - Corel Corporation) Hidden
Corel Home Office - Launcher (Version: 5.0.45 - Corel Corporation) Hidden
Corel Home Office - Templates1 (Version: 5 - Your Company Name) Hidden
Corel Home Office (Version: 5.0.56 - Corel Corporation) Hidden
Corel Home Office 5.0.56 (HKLM\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version:  - Corel Corporation)
Corel Home Office 5.0.56 (Version: 5.0.56 - Corel Corporation) Hidden
Corel Painter Essentials 4 (HKLM\...\_{E1A63F75-1F72-4450-980D-434496FFC646}) (Version:  - Corel Corporation)
Corel Painter Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CostMin (HKLM\...\{F6EF44E0-CA47-4F41-8C06-431C005AAEFE}) (Version: 4.3.0.1648 - CostMin)
CyberLink MediaShow (HKLM\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.2325 - CyberLink Corp.)
CyberLink MediaShow (Version: 4.1.2325 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.5615 - CyberLink Corp.)
CyberLink PhotoNow (Version: 1.1.5615 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2625 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2625 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2606a - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2606a - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1412 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1412 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.2521 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.2521 - CyberLink Corp.) Hidden
Dell C1765 Color MFP (HKLM\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)
Dell C1765 Color MFP (Version: 1.039.0 - Dell Inc.) Hidden
e-Wörterbücher (HKLM\...\{4737AD9F-13AA-4E4C-B86F-B631D557F6A7}) (Version:  - )
Finger-sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.4.1.5 - FSP)
Foxlink Webcam (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.51000.202_WHQL - Sonix)
Google Earth (HKLM\...\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}) (Version: 4.3.7284.3916 - Google)
Google Updater (HKLM\...\Google Updater) (Version: 2.4.1487.6512 - Google Inc.)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java(TM) 6 Update 13 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216013FF}) (Version: 6.0.130 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mobogenie (HKLM\...\Mobogenie) (Version:  - Mobogenie.com) <==== ATTENTION
Mozilla Firefox 32.0.1 (x86 de) (HKLM\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
neroxml (Version: 1.0.0 - Nero AG) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
Picasa 2 (HKLM\...\Picasa2) (Version: 2.0 - Google, Inc.)
QuickTime (HKLM\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5730 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20111 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.01.0092 - REALTEK Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
The weDownload Manager (HKLM\...\The weDownload Manager) (Version: 1.34.2.13 - weDownload) <==== ATTENTION
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8051.1204 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-08-2014 08:24:49 Windows Update
16-08-2014 09:06:43 Windows Update
17-08-2014 15:22:16 Windows Update
21-08-2014 15:29:34 Windows Update
25-08-2014 15:02:24 Windows Update
31-08-2014 15:24:07 Windows Update
31-08-2014 15:24:26 Removed Del Ad for Internet Explorer 3.1
31-08-2014 15:32:55 Windows Update
31-08-2014 15:51:19 Installed Adblock Plus for IE (32-bit)
06-09-2014 13:54:40 Windows Update
15-09-2014 19:18:07 Windows Update
15-09-2014 20:57:14 Wiederherstellungsvorgang
15-09-2014 21:09:38 Windows Update
15-09-2014 21:37:22 Windows Update
16-09-2014 17:05:59 Geplanter Prüfpunkt
16-09-2014 18:07:25 Microsoft Office 2000 Professional wird installiert
16-09-2014 19:05:48 Microsoft Office 2000 Professional wird entfernt
16-09-2014 19:13:08 Installed Microsoft Office Enterprise 2007
16-09-2014 19:36:05 Removed Microsoft Office Enterprise 2007
16-09-2014 19:40:03 Compatibility Pack für 2007 Office System wird entfernt
16-09-2014 19:41:39 Microsoft Office PowerPoint Viewer 2007 (German) wird entfernt
16-09-2014 19:42:54 Removed Microsoft Office Home and Student 2007
16-09-2014 19:47:26 Microsoft Office Live Add-in 1.5 wird entfernt
16-09-2014 19:51:19 Installed Microsoft Office Enterprise 2007
17-09-2014 01:00:27 Windows Update
25-09-2014 18:21:46 Windows Update
25-09-2014 18:24:39 Windows Update
25-09-2014 18:42:37 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {99F881F4-D987-4768-933F-213A24E6C167} - System32\Tasks\The weDownload Manager-codedownloader => C:\Program Files\The weDownload Manager\The weDownload Manager-codedownloader.exe [2014-03-23] (weDownload) <==== ATTENTION
Task: {9BA38F40-047E-4BFF-A997-784E6D384FE9} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-17] (Google)
Task: {A6710F42-CA3E-46D6-98FF-4796E0437D0D} - System32\Tasks\The weDownload Manager-firefoxinstaller => C:\Program Files\The weDownload Manager\The weDownload Manager-firefoxinstaller.exe [2014-03-23] (weDownload) <==== ATTENTION
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {C39B37D7-8E17-4070-ACE4-7BFEB27EB404} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-25] (Adobe Systems Incorporated)
Task: {CF2B434F-2604-46E2-A9E5-8DDBD0E1CE17} - System32\Tasks\The weDownload Manager-updater => C:\Program Files\The weDownload Manager\The weDownload Manager-updater.exe [2014-03-23] (weDownload) <==== ATTENTION
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {F273AF1F-7892-4874-B706-C2ABC5879394} - System32\Tasks\The weDownload Manager-chromeinstaller => C:\Program Files\The weDownload Manager\The weDownload Manager-chromeinstaller.exe [2014-03-23] (weDownload) <==== ATTENTION
Task: {F5157BEF-37D9-4CAC-B0B5-624D2B289C84} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {FBC9D552-EB0E-4B99-A4E8-934746BD2B76} - System32\Tasks\The weDownload Manager-enabler => C:\Program Files\The weDownload Manager\The weDownload Manager-enabler.exe [2014-03-23] (weDownload) <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\The weDownload Manager-chromeinstaller.job => C:\Program Files\The weDownload Manager\The weDownload Manager-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\The weDownload Manager-codedownloader.job => C:\Program Files\The weDownload Manager\The weDownload Manager-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\The weDownload Manager-enabler.job => C:\Program Files\The weDownload Manager\The weDownload Manager-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\The weDownload Manager-firefoxinstaller.job => C:\Program Files\The weDownload Manager\The weDownload Manager-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\The weDownload Manager-updater.job => C:\Program Files\The weDownload Manager\The weDownload Manager-updater.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2013-02-06 18:37 - 2013-02-06 18:37 - 00191464 _____ () C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
2014-03-23 11:12 - 2014-07-22 22:05 - 00105664 _____ () C:\Program Files\Mobogenie\MgAssist.exe
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2009-06-10 14:57 - 2008-10-29 16:20 - 00070656 _____ () C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
2009-06-10 14:58 - 2009-03-05 18:54 - 00311296 _____ () C:\Windows\SYSTEM32\Rezip.exe
2009-06-10 22:13 - 2009-02-25 08:13 - 00247152 _____ () C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2009-06-10 15:00 - 2008-08-28 15:03 - 00233472 _____ () C:\Windows\tsnp2uvc.exe
2009-06-08 18:14 - 2009-02-17 12:26 - 00053248 _____ () C:\Program Files\FSP\KbdHook.dll
2009-06-08 18:14 - 2009-04-23 15:29 - 00073728 _____ () C:\Program Files\FSP\FspLib.dll
2014-03-23 11:12 - 2014-07-20 15:16 - 00748736 _____ () C:\Program Files\Mobogenie\DaemonProcess.exe
2014-03-23 11:12 - 2014-07-20 15:16 - 00065728 _____ () C:\Program Files\Mobogenie\Device.dll
2014-03-23 11:12 - 2014-07-20 15:16 - 00474816 _____ () C:\Program Files\Mobogenie\DCR.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\21871ce315d4257cfe2052454e583368\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-03-23 11:24 - 2014-03-23 11:24 - 14971904 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\c94e1e76e67ad518b4310a539f072832\Kies.Theme.ni.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 01842688 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\0107366ee1ddeb3e9873c6fac6344bc1\Kies.UI.ni.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\8375369d3ac9c732c2ec8f6b5c9f2bb8\Kies.MVVM.ni.dll
2014-03-23 11:24 - 2014-03-23 11:24 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2014-01-12 22:06 - 2012-06-07 18:48 - 00019968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dltfm1zPP.dll
2014-01-12 22:06 - 2013-02-01 16:55 - 12875264 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\dlthm1zRC.DLL
2014-09-16 22:05 - 2014-09-16 22:06 - 03716720 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-09-16 00:43 - 2014-09-16 00:43 - 16825520 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1863392313-3708449669-3860219250-500 - Disabled - Status: Degraded)
Anika (S-1-5-21-1863392313-3708449669-3860219250-1001 - Enabled - Status: OK) => C:\Users\Anika
Gast (S-1-5-21-1863392313-3708449669-3860219250-501 - Disabled - Status: Degraded)
Rene (S-1-5-21-1863392313-3708449669-3860219250-1000 - Enabled - Status: OK) => C:\Users\Rene

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/16/2014 09:51:18 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {cc131f26-b38f-457b-b9e6-97401f7682b8}

Error: (09/16/2014 09:42:53 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {cc131f26-b38f-457b-b9e6-97401f7682b8}

Error: (09/16/2014 09:36:04 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {cc131f26-b38f-457b-b9e6-97401f7682b8}

Error: (09/16/2014 09:26:01 PM) (Source: MsiInstaller) (EventID: 11500) (User: Rene-PC)
Description: Produkt: Microsoft Office Enterprise 2007 -- Fehler 1500.Zurzeit wird eine andere Installation ausgeführt. Sie müssen erst die andere Installation abschließen, bevor Sie diese Installation fortsetzen können.

Error: (09/16/2014 09:22:58 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Kontext:  Anwendung, SystemIndex Katalog

Error: (09/16/2014 09:22:58 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Error: (09/16/2014 09:13:07 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {cc131f26-b38f-457b-b9e6-97401f7682b8}

Error: (09/16/2014 06:29:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2014 11:17:36 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\RENE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M6PTL3Y6.DEFAULT-1406321759494\EXTENSIONS\B1AC2FF7-8E51-4BB6-8BF8-87F1D567919A@4BB97481-AEAD-4C2E-A62B-E25E264651BB.COM\EXTENSIONDATA\USERCODE> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (09/15/2014 11:17:36 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\RENE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M6PTL3Y6.DEFAULT-1406321759494\EXTENSIONS\B1AC2FF7-8E51-4BB6-8BF8-87F1D567919A@4BB97481-AEAD-4C2E-A62B-E25E264651BB.COM\EXTENSIONDATA\USERCODE> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)


System errors:
=============
Error: (09/25/2014 08:46:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053

Error: (09/25/2014 08:46:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search

Error: (09/25/2014 08:45:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053

Error: (09/25/2014 08:45:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search

Error: (09/25/2014 08:44:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053

Error: (09/25/2014 08:44:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search

Error: (09/25/2014 08:44:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053

Error: (09/25/2014 08:44:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search

Error: (09/25/2014 08:41:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053

Error: (09/25/2014 08:41:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T6500 @ 2.10GHz
Percentage of memory in use: 64%
Total physical RAM: 3065.95 MB
Available physical RAM: 1099.84 MB
Total Pagefile: 6338.22 MB
Available Pagefile: 4284.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1909.16 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:268.79 GB) (Free:192.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:29.28 GB) (Free:14.35 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 9338ECFC)
Partition 1: (Active) - (Size=268.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=29.3 GB) - (Type=0C)

==================== End Of Log ============================

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-09-2014 01
Ran by Rene (administrator) on RENE-PC on 25-09-2014 21:16:29
Running from C:\Users\Rene\Downloads
Loaded Profile: Rene (Available profiles: Rene & Anika)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
() C:\Program Files\Mobogenie\MgAssist.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Windows\System32\PSIService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
() C:\Windows\System32\Rezip.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google) C:\Windows\Temp\gis36a2f3\GoogleUpdater.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
() C:\Program Files\Mobogenie\DaemonProcess.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dell Inc.) C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-02-11] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [745472 2009-05-07] (Sentelic Corporation)
HKLM\...\Run: [MDS_Menu] => C:\Program Files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe [50472 2007-12-14] ()
HKLM\...\Run: [UCam_Menu] => C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe [748736 2014-07-20] ()
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [NextLive] => C:\Windows\system32\rundll32.exe "C:\Users\Rene\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-12-11] (Samsung)
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
BHO: CostMin -> {0E50CF5A-6008-E265-37E6-3D7207A01F3B} -> C:\Program Files\CostMin\1mbE.dll ()
BHO: The weDownload Manager -> {11111111-1111-1111-1111-110411901174} -> C:\Program Files\The weDownload Manager\The weDownload Manager-bho.dll (weDownload)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: No Name -> {84FF7BD6-B47F-46F8-9130-01B2696B36CB} ->  No File
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=13 -> C:\Program Files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll (Google)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\user.js
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\webssearches.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: The weDownload Manager - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb(105).com [2014-09-15]
FF Extension: The weDownload Manager - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com [2014-09-16]
FF Extension: Fast Start - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\faststartff@gmail.com [2014-09-15]
FF Extension: Adblock Plus - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-16]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-01-12]

Chrome: 
=======
CHR CustomProfile: C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecoccdldklbjglocbgbfpmpehjegkode [2014-05-04]
CHR Extension: (CostMin) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm [2014-03-23]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()
R2 MgAssistService; C:\Program Files\Mobogenie\MgAssist.exe [105664 2014-07-22] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
R2 Rezip; C:\Windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [247152 2009-02-25] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799808 2008-12-29] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-25 21:14 - 2014-09-25 21:16 - 00032687 _____ () C:\Users\Rene\Downloads\Addition.txt
2014-09-25 21:13 - 2014-09-25 21:16 - 00013687 _____ () C:\Users\Rene\Downloads\FRST.txt
2014-09-25 21:13 - 2014-09-25 21:16 - 00000000 ____D () C:\FRST
2014-09-25 21:12 - 2014-09-25 21:12 - 01100800 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2014-09-25 21:11 - 2014-09-25 21:15 - 00000470 _____ () C:\Users\Rene\Downloads\defogger_disable.log
2014-09-25 21:11 - 2014-09-25 21:11 - 00050477 _____ () C:\Users\Rene\Downloads\Defogger.exe
2014-09-25 21:11 - 2014-09-25 21:11 - 00000000 _____ () C:\Users\Rene\defogger_reenable
2014-09-25 20:46 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-25 20:35 - 2014-09-25 20:35 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-09-25 20:22 - 2014-09-25 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-09-16 22:05 - 2014-09-25 20:46 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-16 21:59 - 2014-09-25 20:22 - 00002633 _____ () C:\Users\Rene\Desktop\Microsoft Office Excel 2007.lnk
2014-09-16 21:59 - 2014-09-16 21:59 - 00002631 _____ () C:\Users\Rene\Desktop\Microsoft Office Word 2007.lnk
2014-09-16 21:55 - 2014-09-16 21:55 - 00000000 ____D () C:\Program Files\Microsoft Visual Studio
2014-09-16 21:51 - 2014-09-16 21:51 - 00000000 __RHD () C:\MSOCache
2014-09-16 20:14 - 2014-09-16 20:14 - 00000403 _____ () C:\Windows\ODBC.INI
2014-09-16 20:10 - 2014-09-16 20:10 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft Web Folders
2014-09-15 23:48 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-15 23:48 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-15 23:48 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-15 23:48 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-15 23:48 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-15 23:48 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-15 23:48 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-15 23:48 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-15 23:48 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-15 23:47 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-15 21:18 - 2014-09-15 21:28 - 00000000 ____D () C:\408e71e1a45e60e961
2014-09-15 21:17 - 2014-09-15 21:17 - 00000000 ____D () C:\ProgramData\2308189059
2014-09-15 21:12 - 2014-09-15 23:07 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-09-15 21:12 - 2014-09-15 22:37 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-09-15 21:12 - 2014-09-15 21:40 - 00000000 ____D () C:\Program Files\RockResult
2014-09-15 21:12 - 2014-09-15 21:12 - 00000000 ____D () C:\Users\Rene\Documents\Optimizer Pro
2014-09-15 21:12 - 2014-09-15 21:12 - 00000000 ____D () C:\Program Files\SupTab
2014-08-31 18:26 - 2014-08-31 18:26 - 00000947 _____ () C:\Users\Rene\Desktop\Launch Internet Explorer Browser.lnk
2014-08-31 18:16 - 2014-08-31 18:17 - 00603462 _____ () C:\Users\Anika\Downloads\Setup(1).exe.part
2014-08-31 18:16 - 2014-08-31 18:16 - 00578304 _____ () C:\Users\Anika\Downloads\Java_install(2).exe
2014-08-31 18:14 - 2014-08-31 18:14 - 00578304 _____ () C:\Users\Anika\Downloads\Java_install.exe
2014-08-31 18:14 - 2014-08-31 18:14 - 00578304 _____ () C:\Users\Anika\Downloads\Java_install(1).exe
2014-08-31 18:02 - 2014-08-31 18:08 - 00000000 ____D () C:\Users\Anika\AppData\Local\RocketTab
2014-08-31 17:51 - 2014-08-31 17:51 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 17:33 - 2014-08-23 03:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-31 17:33 - 2014-08-23 01:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-25 21:16 - 2014-09-25 21:14 - 00032687 _____ () C:\Users\Rene\Downloads\Addition.txt
2014-09-25 21:16 - 2014-09-25 21:13 - 00013687 _____ () C:\Users\Rene\Downloads\FRST.txt
2014-09-25 21:16 - 2014-09-25 21:13 - 00000000 ____D () C:\FRST
2014-09-25 21:15 - 2014-09-25 21:11 - 00000470 _____ () C:\Users\Rene\Downloads\defogger_disable.log
2014-09-25 21:12 - 2014-09-25 21:12 - 01100800 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2014-09-25 21:11 - 2014-09-25 21:11 - 00050477 _____ () C:\Users\Rene\Downloads\Defogger.exe
2014-09-25 21:11 - 2014-09-25 21:11 - 00000000 _____ () C:\Users\Rene\defogger_reenable
2014-09-25 21:11 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene
2014-09-25 21:06 - 2014-01-12 17:19 - 01773097 _____ () C:\Windows\WindowsUpdate.log
2014-09-25 20:47 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-25 20:46 - 2014-09-16 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 20:46 - 2009-06-10 17:02 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-25 20:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-09-25 20:44 - 2006-11-02 12:23 - 00000240 _____ () C:\Windows\win.ini
2014-09-25 20:43 - 2014-03-28 17:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-25 20:35 - 2014-09-25 20:35 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-09-25 20:27 - 2014-01-12 18:53 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-25 20:27 - 2006-11-02 14:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-25 20:27 - 2006-11-02 14:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-25 20:23 - 2006-11-02 14:52 - 00194180 _____ () C:\Windows\setupact.log
2014-09-25 20:22 - 2014-09-25 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-09-25 20:22 - 2014-09-16 21:59 - 00002633 _____ () C:\Users\Rene\Desktop\Microsoft Office Excel 2007.lnk
2014-09-25 20:21 - 2014-03-28 17:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-25 20:21 - 2014-03-28 17:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-25 20:21 - 2014-03-23 11:12 - 00001608 _____ () C:\Windows\Tasks\The weDownload Manager-updater.job
2014-09-25 20:21 - 2014-03-23 11:12 - 00001564 _____ () C:\Windows\Tasks\The weDownload Manager-codedownloader.job
2014-09-25 20:21 - 2014-03-23 11:12 - 00001462 _____ () C:\Windows\Tasks\The weDownload Manager-enabler.job
2014-09-25 20:21 - 2014-03-23 11:11 - 00003122 _____ () C:\Windows\Tasks\The weDownload Manager-chromeinstaller.job
2014-09-25 20:21 - 2014-03-23 11:11 - 00002546 _____ () C:\Windows\Tasks\The weDownload Manager-firefoxinstaller.job
2014-09-25 20:21 - 2009-06-17 10:21 - 00000868 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-09-17 03:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-09-16 21:59 - 2014-09-16 21:59 - 00002631 _____ () C:\Users\Rene\Desktop\Microsoft Office Word 2007.lnk
2014-09-16 21:58 - 2009-06-10 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-09-16 21:55 - 2014-09-16 21:55 - 00000000 ____D () C:\Program Files\Microsoft Visual Studio
2014-09-16 21:55 - 2009-06-10 17:00 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-09-16 21:54 - 2009-06-10 17:03 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-09-16 21:52 - 2006-11-02 14:37 - 00000000 ____D () C:\Windows\ShellNew
2014-09-16 21:51 - 2014-09-16 21:51 - 00000000 __RHD () C:\MSOCache
2014-09-16 21:45 - 2009-06-10 16:59 - 00000000 ____D () C:\Program Files\Microsoft Works
2014-09-16 21:38 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\MSBuild
2014-09-16 21:07 - 2006-11-02 13:18 - 00000000 __RSD () C:\Windows\Media
2014-09-16 20:18 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene\AppData\Local\VirtualStore
2014-09-16 20:14 - 2014-09-16 20:14 - 00000403 _____ () C:\Windows\ODBC.INI
2014-09-16 20:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\MSAgent
2014-09-16 20:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Help
2014-09-16 20:10 - 2014-09-16 20:10 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft Web Folders
2014-09-16 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system
2014-09-16 19:33 - 2014-01-12 17:41 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\newnext.me
2014-09-16 19:32 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-09-16 19:27 - 2009-06-17 10:21 - 00000000 ____D () C:\ProgramData\Google Updater
2014-09-16 18:38 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-16 18:28 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-16 18:26 - 2006-11-02 15:01 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-15 23:47 - 2014-01-12 20:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-15 23:42 - 2014-01-12 18:59 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-09-15 23:42 - 2014-01-12 18:59 - 00001830 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-15 23:42 - 2014-01-12 18:58 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-15 23:42 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-15 23:38 - 2006-11-02 12:33 - 01541636 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-15 23:07 - 2014-09-15 21:12 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-09-15 23:07 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-09-15 23:06 - 2014-01-17 18:29 - 00000000 ____D () C:\Users\Anika
2014-09-15 23:06 - 2006-11-02 12:22 - 48234496 _____ () C:\Windows\system32\config\software_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 41156608 _____ () C:\Windows\system32\config\components_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 18874368 _____ () C:\Windows\system32\config\system_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-09-15 23:05 - 2014-01-12 17:40 - 00000000 ____D () C:\Program Files\MyPC Backup
2014-09-15 23:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-09-15 23:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-09-15 22:37 - 2014-09-15 21:12 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-09-15 21:40 - 2014-09-15 21:12 - 00000000 ____D () C:\Program Files\RockResult
2014-09-15 21:40 - 2008-01-21 04:47 - 00042412 _____ () C:\Windows\PFRO.log
2014-09-15 21:28 - 2014-09-15 21:18 - 00000000 ____D () C:\408e71e1a45e60e961
2014-09-15 21:17 - 2014-09-15 21:17 - 00000000 ____D () C:\ProgramData\2308189059
2014-09-15 21:12 - 2014-09-15 21:12 - 00000000 ____D () C:\Users\Rene\Documents\Optimizer Pro
2014-09-15 21:12 - 2014-09-15 21:12 - 00000000 ____D () C:\Program Files\SupTab
2014-09-09 08:24 - 2014-09-25 20:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-31 18:26 - 2014-08-31 18:26 - 00000947 _____ () C:\Users\Rene\Desktop\Launch Internet Explorer Browser.lnk
2014-08-31 18:17 - 2014-08-31 18:16 - 00603462 _____ () C:\Users\Anika\Downloads\Setup(1).exe.part
2014-08-31 18:16 - 2014-08-31 18:16 - 00578304 _____ () C:\Users\Anika\Downloads\Java_install(2).exe
2014-08-31 18:14 - 2014-08-31 18:14 - 00578304 _____ () C:\Users\Anika\Downloads\Java_install.exe
2014-08-31 18:14 - 2014-08-31 18:14 - 00578304 _____ () C:\Users\Anika\Downloads\Java_install(1).exe
2014-08-31 18:08 - 2014-08-31 18:02 - 00000000 ____D () C:\Users\Anika\AppData\Local\RocketTab
2014-08-31 17:51 - 2014-08-31 17:51 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 17:37 - 2014-01-17 18:29 - 00000000 ____D () C:\Users\Anika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-08-31 17:37 - 2014-01-12 17:41 - 00000000 ____D () C:\Program Files\Mobogenie
2014-08-31 17:36 - 2006-11-02 14:47 - 00334448 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-31 17:23 - 2014-01-12 17:41 - 00000000 ____D () C:\Users\Rene\Documents\Mobogenie

Some content of TEMP:
====================
C:\Users\Anika\AppData\Local\Temp\SPSetup.exe
C:\Users\Anika\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Anika\AppData\Local\Temp\System.Data.SQLite69922.dll
C:\Users\Rene\AppData\Local\Temp\1395067218_tmps.exe
C:\Users\Rene\AppData\Local\Temp\1395158248_the_wedownload_manager.exe
C:\Users\Rene\AppData\Local\Temp\294823_.exe
C:\Users\Rene\AppData\Local\Temp\BackupSetup.exe
C:\Users\Rene\AppData\Local\Temp\din.exe
C:\Users\Rene\AppData\Local\Temp\dlm1AnotherRegister.exe
C:\Users\Rene\AppData\Local\Temp\DownloadManager.exe
C:\Users\Rene\AppData\Local\Temp\Foxy6_FF_IE_Setup.exe
C:\Users\Rene\AppData\Local\Temp\IminentSetup_july17.exe
C:\Users\Rene\AppData\Local\Temp\instructionsFv4.exe
C:\Users\Rene\AppData\Local\Temp\Mobogenie_Setup_2.2.2_122100041.exe
C:\Users\Rene\AppData\Local\Temp\nsa65D9.exe
C:\Users\Rene\AppData\Local\Temp\nsd3E89.exe
C:\Users\Rene\AppData\Local\Temp\nso435B.exe
C:\Users\Rene\AppData\Local\Temp\nsoB10E.exe
C:\Users\Rene\AppData\Local\Temp\nsp14DB.exe
C:\Users\Rene\AppData\Local\Temp\nsrBF.exe
C:\Users\Rene\AppData\Local\Temp\nstB6F8.exe
C:\Users\Rene\AppData\Local\Temp\nsxBBD3.exe
C:\Users\Rene\AppData\Local\Temp\ose00000.exe
C:\Users\Rene\AppData\Local\Temp\ose00001.exe
C:\Users\Rene\AppData\Local\Temp\ose00002.exe
C:\Users\Rene\AppData\Local\Temp\SearchProtectINT.exe
C:\Users\Rene\AppData\Local\Temp\SPSetup.exe
C:\Users\Rene\AppData\Local\Temp\sp_downloader.exe
C:\Users\Rene\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Rene\AppData\Local\Temp\System.Data.SQLite52060.dll
C:\Users\Rene\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-16 18:33

==================== End Of Log ============================

cosinus · 25.09.2014, 22:03

Hallo und

Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

illhardt · 26.09.2014, 06:28

ich hoffe das ich nichts vergessen habe

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-09-2014
Ran by Rene (administrator) on RENE-PC on 26-09-2014 07:24:35
Running from C:\Users\Rene\Downloads
Loaded Profile: Rene (Available profiles: Rene & Anika)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Windows\System32\PSIService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dell Inc.) C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
() C:\Windows\System32\Rezip.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Google) C:\Windows\Temp\gis7f48b\GoogleUpdater.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\Rene\Downloads\FRST(1).exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-02-11] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [745472 2009-05-07] (Sentelic Corporation)
HKLM\...\Run: [MDS_Menu] => C:\Program Files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe [50472 2007-12-14] ()
HKLM\...\Run: [UCam_Menu] => C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-12-11] (Samsung)
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=13 -> C:\Program Files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll (Google)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\webssearches.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: The weDownload Manager - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb(105).com [2014-09-15]
FF Extension: Adblock Plus - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-16]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-01-12]

Chrome: 
=======
CHR CustomProfile: C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecoccdldklbjglocbgbfpmpehjegkode [2014-05-04]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
R2 Rezip; C:\Windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [247152 2009-02-25] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799808 2008-12-29] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-26 07:23 - 2014-09-26 07:23 - 00025923 _____ () C:\Users\Rene\Desktop\FRST.txt
2014-09-26 07:21 - 2014-09-26 07:21 - 01100288 _____ (Farbar) C:\Users\Rene\Downloads\FRST(1).exe
2014-09-26 07:19 - 2014-09-26 07:19 - 00000633 _____ () C:\Users\Rene\Desktop\JRT.txt
2014-09-26 07:16 - 2014-09-26 07:16 - 00000000 ____D () C:\Windows\ERUNT
2014-09-26 07:15 - 2014-09-26 07:15 - 01024790 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2014-09-26 07:12 - 2014-09-26 07:12 - 00011450 _____ () C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2014-09-26 07:08 - 2007-01-04 11:15 - 00009336 _____ (hxxp://www.internals.com) C:\Windows\system32\WinIo.sys
2014-09-26 07:06 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-09-26 07:04 - 2014-09-26 07:08 - 00000000 ____D () C:\AdwCleaner
2014-09-26 07:03 - 2014-09-26 07:04 - 01373475 _____ () C:\Users\Rene\Downloads\AdwCleaner_3.310.exe
2014-09-26 07:03 - 2014-09-26 07:03 - 00006393 _____ () C:\Users\Rene\Desktop\mbam.txt
2014-09-26 06:20 - 2014-09-26 07:12 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 06:20 - 2014-09-26 06:20 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-26 06:20 - 2014-09-26 06:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-26 06:20 - 2014-09-26 06:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 06:20 - 2014-09-26 06:20 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-09-26 06:20 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-26 06:20 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-26 06:20 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-26 06:18 - 2014-09-26 06:18 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Rene\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-25 21:14 - 2014-09-25 21:18 - 00032592 _____ () C:\Users\Rene\Downloads\Addition.txt
2014-09-25 21:13 - 2014-09-26 07:24 - 00012492 _____ () C:\Users\Rene\Downloads\FRST.txt
2014-09-25 21:13 - 2014-09-26 07:24 - 00000000 ____D () C:\FRST
2014-09-25 21:12 - 2014-09-25 21:12 - 01100800 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2014-09-25 21:11 - 2014-09-25 21:15 - 00000470 _____ () C:\Users\Rene\Downloads\defogger_disable.log
2014-09-25 21:11 - 2014-09-25 21:11 - 00050477 _____ () C:\Users\Rene\Downloads\Defogger.exe
2014-09-25 21:11 - 2014-09-25 21:11 - 00000000 _____ () C:\Users\Rene\defogger_reenable
2014-09-25 20:46 - 2014-09-25 20:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 20:46 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-25 20:35 - 2014-09-25 20:35 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-09-25 20:22 - 2014-09-25 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-09-16 21:59 - 2014-09-25 20:22 - 00002633 _____ () C:\Users\Rene\Desktop\Microsoft Office Excel 2007.lnk
2014-09-16 21:59 - 2014-09-16 21:59 - 00002631 _____ () C:\Users\Rene\Desktop\Microsoft Office Word 2007.lnk
2014-09-16 21:55 - 2014-09-16 21:55 - 00000000 ____D () C:\Program Files\Microsoft Visual Studio
2014-09-16 21:51 - 2014-09-16 21:51 - 00000000 __RHD () C:\MSOCache
2014-09-16 20:14 - 2014-09-16 20:14 - 00000403 _____ () C:\Windows\ODBC.INI
2014-09-16 20:10 - 2014-09-16 20:10 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft Web Folders
2014-09-15 23:48 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-15 23:48 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-15 23:48 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-15 23:48 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-15 23:48 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-15 23:48 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-15 23:48 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-15 23:48 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-15 23:48 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-15 23:47 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-15 21:18 - 2014-09-15 21:28 - 00000000 ____D () C:\408e71e1a45e60e961
2014-09-15 21:12 - 2014-09-15 21:40 - 00000000 ____D () C:\Program Files\RockResult
2014-08-31 18:26 - 2014-08-31 18:26 - 00000947 _____ () C:\Users\Rene\Desktop\Launch Internet Explorer Browser.lnk
2014-08-31 18:16 - 2014-08-31 18:17 - 00603462 _____ () C:\Users\Anika\Downloads\Setup(1).exe.part
2014-08-31 17:51 - 2014-08-31 17:51 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 17:33 - 2014-08-23 03:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-31 17:33 - 2014-08-23 01:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-26 07:18 - 2009-06-17 10:21 - 00000868 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-09-26 07:18 - 2009-06-17 10:21 - 00000000 ____D () C:\ProgramData\Google Updater
2014-09-26 07:16 - 2014-01-12 17:19 - 01781419 _____ () C:\Windows\WindowsUpdate.log
2014-09-26 07:13 - 2014-01-12 18:53 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-26 07:13 - 2006-11-02 14:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-26 07:13 - 2006-11-02 14:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-26 07:12 - 2014-01-12 17:24 - 00118144 _____ () C:\Users\Rene\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-26 07:12 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-09-26 07:10 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-26 07:10 - 2006-11-02 14:47 - 00412624 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-26 07:09 - 2008-01-21 04:47 - 00050024 _____ () C:\Windows\PFRO.log
2014-09-26 07:08 - 2014-01-17 18:29 - 00000000 ____D () C:\Users\Anika
2014-09-26 07:08 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene
2014-09-26 07:08 - 2006-11-02 15:01 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-26 07:01 - 2014-03-23 11:11 - 00000000 ____D () C:\Program Files\The weDownload Manager
2014-09-26 06:43 - 2014-03-28 17:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-25 20:47 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-25 20:46 - 2009-06-10 17:02 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-25 20:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-09-25 20:44 - 2006-11-02 12:23 - 00000240 _____ () C:\Windows\win.ini
2014-09-25 20:23 - 2006-11-02 14:52 - 00194180 _____ () C:\Windows\setupact.log
2014-09-25 20:21 - 2014-03-28 17:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-25 20:21 - 2014-03-28 17:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-17 03:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-09-16 21:58 - 2009-06-10 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-09-16 21:55 - 2009-06-10 17:00 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-09-16 21:54 - 2009-06-10 17:03 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-09-16 21:52 - 2006-11-02 14:37 - 00000000 ____D () C:\Windows\ShellNew
2014-09-16 21:45 - 2009-06-10 16:59 - 00000000 ____D () C:\Program Files\Microsoft Works
2014-09-16 21:38 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\MSBuild
2014-09-16 21:07 - 2006-11-02 13:18 - 00000000 __RSD () C:\Windows\Media
2014-09-16 20:18 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene\AppData\Local\VirtualStore
2014-09-16 20:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\MSAgent
2014-09-16 20:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Help
2014-09-16 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system
2014-09-16 18:38 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-15 23:47 - 2014-01-12 20:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-15 23:42 - 2014-01-12 18:59 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-09-15 23:42 - 2014-01-12 18:59 - 00001830 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-15 23:42 - 2014-01-12 18:58 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-15 23:42 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-15 23:38 - 2006-11-02 12:33 - 01541636 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-15 23:07 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-09-15 23:06 - 2006-11-02 12:22 - 48234496 _____ () C:\Windows\system32\config\software_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 41156608 _____ () C:\Windows\system32\config\components_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 18874368 _____ () C:\Windows\system32\config\system_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-09-15 23:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-09-15 23:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-31 17:37 - 2014-01-17 18:29 - 00000000 ____D () C:\Users\Anika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema

Some content of TEMP:
====================
C:\Users\Anika\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Anika\AppData\Local\Temp\System.Data.SQLite69922.dll
C:\Users\Rene\AppData\Local\Temp\BackupSetup.exe
C:\Users\Rene\AppData\Local\Temp\dlm1AnotherRegister.exe
C:\Users\Rene\AppData\Local\Temp\Foxy6_FF_IE_Setup.exe
C:\Users\Rene\AppData\Local\Temp\IminentSetup_july17.exe
C:\Users\Rene\AppData\Local\Temp\instructionsFv4.exe
C:\Users\Rene\AppData\Local\Temp\Mobogenie_Setup_2.2.2_122100041.exe
C:\Users\Rene\AppData\Local\Temp\ose00002.exe
C:\Users\Rene\AppData\Local\Temp\Quarantine.exe
C:\Users\Rene\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Rene\AppData\Local\Temp\System.Data.SQLite52060.dll
C:\Users\Rene\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-26 07:16

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.0 (09.22.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Rene on 26.09.2014 at  7:16:12,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.09.2014 at  7:19:15,74
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 26.09.2014 06:20:40, SYSTEM, RENE-PC, Protection, Malware Protection, Starting, 
Protection, 26.09.2014 06:20:40, SYSTEM, RENE-PC, Protection, Malware Protection, Started, 
Protection, 26.09.2014 06:20:40, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Detection, 26.09.2014 06:20:44, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.MultiPlug.A, C:\Program Files\CostMin\1mbE.dll, Quarantine, [73d607f87bff5dd9e457058721e0a957]
Protection, 26.09.2014 06:20:46, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Detection, 26.09.2014 06:20:51, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.MultiPlug.A, c:\program files\costmin\1mbe.dll, Quarantine, [73d607f87bff5dd9e457058721e0a957]
Protection, 26.09.2014 06:20:51, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\costmin\1mbe.dll, 
Error, 26.09.2014 06:20:51, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\costmin\1mbe.dll, 
Update, 26.09.2014 06:21:11, SYSTEM, RENE-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.9.19.1, 
Update, 26.09.2014 06:21:15, SYSTEM, RENE-PC, Manual, Malware Database, 2014.3.4.9, 2014.9.26.1, 
Protection, 26.09.2014 06:21:16, SYSTEM, RENE-PC, Protection, Refresh, Starting, 
Protection, 26.09.2014 06:21:16, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 26.09.2014 06:21:16, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 26.09.2014 06:21:23, SYSTEM, RENE-PC, Protection, Refresh, Success, 
Protection, 26.09.2014 06:21:23, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Protection, 26.09.2014 06:21:23, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Detection, 26.09.2014 06:40:58, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, C:\Users\Rene\AppData\Local\genienext\nengine.dll, Quarantine, [e4557c76df9ca19527db5a0cf60bee12]
Detection, 26.09.2014 06:42:02, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\local\genienext\nengine.dll, Quarantine, [e4557c76df9ca19527db5a0cf60bee12]
Protection, 26.09.2014 06:42:02, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\local\genienext\nengine.dll, 
Error, 26.09.2014 06:42:02, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\local\genienext\nengine.dll, 
Detection, 26.09.2014 06:46:25, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, C:\Program Files\The weDownload Manager\The weDownload Manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Detection, 26.09.2014 06:53:41, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, C:\Users\Rene\AppData\Roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Detection, 26.09.2014 06:56:38, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 06:56:38, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 06:56:38, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Detection, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Protection, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Error, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Detection, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, C:\Program Files\The weDownload Manager\The weDownload Manager-bho.dll, Quarantine, [2d0c658d82f990a690f16a7705fdce32]
Detection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Detection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Protection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Error, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Detection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bho.dll, Quarantine, [2d0c658d82f990a690f16a7705fdce32]
Protection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bho.dll, 
Error, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bho.dll, 
Detection, 26.09.2014 07:00:56, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 07:00:57, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 07:00:57, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 

(end)

Code:

ATTFilter

# AdwCleaner v3.310 - Bericht erstellt am 26/09/2014 um 07:07:41
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Rene - RENE-PC
# Gestartet von : C:\Users\Rene\Downloads\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : MgAssistService

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\CostMin
Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\Program Files\CostMin
Ordner Gelöscht : C:\Program Files\Mobogenie
Ordner Gelöscht : C:\Program Files\MyPC Backup
Ordner Gelöscht : C:\Program Files\SupTab
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\torch
Ordner Gelöscht : C:\Users\Anika\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Anika\AppData\Local\RocketTab
Ordner Gelöscht : C:\Users\Anika\AppData\Local\torch
Ordner Gelöscht : C:\Users\Anika\AppData\Roaming\Mobogenie
Ordner Gelöscht : C:\Users\Anika\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Gast\AppData\Local\torch
Ordner Gelöscht : C:\Users\Rene\AppData\Local\genienext
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Rene\AppData\Local\torch
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Temp\Security Systems
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mobogenie
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\webssearches
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
Ordner Gelöscht : C:\Users\Rene\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Rene\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\faststartff@gmail.com
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
Ordner Gelöscht : C:\Users\Anika\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Anika\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Anika\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Anika\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
[!] Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfffmnklliifpdlglpcmblnpbcafbpm
Datei Gelöscht : C:\Windows\system32\roboot.exe
Datei Gelöscht : C:\Users\Anika\daemonprocess.txt
Datei Gelöscht : C:\Users\Rene\daemonprocess.txt
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Mobogenie
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\The weDownload Manager
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16575


-\\ Mozilla Firefox v32.0.1 (x86 de)

[ Datei : C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\prefs.js ]

Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_channels.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_channels.value", "%7B%22app0%22%3A%22app0%22%2C%22app49074%22%3A%22app49[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_geolocation.expiration", "Mon Sep 01 2014 17:06:13 GMT+0200");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_geolocation.value", "%22DE%22");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_metadata.expiration", "Mon Sep 01 2014 17:37:47 GMT+0200");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_metadata.value", "%7B%22appId%22%3A49074%2C%22appName%22%3A%22The%20weDo[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.description", "Enhance your search results with direct download links and information for apps and[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.internaldb.Resources_meta.value", "%7B%22extension.css%22%3A%7B%22id%22%3A479259%2C%22ver%22%3A1%2[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.internaldb.Resources_resource_479259.value", "%22.crossrider-nofity-34345-body-theme-white-black%2[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...]
Zeile gelöscht : user_pref("iminent.BirthDate", "1406320267");

[ Datei : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\prefs.js ]

Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_channels.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_channels.value", "%7B%22app0%22%3A%22app0%22%2C%22app49074%22%3A%22app49[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_geolocation.expiration", "Thu Oct 02 2014 20:27:32 GMT+0200");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_geolocation.value", "%22DE%22");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_metadata.expiration", "Fri Sep 26 2014 20:27:35 GMT+0200");
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.cookie.CrossriderNotifier_metadata.value", "%7B%22appId%22%3A49074%2C%22appName%22%3A%22The%20weDo[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.description", "Enhance your search results with direct download links and information for apps and[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.internaldb.Resources_meta.value", "%7B%22extension.css%22%3A%7B%22id%22%3A479259%2C%22ver%22%3A1%2[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.internaldb.Resources_resource_479259.value", "%22.crossrider-nofity-34345-body-theme-white-black%2[...]
Zeile gelöscht : user_pref("extensions.ab1ac2ff78e514bb68bf887f1d567919a4bb97481aead4c2ea62be25e264651bbcom49074.49074.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...]

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [11426 octets] - [26/09/2014 07:04:55]
AdwCleaner[S0].txt - [11308 octets] - [26/09/2014 07:07:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11369 octets] ##########

cosinus · 26.09.2014, 09:36

Bitte das richtige Log von MBAM posten. Außerdem fehlt eine neue Addition.txt

illhardt · 26.09.2014, 14:41

Code:

ATTFilter

alwarebytes Anti-Malware
www.malwarebytes.org


Protection, 26.09.2014 06:20:40, SYSTEM, RENE-PC, Protection, Malware Protection, Starting, 
Protection, 26.09.2014 06:20:40, SYSTEM, RENE-PC, Protection, Malware Protection, Started, 
Protection, 26.09.2014 06:20:40, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Detection, 26.09.2014 06:20:44, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.MultiPlug.A, C:\Program Files\CostMin\1mbE.dll, Quarantine, [73d607f87bff5dd9e457058721e0a957]
Protection, 26.09.2014 06:20:46, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Detection, 26.09.2014 06:20:51, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.MultiPlug.A, c:\program files\costmin\1mbe.dll, Quarantine, [73d607f87bff5dd9e457058721e0a957]
Protection, 26.09.2014 06:20:51, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\costmin\1mbe.dll, 
Error, 26.09.2014 06:20:51, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\costmin\1mbe.dll, 
Update, 26.09.2014 06:21:11, SYSTEM, RENE-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.9.19.1, 
Update, 26.09.2014 06:21:15, SYSTEM, RENE-PC, Manual, Malware Database, 2014.3.4.9, 2014.9.26.1, 
Protection, 26.09.2014 06:21:16, SYSTEM, RENE-PC, Protection, Refresh, Starting, 
Protection, 26.09.2014 06:21:16, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 26.09.2014 06:21:16, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 26.09.2014 06:21:23, SYSTEM, RENE-PC, Protection, Refresh, Success, 
Protection, 26.09.2014 06:21:23, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Protection, 26.09.2014 06:21:23, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Detection, 26.09.2014 06:40:58, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, C:\Users\Rene\AppData\Local\genienext\nengine.dll, Quarantine, [e4557c76df9ca19527db5a0cf60bee12]
Detection, 26.09.2014 06:42:02, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\local\genienext\nengine.dll, Quarantine, [e4557c76df9ca19527db5a0cf60bee12]
Protection, 26.09.2014 06:42:02, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\local\genienext\nengine.dll, 
Error, 26.09.2014 06:42:02, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\local\genienext\nengine.dll, 
Detection, 26.09.2014 06:46:25, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, C:\Program Files\The weDownload Manager\The weDownload Manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Detection, 26.09.2014 06:53:41, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, C:\Users\Rene\AppData\Roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Detection, 26.09.2014 06:56:38, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 06:56:38, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 06:56:38, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Detection, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Protection, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Error, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Detection, 26.09.2014 06:56:39, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, C:\Program Files\The weDownload Manager\The weDownload Manager-bho.dll, Quarantine, [2d0c658d82f990a690f16a7705fdce32]
Detection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Detection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Protection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Error, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Detection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bho.dll, Quarantine, [2d0c658d82f990a690f16a7705fdce32]
Protection, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bho.dll, 
Error, 26.09.2014 06:57:08, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bho.dll, 
Detection, 26.09.2014 07:00:56, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 07:00:57, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 07:00:57, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Detection, 26.09.2014 07:02:32, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 07:02:32, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 07:02:32, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Detection, 26.09.2014 07:03:42, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Detection, 26.09.2014 07:03:42, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bho.dll, Quarantine, [2d0c658d82f990a690f16a7705fdce32]
Protection, 26.09.2014 07:03:42, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Error, 26.09.2014 07:03:42, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Protection, 26.09.2014 07:03:43, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bho.dll, 
Error, 26.09.2014 07:03:43, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bho.dll, 
Detection, 26.09.2014 07:08:26, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.weDownload.A, c:\program files\the wedownload manager\the wedownload manager-bg.exe, Quarantine, [58e1b240bdbe3bfb087926bb9c6657a9]
Protection, 26.09.2014 07:08:26, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Error, 26.09.2014 07:08:26, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\program files\the wedownload manager\the wedownload manager-bg.exe, 
Detection, 26.09.2014 07:08:38, SYSTEM, RENE-PC, Protection, Malware Protection, File, PUP.Optional.NextLive.A, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, Quarantine, [2712db17ed8e26107d85095d709145bb]
Protection, 26.09.2014 07:08:38, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Error, 26.09.2014 07:08:38, SYSTEM, RENE-PC, Protection, SDKQuarantine, 1, Failed, c:\users\rene\appdata\roaming\newnext.me\nengine.dll, 
Protection, 26.09.2014 07:11:32, SYSTEM, RENE-PC, Protection, Malware Protection, Starting, 
Protection, 26.09.2014 07:11:32, SYSTEM, RENE-PC, Protection, Malware Protection, Started, 
Protection, 26.09.2014 07:11:32, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Protection, 26.09.2014 07:12:25, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Update, 26.09.2014 15:04:45, SYSTEM, RENE-PC, Scheduler, Malware Database, 2014.9.26.1, 2014.9.26.4, 
Protection, 26.09.2014 15:04:47, SYSTEM, RENE-PC, Protection, Refresh, Starting, 
Protection, 26.09.2014 15:04:47, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 26.09.2014 15:04:47, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 26.09.2014 15:05:26, SYSTEM, RENE-PC, Protection, Refresh, Success, 
Protection, 26.09.2014 15:05:26, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Protection, 26.09.2014 15:05:35, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Protection, 26.09.2014 15:07:52, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 26.09.2014 15:07:52, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 26.09.2014 15:07:52, SYSTEM, RENE-PC, Protection, Malware Protection, Stopping, 
Protection, 26.09.2014 15:07:53, SYSTEM, RENE-PC, Protection, Malware Protection, Stopped, 
Protection, 26.09.2014 15:08:27, SYSTEM, RENE-PC, Protection, Malware Protection, Starting, 
Protection, 26.09.2014 15:08:27, SYSTEM, RENE-PC, Protection, Malware Protection, Started, 
Protection, 26.09.2014 15:08:27, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Protection, 26.09.2014 15:08:28, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 
Update, 26.09.2014 15:08:49, SYSTEM, RENE-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.9.19.1, 
Update, 26.09.2014 15:08:56, SYSTEM, RENE-PC, Manual, Malware Database, 2014.3.4.9, 2014.9.26.4, 
Protection, 26.09.2014 15:08:57, SYSTEM, RENE-PC, Protection, Refresh, Starting, 
Protection, 26.09.2014 15:08:57, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 26.09.2014 15:08:57, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 26.09.2014 15:09:03, SYSTEM, RENE-PC, Protection, Refresh, Success, 
Protection, 26.09.2014 15:09:03, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Starting, 
Protection, 26.09.2014 15:09:03, SYSTEM, RENE-PC, Protection, Malicious Website Protection, Started, 

(end)

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-09-2014
Ran by Rene at 2014-09-26 15:37:55
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adblock Plus für IE (32-Bit) (HKLM\...\{8CF6A3B1-8799-4F0C-AC2A-1F53D31B143F}) (Version: 99.9 - Eyeo GmbH)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Adobe Shockwave Player 11 (HKLM\...\Adobe Shockwave Player) (Version: 11 - Adobe Systems, Inc.)
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
Badaboom 1.1.1.194 (HKLM\...\Badaboom) (Version: 1.1.1.194 - Elemental Technologies)
Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden
Corel Home Office - IPM (Version: 5.0 - Corel Corporation) Hidden
Corel Home Office - Launcher (Version: 5.0.45 - Corel Corporation) Hidden
Corel Home Office - Templates1 (Version: 5 - Your Company Name) Hidden
Corel Home Office (Version: 5.0.56 - Corel Corporation) Hidden
Corel Home Office 5.0.56 (HKLM\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version:  - Corel Corporation)
Corel Home Office 5.0.56 (Version: 5.0.56 - Corel Corporation) Hidden
Corel Painter Essentials 4 (HKLM\...\_{E1A63F75-1F72-4450-980D-434496FFC646}) (Version:  - Corel Corporation)
Corel Painter Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CyberLink MediaShow (HKLM\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.2325 - CyberLink Corp.)
CyberLink MediaShow (Version: 4.1.2325 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.5615 - CyberLink Corp.)
CyberLink PhotoNow (Version: 1.1.5615 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2625 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2625 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2606a - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2606a - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1412 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1412 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.2521 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.2521 - CyberLink Corp.) Hidden
Dell C1765 Color MFP (HKLM\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)
Dell C1765 Color MFP (Version: 1.039.0 - Dell Inc.) Hidden
e-Wörterbücher (HKLM\...\{4737AD9F-13AA-4E4C-B86F-B631D557F6A7}) (Version:  - )
Finger-sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.4.1.5 - FSP)
Foxlink Webcam (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.51000.202_WHQL - Sonix)
Google Earth (HKLM\...\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}) (Version: 4.3.7284.3916 - Google)
Google Updater (HKLM\...\Google Updater) (Version: 2.4.1487.6512 - Google Inc.)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java(TM) 6 Update 13 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216013FF}) (Version: 6.0.130 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
neroxml (Version: 1.0.0 - Nero AG) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
Picasa 2 (HKLM\...\Picasa2) (Version: 2.0 - Google, Inc.)
QuickTime (HKLM\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5730 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20111 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.01.0092 - REALTEK Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8051.1204 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

16-08-2014 09:06:43 Windows Update
17-08-2014 15:22:16 Windows Update
21-08-2014 15:29:34 Windows Update
25-08-2014 15:02:24 Windows Update
31-08-2014 15:24:07 Windows Update
31-08-2014 15:24:26 Removed Del Ad for Internet Explorer 3.1
31-08-2014 15:32:55 Windows Update
31-08-2014 15:51:19 Installed Adblock Plus for IE (32-bit)
06-09-2014 13:54:40 Windows Update
15-09-2014 19:18:07 Windows Update
15-09-2014 20:57:14 Wiederherstellungsvorgang
15-09-2014 21:09:38 Windows Update
15-09-2014 21:37:22 Windows Update
16-09-2014 17:05:59 Geplanter Prüfpunkt
16-09-2014 18:07:25 Microsoft Office 2000 Professional wird installiert
16-09-2014 19:05:48 Microsoft Office 2000 Professional wird entfernt
16-09-2014 19:13:08 Installed Microsoft Office Enterprise 2007
16-09-2014 19:36:05 Removed Microsoft Office Enterprise 2007
16-09-2014 19:40:03 Compatibility Pack für 2007 Office System wird entfernt
16-09-2014 19:41:39 Microsoft Office PowerPoint Viewer 2007 (German) wird entfernt
16-09-2014 19:42:54 Removed Microsoft Office Home and Student 2007
16-09-2014 19:47:26 Microsoft Office Live Add-in 1.5 wird entfernt
16-09-2014 19:51:19 Installed Microsoft Office Enterprise 2007
17-09-2014 01:00:27 Windows Update
25-09-2014 18:21:46 Windows Update
25-09-2014 18:24:39 Windows Update
25-09-2014 18:42:37 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {9BA38F40-047E-4BFF-A997-784E6D384FE9} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-17] (Google)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {C39B37D7-8E17-4070-ACE4-7BFEB27EB404} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-25] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {F5157BEF-37D9-4CAC-B0B5-624D2B289C84} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

==================== Loaded Modules (whitelisted) =============

2014-01-12 22:06 - 2012-06-07 18:48 - 00019968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dltfm1zPP.dll
2014-01-12 22:06 - 2013-02-01 16:55 - 12875264 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\dlthm1zRC.DLL
2013-02-06 18:37 - 2013-02-06 18:37 - 00191464 _____ () C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2009-06-10 14:57 - 2008-10-29 16:20 - 00070656 _____ () C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
2009-06-10 15:00 - 2008-08-28 15:03 - 00233472 _____ () C:\Windows\tsnp2uvc.exe
2009-06-08 18:14 - 2009-02-17 12:26 - 00053248 _____ () C:\Program Files\FSP\KbdHook.dll
2009-06-08 18:14 - 2009-04-23 15:29 - 00073728 _____ () C:\Program Files\FSP\FspLib.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\21871ce315d4257cfe2052454e583368\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-03-23 11:24 - 2014-03-23 11:24 - 14971904 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\c94e1e76e67ad518b4310a539f072832\Kies.Theme.ni.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 01842688 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\0107366ee1ddeb3e9873c6fac6344bc1\Kies.UI.ni.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\8375369d3ac9c732c2ec8f6b5c9f2bb8\Kies.MVVM.ni.dll
2014-03-23 11:24 - 2014-03-23 11:24 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2009-06-10 14:58 - 2009-03-05 18:54 - 00311296 _____ () C:\Windows\SYSTEM32\Rezip.exe
2009-06-10 22:13 - 2009-02-25 08:13 - 00247152 _____ () C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2014-09-25 20:46 - 2014-09-25 20:46 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1863392313-3708449669-3860219250-500 - Disabled - Status: Degraded)
Anika (S-1-5-21-1863392313-3708449669-3860219250-1001 - Enabled - Status: OK) => C:\Users\Anika
Gast (S-1-5-21-1863392313-3708449669-3860219250-501 - Disabled - Status: Degraded)
Rene (S-1-5-21-1863392313-3708449669-3860219250-1000 - Enabled - Status: OK) => C:\Users\Rene

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-09-26 15:37:51.146
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.974
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.818
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.646
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.381
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.210
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.054
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:49.882
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:34.610
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:34.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T6500 @ 2.10GHz
Percentage of memory in use: 58%
Total physical RAM: 3065.95 MB
Available physical RAM: 1276.14 MB
Total Pagefile: 6336.19 MB
Available Pagefile: 4557.11 MB
Total Virtual: 2047.88 MB
Available Virtual: 1927.15 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:268.79 GB) (Free:192.11 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:29.28 GB) (Free:14.35 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 9338ECFC)
Partition 1: (Active) - (Size=268.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=29.3 GB) - (Type=0C)

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 26-09-2014
Ran by Rene at 2014-09-26 15:37:55
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adblock Plus für IE (32-Bit) (HKLM\...\{8CF6A3B1-8799-4F0C-AC2A-1F53D31B143F}) (Version: 99.9 - Eyeo GmbH)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Adobe Shockwave Player 11 (HKLM\...\Adobe Shockwave Player) (Version: 11 - Adobe Systems, Inc.)
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
Badaboom 1.1.1.194 (HKLM\...\Badaboom) (Version: 1.1.1.194 - Elemental Technologies)
Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden
Corel Home Office - IPM (Version: 5.0 - Corel Corporation) Hidden
Corel Home Office - Launcher (Version: 5.0.45 - Corel Corporation) Hidden
Corel Home Office - Templates1 (Version: 5 - Your Company Name) Hidden
Corel Home Office (Version: 5.0.56 - Corel Corporation) Hidden
Corel Home Office 5.0.56 (HKLM\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version:  - Corel Corporation)
Corel Home Office 5.0.56 (Version: 5.0.56 - Corel Corporation) Hidden
Corel Painter Essentials 4 (HKLM\...\_{E1A63F75-1F72-4450-980D-434496FFC646}) (Version:  - Corel Corporation)
Corel Painter Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CyberLink MediaShow (HKLM\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.2325 - CyberLink Corp.)
CyberLink MediaShow (Version: 4.1.2325 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.5615 - CyberLink Corp.)
CyberLink PhotoNow (Version: 1.1.5615 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2625 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2625 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2606a - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2606a - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1412 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1412 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.2521 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.2521 - CyberLink Corp.) Hidden
Dell C1765 Color MFP (HKLM\...\InstallShield_{B03A2793-A8FF-4242-B23D-88D2D5FAE56A}) (Version: 1.039.0 - Dell Inc.)
Dell C1765 Color MFP (Version: 1.039.0 - Dell Inc.) Hidden
e-Wörterbücher (HKLM\...\{4737AD9F-13AA-4E4C-B86F-B631D557F6A7}) (Version:  - )
Finger-sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.4.1.5 - FSP)
Foxlink Webcam (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.51000.202_WHQL - Sonix)
Google Earth (HKLM\...\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}) (Version: 4.3.7284.3916 - Google)
Google Updater (HKLM\...\Google Updater) (Version: 2.4.1487.6512 - Google Inc.)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java(TM) 6 Update 13 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216013FF}) (Version: 6.0.130 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
neroxml (Version: 1.0.0 - Nero AG) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
Picasa 2 (HKLM\...\Picasa2) (Version: 2.0 - Google, Inc.)
QuickTime (HKLM\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5730 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20111 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.01.0092 - REALTEK Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8051.1204 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

16-08-2014 09:06:43 Windows Update
17-08-2014 15:22:16 Windows Update
21-08-2014 15:29:34 Windows Update
25-08-2014 15:02:24 Windows Update
31-08-2014 15:24:07 Windows Update
31-08-2014 15:24:26 Removed Del Ad for Internet Explorer 3.1
31-08-2014 15:32:55 Windows Update
31-08-2014 15:51:19 Installed Adblock Plus for IE (32-bit)
06-09-2014 13:54:40 Windows Update
15-09-2014 19:18:07 Windows Update
15-09-2014 20:57:14 Wiederherstellungsvorgang
15-09-2014 21:09:38 Windows Update
15-09-2014 21:37:22 Windows Update
16-09-2014 17:05:59 Geplanter Prüfpunkt
16-09-2014 18:07:25 Microsoft Office 2000 Professional wird installiert
16-09-2014 19:05:48 Microsoft Office 2000 Professional wird entfernt
16-09-2014 19:13:08 Installed Microsoft Office Enterprise 2007
16-09-2014 19:36:05 Removed Microsoft Office Enterprise 2007
16-09-2014 19:40:03 Compatibility Pack für 2007 Office System wird entfernt
16-09-2014 19:41:39 Microsoft Office PowerPoint Viewer 2007 (German) wird entfernt
16-09-2014 19:42:54 Removed Microsoft Office Home and Student 2007
16-09-2014 19:47:26 Microsoft Office Live Add-in 1.5 wird entfernt
16-09-2014 19:51:19 Installed Microsoft Office Enterprise 2007
17-09-2014 01:00:27 Windows Update
25-09-2014 18:21:46 Windows Update
25-09-2014 18:24:39 Windows Update
25-09-2014 18:42:37 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {9BA38F40-047E-4BFF-A997-784E6D384FE9} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-17] (Google)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {C39B37D7-8E17-4070-ACE4-7BFEB27EB404} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-25] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {F5157BEF-37D9-4CAC-B0B5-624D2B289C84} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

==================== Loaded Modules (whitelisted) =============

2014-01-12 22:06 - 2012-06-07 18:48 - 00019968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dltfm1zPP.dll
2014-01-12 22:06 - 2013-02-01 16:55 - 12875264 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\dlthm1zRC.DLL
2013-02-06 18:37 - 2013-02-06 18:37 - 00191464 _____ () C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2009-06-10 14:57 - 2008-10-29 16:20 - 00070656 _____ () C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
2009-06-10 15:00 - 2008-08-28 15:03 - 00233472 _____ () C:\Windows\tsnp2uvc.exe
2009-06-08 18:14 - 2009-02-17 12:26 - 00053248 _____ () C:\Program Files\FSP\KbdHook.dll
2009-06-08 18:14 - 2009-04-23 15:29 - 00073728 _____ () C:\Program Files\FSP\FspLib.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\21871ce315d4257cfe2052454e583368\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-03-23 11:24 - 2014-03-23 11:24 - 14971904 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\c94e1e76e67ad518b4310a539f072832\Kies.Theme.ni.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 01842688 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\0107366ee1ddeb3e9873c6fac6344bc1\Kies.UI.ni.dll
2014-03-23 11:23 - 2014-03-23 11:23 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\8375369d3ac9c732c2ec8f6b5c9f2bb8\Kies.MVVM.ni.dll
2014-03-23 11:24 - 2014-03-23 11:24 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2009-06-10 14:58 - 2009-03-05 18:54 - 00311296 _____ () C:\Windows\SYSTEM32\Rezip.exe
2009-06-10 22:13 - 2009-02-25 08:13 - 00247152 _____ () C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2014-09-25 20:46 - 2014-09-25 20:46 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1863392313-3708449669-3860219250-500 - Disabled - Status: Degraded)
Anika (S-1-5-21-1863392313-3708449669-3860219250-1001 - Enabled - Status: OK) => C:\Users\Anika
Gast (S-1-5-21-1863392313-3708449669-3860219250-501 - Disabled - Status: Degraded)
Rene (S-1-5-21-1863392313-3708449669-3860219250-1000 - Enabled - Status: OK) => C:\Users\Rene

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-09-26 15:37:51.146
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.974
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.818
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.646
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.381
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.210
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:50.054
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:49.882
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:34.610
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-26 15:37:34.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T6500 @ 2.10GHz
Percentage of memory in use: 58%
Total physical RAM: 3065.95 MB
Available physical RAM: 1276.14 MB
Total Pagefile: 6336.19 MB
Available Pagefile: 4557.11 MB
Total Virtual: 2047.88 MB
Available Virtual: 1927.15 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:268.79 GB) (Free:192.11 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:29.28 GB) (Free:14.35 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 9338ECFC)
Partition 1: (Active) - (Size=268.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=29.3 GB) - (Type=0C)

==================== End Of Log ============================

so hoffe das ist alles

cosinus · 26.09.2014, 14:44

Bitte die Anlelitung richtig lesen!

Zitat:

Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Wähle Exportieren auf Textdatei (.txt) und speichere die Datei als mbam.txt auf dem Desktop ab.

illhardt · 26.09.2014, 20:22

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 26.09.2014
Suchlauf-Zeit: 15:09:58
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.26.04
Rootkit Datenbank: v2014.09.19.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Rene

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 362482
Verstrichene Zeit: 18 Min, 5 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 16
PUP.Optional.CrossRider.A, C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecoccdldklbjglocbgbfpmpehjegkode, In Quarantäne, [c07ccd255d1e60d66682479658aa08f8], 
PUP.Optional.CrossRider.A, C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecoccdldklbjglocbgbfpmpehjegkode\1.26.44_0, In Quarantäne, [c07ccd255d1e60d66682479658aa08f8], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\chrome, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\chrome\content, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\chrome\content\api, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\chrome\content\core, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\defaults, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\defaults\preferences, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\extensionData, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\extensionData\plugins, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\extensionData\userCode, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\locale, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\locale\en-US, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.CrossRider.A, C:\Users\Anika\AppData\Roaming\Mozilla\Firefox\Profiles\f3p9zy3i.default-1406318140517\extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb.com\skin, In Quarantäne, [99a329c9c0bbc670d91802de5ea4738d], 
PUP.Optional.weDownload.A, C:\Program Files\The weDownload Manager, In Quarantäne, [cb711ad882f976c0468a27ba936fc43c], 

Dateien: 1
PUP.Optional.WebsSearches.A, C:\Program Files\Mozilla Firefox\browser\searchplugins\webssearches.xml, In Quarantäne, [65d7777b304b3ff778b268cb19ead32d], 

Physische Sektoren: 0
(No malicious items detected)


(end)

jetzt aber oder :-(

cosinus · 27.09.2014, 16:08

Bitte auch ne aktuelle FRST.txt posten, du hast 2x das Addition.txt Log gepostet

illhardt · 27.09.2014, 18:18

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-09-2014
Ran by Rene (administrator) on RENE-PC on 27-09-2014 19:17:35
Running from C:\Users\Rene\Downloads
Loaded Profile: Rene (Available profiles: Rene & Anika)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Windows\System32\PSIService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dell Inc.) C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
() C:\Windows\System32\Rezip.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Google) C:\Windows\Temp\gis7f48b\GoogleUpdater.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Google) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Farbar) C:\Users\Rene\Downloads\FRST(4).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-02-11] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [745472 2009-05-07] (Sentelic Corporation)
HKLM\...\Run: [MDS_Menu] => C:\Program Files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe [50472 2007-12-14] ()
HKLM\...\Run: [UCam_Menu] => C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LauncherC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Launcher\dlm1launcher.exe [2471928 2013-08-13] (Dell Inc.)
HKLM\...\Run: [StatusAutoRunC1765nf] => C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1pl.exe [3024360 2013-02-06] (Dell Inc.)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-12-11] (Samsung)
HKU\S-1-5-21-1863392313-3708449669-3860219250-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=13 -> C:\Program Files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll (Google)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: The weDownload Manager - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\b1ac2ff7-8e51-4bb6-8bf8-87f1d567919a@4bb97481-aead-4c2e-a62b-e25e264651bb(105).com [2014-09-15]
FF Extension: Adblock Plus - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\m6ptl3y6.default-1406321759494\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-16]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-01-12]

Chrome: 
=======
CHR CustomProfile: C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DLNBDB; C:\Program Files\Dell Printers\Printer SSW\Status Monitor\dlm1db.exe [191464 2013-02-06] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
R2 Rezip; C:\Windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [247152 2009-02-25] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R1 MpKsl7e27552d; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6EF8E07B-3BAE-4A33-A3AD-87E04ACF66C0}\MpKsl7e27552d.sys [39464 2014-09-26] (Microsoft Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799808 2008-12-29] ()
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-27 19:17 - 2014-09-27 19:17 - 01100288 _____ (Farbar) C:\Users\Rene\Downloads\FRST(4).exe
2014-09-26 15:35 - 2014-09-26 15:35 - 00026334 _____ () C:\Users\Rene\Desktop\FRST.txt
2014-09-26 15:31 - 2014-09-26 15:32 - 01100288 _____ (Farbar) C:\Users\Rene\Downloads\FRST(3).exe
2014-09-26 15:31 - 2014-09-26 15:31 - 01100288 _____ (Farbar) C:\Users\Rene\Downloads\FRST(2).exe
2014-09-26 15:30 - 2014-09-26 21:22 - 00005270 _____ () C:\Users\Rene\Desktop\mbam.txt
2014-09-26 15:07 - 2014-09-26 15:07 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Rene\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-09-26 07:21 - 2014-09-26 07:21 - 01100288 _____ (Farbar) C:\Users\Rene\Downloads\FRST(1).exe
2014-09-26 07:16 - 2014-09-26 07:16 - 00000000 ____D () C:\Windows\ERUNT
2014-09-26 07:15 - 2014-09-26 07:15 - 01024790 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2014-09-26 07:06 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-09-26 07:04 - 2014-09-26 07:08 - 00000000 ____D () C:\AdwCleaner
2014-09-26 07:03 - 2014-09-26 07:04 - 01373475 _____ () C:\Users\Rene\Downloads\AdwCleaner_3.310.exe
2014-09-26 06:20 - 2014-09-27 19:17 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 06:20 - 2014-09-26 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-26 06:20 - 2014-09-26 15:08 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-09-26 06:20 - 2014-09-26 06:20 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-26 06:20 - 2014-09-26 06:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 06:20 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-26 06:20 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-26 06:20 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-26 06:18 - 2014-09-26 06:18 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Rene\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-25 21:14 - 2014-09-26 15:39 - 00026708 _____ () C:\Users\Rene\Downloads\Addition.txt
2014-09-25 21:13 - 2014-09-27 19:17 - 00012580 _____ () C:\Users\Rene\Downloads\FRST.txt
2014-09-25 21:13 - 2014-09-27 19:17 - 00000000 ____D () C:\FRST
2014-09-25 21:12 - 2014-09-25 21:12 - 01100800 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2014-09-25 21:11 - 2014-09-25 21:15 - 00000470 _____ () C:\Users\Rene\Downloads\defogger_disable.log
2014-09-25 21:11 - 2014-09-25 21:11 - 00050477 _____ () C:\Users\Rene\Downloads\Defogger.exe
2014-09-25 21:11 - 2014-09-25 21:11 - 00000000 _____ () C:\Users\Rene\defogger_reenable
2014-09-25 20:46 - 2014-09-25 20:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 20:46 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-25 20:35 - 2014-09-25 20:35 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-09-25 20:22 - 2014-09-25 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-09-16 21:59 - 2014-09-26 22:54 - 00002633 _____ () C:\Users\Rene\Desktop\Microsoft Office Excel 2007.lnk
2014-09-16 21:59 - 2014-09-26 22:54 - 00002631 _____ () C:\Users\Rene\Desktop\Microsoft Office Word 2007.lnk
2014-09-16 21:55 - 2014-09-16 21:55 - 00000000 ____D () C:\Program Files\Microsoft Visual Studio
2014-09-16 21:51 - 2014-09-16 21:51 - 00000000 __RHD () C:\MSOCache
2014-09-16 20:14 - 2014-09-16 20:14 - 00000403 _____ () C:\Windows\ODBC.INI
2014-09-16 20:10 - 2014-09-16 20:10 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft Web Folders
2014-09-15 23:48 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-15 23:48 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-15 23:48 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-15 23:48 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-15 23:48 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-15 23:48 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-15 23:48 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-15 23:48 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-15 23:48 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-15 23:48 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-15 23:48 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-15 23:47 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-15 21:18 - 2014-09-15 21:28 - 00000000 ____D () C:\408e71e1a45e60e961
2014-09-15 21:12 - 2014-09-15 21:40 - 00000000 ____D () C:\Program Files\RockResult
2014-08-31 18:26 - 2014-08-31 18:26 - 00000947 _____ () C:\Users\Rene\Desktop\Launch Internet Explorer Browser.lnk
2014-08-31 18:16 - 2014-08-31 18:17 - 00603462 _____ () C:\Users\Anika\Downloads\Setup(1).exe.part
2014-08-31 17:51 - 2014-08-31 17:51 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 17:33 - 2014-08-23 03:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-31 17:33 - 2014-08-23 01:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-27 19:17 - 2009-06-17 10:21 - 00000868 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-09-27 19:16 - 2014-03-28 17:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-27 19:16 - 2006-11-02 14:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-27 19:16 - 2006-11-02 14:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-27 08:42 - 2014-01-12 17:19 - 01818748 _____ () C:\Windows\WindowsUpdate.log
2014-09-26 07:27 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-09-26 07:18 - 2009-06-17 10:21 - 00000000 ____D () C:\ProgramData\Google Updater
2014-09-26 07:13 - 2014-01-12 18:53 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-26 07:12 - 2014-01-12 17:24 - 00118144 _____ () C:\Users\Rene\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-26 07:12 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-09-26 07:10 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-26 07:10 - 2006-11-02 14:47 - 00412624 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-26 07:09 - 2008-01-21 04:47 - 00050024 _____ () C:\Windows\PFRO.log
2014-09-26 07:08 - 2014-01-17 18:29 - 00000000 ____D () C:\Users\Anika
2014-09-26 07:08 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene
2014-09-26 07:08 - 2006-11-02 15:01 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-25 20:47 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-25 20:46 - 2009-06-10 17:02 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-25 20:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-09-25 20:44 - 2006-11-02 12:23 - 00000240 _____ () C:\Windows\win.ini
2014-09-25 20:23 - 2006-11-02 14:52 - 00194180 _____ () C:\Windows\setupact.log
2014-09-25 20:21 - 2014-03-28 17:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-25 20:21 - 2014-03-28 17:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 08:41 - 2014-01-12 20:09 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-17 03:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-09-16 21:58 - 2009-06-10 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-09-16 21:55 - 2009-06-10 17:00 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-09-16 21:54 - 2009-06-10 17:03 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-09-16 21:52 - 2006-11-02 14:37 - 00000000 ____D () C:\Windows\ShellNew
2014-09-16 21:45 - 2009-06-10 16:59 - 00000000 ____D () C:\Program Files\Microsoft Works
2014-09-16 21:38 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\MSBuild
2014-09-16 21:07 - 2006-11-02 13:18 - 00000000 __RSD () C:\Windows\Media
2014-09-16 20:18 - 2014-01-12 17:24 - 00000000 ____D () C:\Users\Rene\AppData\Local\VirtualStore
2014-09-16 20:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\MSAgent
2014-09-16 20:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Help
2014-09-16 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system
2014-09-16 18:38 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-15 23:47 - 2014-01-12 20:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-15 23:42 - 2014-01-12 18:59 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-09-15 23:42 - 2014-01-12 18:59 - 00001830 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-15 23:42 - 2014-01-12 18:58 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-15 23:42 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-15 23:38 - 2006-11-02 12:33 - 01541636 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-15 23:07 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-09-15 23:06 - 2006-11-02 12:22 - 48234496 _____ () C:\Windows\system32\config\software_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 41156608 _____ () C:\Windows\system32\config\components_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 18874368 _____ () C:\Windows\system32\config\system_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-09-15 23:06 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-09-15 23:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-09-15 23:05 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-08-31 17:37 - 2014-01-17 18:29 - 00000000 ____D () C:\Users\Anika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema

Some content of TEMP:
====================
C:\Users\Anika\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Anika\AppData\Local\Temp\System.Data.SQLite69922.dll
C:\Users\Rene\AppData\Local\Temp\BackupSetup.exe
C:\Users\Rene\AppData\Local\Temp\dlm1AnotherRegister.exe
C:\Users\Rene\AppData\Local\Temp\Foxy6_FF_IE_Setup.exe
C:\Users\Rene\AppData\Local\Temp\IminentSetup_july17.exe
C:\Users\Rene\AppData\Local\Temp\instructionsFv4.exe
C:\Users\Rene\AppData\Local\Temp\Mobogenie_Setup_2.2.2_122100041.exe
C:\Users\Rene\AppData\Local\Temp\ose00002.exe
C:\Users\Rene\AppData\Local\Temp\Quarantine.exe
C:\Users\Rene\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Rene\AppData\Local\Temp\System.Data.SQLite52060.dll
C:\Users\Rene\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-26 07:16

==================== End Of Log ============================

--- --- ---

--- --- ---

cosinus · 27.09.2014, 18:28

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

illhardt · 27.09.2014, 18:41

wenn ich das so mache, schreibt er mir immer das er die fixlist.txt datei nicht findet

cosinus · 27.09.2014, 18:42

Weil du die Anleitung nicht richtig umsetzt:

Zitat:

Running from C:\Users\Rene\Downloads

In der Anleitung steht, du sollst FRST auf den Desktop legen und nicht nach Downloads.

illhardt · 27.09.2014, 18:57

sorry

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-09-2014
Ran by Rene at 2014-09-27 19:45:50 Run:1
Running from C:\Users\Rene\Desktop
Loaded Profile: Rene (Available profiles: Rene & Anika)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
EmptyTemp:
         
*****************

EmptyTemp: => Removed 1.7 GB temporary data.


The system needed a reboot. 

==== End of Fixlog ===

cosinus · 28.09.2014, 13:24

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

illhardt · 28.09.2014, 19:29

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3190280fcddd1d449c846e5916a734e9
# engine=20337
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-28 06:20:30
# local_time=2014-09-28 08:20:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 1111109 34908824 0 0
# scanned=159979
# found=12
# cleaned=0
# scan_time=4324
sh=66285FBD827C14BF7808ED02E5133A703F956D59 ft=1 fh=b5072f2ca542d5aa vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\DaemonProcess.exe.vir"
sh=D9F8CA0CC19FCCAD8FEB96185D0A963339930579 ft=1 fh=8858d5899216b75f vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\Mobogenie.exe.vir"
sh=A0DB53EFBACD59768F19F6112E92663D0227E3BC ft=0 fh=0000000000000000 vn="Variante von Android/Mobserv.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\MUServer.apk.vir"
sh=82F978FFA4B602EDD29C5708D0418340FE6D419B ft=1 fh=7e9f45d711ca4a76 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\UpdateMoboGenie.exe.vir"
sh=250B4601E0CC2AAFE97B36C718C306A1731C40DD ft=1 fh=f345f335ca111cd0 vn="Variante von MSIL/Adware.iBryte.G Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Anika\AppData\Local\RocketTab\uninstall.exe.vir"
sh=A068BB4DF78CF294B9E7363B83A7DE0D106E8DC9 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Rene\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.2.8.zip.vir"
sh=9BFBFB3C5AD195FB7D98AE04BD8F893152F0B76D ft=1 fh=b9fa7667e1b0a72c vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Rene\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir"
sh=D9F8CA0CC19FCCAD8FEB96185D0A963339930579 ft=1 fh=8858d5899216b75f vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Rene\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir"
sh=A0DB53EFBACD59768F19F6112E92663D0227E3BC ft=0 fh=0000000000000000 vn="Variante von Android/Mobserv.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Rene\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\MUServer.apk.vir"
sh=82F978FFA4B602EDD29C5708D0418340FE6D419B ft=1 fh=7e9f45d711ca4a76 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Rene\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=8796021AC742D759EB6629CFA22D23820041FB2F ft=1 fh=626734ce82a4d729 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"
sh=9BE986B767ED972D2D369616BA576B443F99CBCE ft=1 fh=6575d556a3c9c108 vn="Variante von Win32/SoftPulse.O evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anika\Downloads\Setup(1).exe.part"

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 28.09.2014
Suchlauf-Zeit: 13:46:41
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.28.03
Rootkit Datenbank: v2014.09.19.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Rene

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 352796
Verstrichene Zeit: 12 Min, 46 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0

26.09.2014, 09:36	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Virus eingefangen Bitte das richtige Log von MBAM posten. Außerdem fehlt eine neue Addition.txt __________________ Logfiles bitte immer in CODE-Tags posten

27.09.2014, 16:08	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Virus eingefangen Bitte auch ne aktuelle FRST.txt posten, du hast 2x das Addition.txt Log gepostet __________________ Logfiles bitte immer in CODE-Tags posten

Virus eingefangen

Log-Analyse und Auswertung: Virus eingefangen