Hallo liebe Gemeinde,

ich habe gestern in meiner Downloadliste die oben genannte Datei gefunden. Der Ursprungsort war die website: r0kr3xbix.com.

Ich habe diese umgehend gelöscht und einen scan mit FRST und AntiMaleware durchlaufen lassen. Dabei sind folgende Punkte zu Tage getreten:

Addition:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02-10-2014
Ran by Dell at 2014-10-03 17:05:52
Running from C:\Users\Dell\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.3.300.270 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audiograbber 1.83 SE  (HKLM\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland)
Avira (HKLM\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - ‪Canon Inc.‬)
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)
Canon MG4200 series Benutzerregistrierung (HKLM\...\Canon MG4200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon MG4200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4200_series) (Version: 1.01 - Canon Inc.)
Canon MG4200 series On-screen Manual (HKLM\...\Canon MG4200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 1.1.2 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 1.0.1 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CopyTrans Control Center deinstallieren (HKCU\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Epson Easy Photo Print 2 (HKLM\...\{02A312B5-1542-47B6-BFE9-F51358C39E86}) (Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (HKLM\...\{BECE9CCD-83F6-4BAA-9B26-227DF7D2E932}) (Version: 3.01.0000 - Seiko Epson Corporation)
EpsonNet Print (HKLM\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.5.00 - SEIKO EPSON CORPORATION)
iFunbox (v2.7.2386.747), iFunbox DevTeam (HKLM\...\iFunbox_is1) (Version: v2.7.2386.747 - )
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
JDownloader 0.9 (HKLM\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Laptop Integrated Webcam Driver (1.04.01.1011)   (HKLM\...\Creative OEM002) (Version:  - )
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
Müller Foto (HKLM\...\Müller Foto) (Version: 5.1.2 - CEWE COLOR AG u Co. OHG)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 1.6 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}) (Version: 9.09.0814 - NVIDIA Corporation)
Pixum Fotobuch (HKLM\...\Pixum Fotobuch) (Version:  - )
Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version:  - )
RICOH Media Driver ver.2.07.01.04 (HKLM\...\{2B818257-E6C7-4841-8C29-C5C9A982BCE5}) (Version: 2.07.01.04 - RICOH)
RICOH R5U8xx Media Driver ver.3.62.02 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.62.02 - RICOH)
Rossmann Fotowelt Software 4.12.1 (HKLM\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WISO Steuer 2012 (HKLM\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7303 - Buhl Data Service GmbH)
WISO Steuer 2013 (HKLM\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4264318807-1016488141-3849266651-1000_Classes\CLSID\{16C3058B-3855-A396-EAA4-DDE6E8917033}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4264318807-1016488141-3849266651-1000_Classes\CLSID\{66E8DCC7-97D2-4A89-8E08-D0610FF0878C}\InprocServer32 -> C:\Users\Dell\AppData\Local\Conduit\Community Alerts\Alert.dll (ClientConnect Ltd.)

==================== Restore Points  =========================

03-10-2014 14:49:03 Removed ABBYY FineReader 6.0 Sprint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1D4F5342-64F1-4A6B-9354-E24B4A2E12CE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {DE748743-865F-44AA-BE8B-29C16E2AAC54} - System32\Tasks\FoxTab => C:\Users\Dell\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {FD8E7420-6381-4244-94E0-54A9FAB3414E} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\FoxTab.job => C:\Users\Dell\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-07-07 09:50 - 2007-06-01 14:06 - 00020480 _____ () C:\Program Files\Lexmark 4800 Series\lxdeamon.exe
2013-07-07 09:50 - 2007-06-08 10:52 - 00028672 _____ () C:\Program Files\Lexmark 4800 Series\App4R.Monitor.Common.dll
2013-07-07 09:50 - 2007-06-08 10:52 - 00036864 _____ () C:\Program Files\Lexmark 4800 Series\App4R.Monitor.Core.dll
2013-07-07 09:50 - 2007-06-08 10:52 - 00057344 _____ () C:\Program Files\Lexmark 4800 Series\app4r.devmons.mcmdevmon.dll
2013-07-07 09:50 - 2007-06-01 14:06 - 00011776 _____ () C:\Program Files\Lexmark 4800 Series\App4R.DevMons.MCMDevMon.AutoPlayUtil.dll
2014-09-04 19:49 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\Dell\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2013-07-07 09:50 - 2007-05-22 16:09 - 00065536 _____ () C:\Program Files\Lexmark 4800 Series\lxdecaps.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2013-07-07 09:52 - 2007-05-23 09:42 - 00045056 _____ () C:\Windows\System32\LXF3PMON.DLL
2013-07-07 09:52 - 2007-01-17 14:07 - 00036864 _____ () C:\Windows\System32\LXF3OEM.DLL
2013-07-07 09:52 - 2007-05-23 09:44 - 00012288 _____ () C:\Windows\System32\LXF3PMRC.DLL
2007-05-16 06:45 - 2007-05-16 06:45 - 00802816 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdeptpc.dll
2007-05-25 19:42 - 2007-05-25 19:42 - 00151552 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdedrui.dll
2014-06-18 14:36 - 2014-10-03 10:53 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-4264318807-1016488141-3849266651-500 - Administrator - Disabled)
Dell (S-1-5-21-4264318807-1016488141-3849266651-1000 - Administrator - Enabled) => C:\Users\Dell
Gast (S-1-5-21-4264318807-1016488141-3849266651-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4264318807-1016488141-3849266651-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/03/2014 04:44:40 PM) (Source: RpcNs) (EventID: 2) (User: )
Description: "C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE"1996

Error: (10/03/2014 04:30:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/03/2014 00:07:39 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x8004231f).

Error: (10/03/2014 00:07:39 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x8004231f).

Error: (10/03/2014 09:49:56 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2014 08:09:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2014 02:28:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/27/2014 10:37:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/21/2014 04:59:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/21/2014 10:38:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (10/03/2014 04:42:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/03/2014 04:28:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lxdeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/03/2014 04:28:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxdeCATSCustConnectService erreicht.

Error: (10/03/2014 04:28:27 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎03.‎10.‎2014 um 13:20:29 unerwartet heruntergefahren.

Error: (10/03/2014 09:48:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "rimmptsk" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058

Error: (10/03/2014 09:48:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lxdeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/03/2014 09:48:17 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxdeCATSCustConnectService erreicht.

Error: (10/01/2014 09:51:30 PM) (Source: Microsoft-Windows-HAL) (EventID: 12) (User: )
Description: Der Speicher wurde beim letzten Leistungsübergang des Systems von der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte Firmware verfügbar ist.

Error: (10/01/2014 08:07:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lxdeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/01/2014 08:07:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxdeCATSCustConnectService erreicht.


Microsoft Office Sessions:
=========================
Error: (06/15/2014 09:15:54 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6611.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/26/2014 10:49:55 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 537 seconds with 300 seconds of active time.  This session ended with a crash.

Error: (03/06/2013 09:20:10 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6611.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 274 seconds with 240 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T7100 @ 1.80GHz
Percentage of memory in use: 71%
Total physical RAM: 2046.19 MB
Available physical RAM: 578.55 MB
Total Pagefile: 4092.38 MB
Available Pagefile: 1925.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.57 MB
         

FRST:


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-10-2014
Ran by Dell (administrator) on DELL-PC on 03-10-2014 17:14:16
Running from C:\Users\Dell\Downloads
Loaded Profiles: Dell (Available profiles: Dell)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\Lexmark 4800 Series\lxdeamon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON Software\Event Manager\EEventManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(CANON INC.) C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMSWCS.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [OEM02Mon.exe] => C:\Windows\OEM02Mon.exe [36864 2007-05-09] (Creative Technology Ltd.)
HKLM\...\Run: [NVHotkey] => rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-09-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)
HKLM\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [449168 2012-03-26] (CANON INC.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [Lexmark 4800 Series] => [X]
HKLM\...\RunOnce: [lxdeUninstallRan] => [X]
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-05-12] (Malwarebytes Corporation)
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {7c510a35-5a76-11e1-a442-806e6f6e6963} - E:\start.exe /auto
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {875c017b-5eb9-11e1-a2ed-0019b988e13c} - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {a8174f82-5d56-11e1-bb36-0019b988e13c} - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {a8174f94-5d56-11e1-bb36-0019b988e13c} - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {ad2977d4-5a73-11e1-bb6c-0019b988e13c} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7B4FE5D590EECC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {6F4BE9B1-9BCD-4988-94A5-7EF92477375A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552&CUI=UN16462282071408726&UM=1
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\user.js
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\Extensions\abs@avira.com [2014-09-30]

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-01] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-08] (Avira GmbH)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-03 17:10 - 2014-10-03 17:10 - 00002598 _____ () C:\Users\Dell\Desktop\AntiMaleware1.txt
2014-10-03 17:09 - 2014-10-03 17:09 - 00002597 _____ () C:\Users\Dell\Desktop\AntiMaleware.txt
2014-10-03 17:05 - 2014-10-03 17:07 - 00023437 _____ () C:\Users\Dell\Downloads\Addition.txt
2014-10-03 17:04 - 2014-10-03 17:14 - 00011208 _____ () C:\Users\Dell\Downloads\FRST.txt
2014-10-03 17:04 - 2014-10-03 17:14 - 00000000 ____D () C:\FRST
2014-10-03 17:03 - 2014-10-03 17:04 - 01100800 _____ (Farbar) C:\Users\Dell\Downloads\FRST.exe
2014-10-03 16:57 - 2014-10-03 16:57 - 00000010 _____ () C:\Users\Dell\Desktop\Fixlist.txt
2014-10-03 16:54 - 2014-10-03 16:54 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-03 16:52 - 2014-10-03 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-03 16:52 - 2014-10-03 16:52 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-10-03 16:52 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-03 16:52 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-03 16:47 - 2014-10-03 16:47 - 00000087 _____ () C:\ProgramData\lxde.log
2014-10-03 16:47 - 2014-10-03 16:47 - 00000078 _____ () C:\lxde.log
2014-10-03 16:45 - 2014-10-03 16:45 - 00000047 _____ () C:\Windows\WinInit.Ini
2014-10-03 16:41 - 2014-10-03 16:41 - 00000000 ____D () C:\ProgramData\hsswpr
2014-10-01 20:46 - 2014-10-01 20:46 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl_01009.Wdf
2014-10-01 20:40 - 2014-10-01 20:42 - 12255246 _____ () C:\Users\Dell\Downloads\WhatsAppMessenger 2.11.7.ipa
2014-09-17 16:07 - 2014-09-17 16:07 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-05 11:15 - 2014-09-05 11:15 - 00002036 _____ () C:\Users\Public\Desktop\WISO Steuer 2013.lnk
2014-09-05 11:15 - 2014-09-05 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer 2013
2014-09-04 19:49 - 2014-09-17 16:08 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-04 12:59 - 2014-09-05 11:23 - 00000000 ____D () C:\Users\Dell\Documents\Steuer
2014-09-04 11:44 - 2014-09-04 11:44 - 00000000 ____D () C:\Users\Dell\AppData\Roaming\Buhl Data Service
2014-09-04 11:44 - 2014-09-04 11:44 - 00000000 ____D () C:\Users\Dell\AppData\Local\Buhl Data Service
2014-09-04 11:43 - 2014-09-05 11:42 - 00000923 _____ () C:\Windows\wiso.ini
2014-09-04 11:43 - 2014-09-05 11:15 - 00000000 ____D () C:\Users\Dell\AppData\Local\Buhl
2014-09-04 11:43 - 2014-09-04 11:43 - 00002034 _____ () C:\Users\Public\Desktop\WISO Steuer 2012.lnk
2014-09-04 11:43 - 2014-09-04 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer 2012
2014-09-04 11:37 - 2014-09-05 11:17 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH
2014-09-04 11:37 - 2014-09-05 11:12 - 00000000 ____D () C:\Program Files\WISO

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-03 16:52 - 2013-05-22 18:52 - 00000000 ____D () C:\Users\Dell\AppData\Roaming\Malwarebytes
2014-10-03 16:52 - 2013-05-22 18:51 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-03 16:52 - 2013-05-22 18:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-03 16:52 - 2013-05-22 18:51 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-10-03 16:50 - 2013-10-29 12:42 - 00000000 ____D () C:\ProgramData\ABBYY
2014-10-03 16:47 - 2013-07-07 09:49 - 00000000 ____D () C:\Program Files\Lexmark 4800 Series
2014-10-03 16:46 - 2013-03-10 14:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-10-03 16:46 - 2013-02-22 22:22 - 00000000 ____D () C:\Program Files\Free Video Converter
2014-10-03 16:46 - 2009-07-14 06:52 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-10-03 16:46 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Windows NT
2014-10-03 16:45 - 2014-01-14 20:36 - 00000000 ____D () C:\Program Files\Canon
2014-10-03 16:45 - 2013-10-29 13:25 - 00000000 ____D () C:\Program Files\JDownloader
2014-10-03 16:45 - 2013-10-29 12:36 - 00000000 ____D () C:\Program Files\EpsonNet
2014-10-03 16:45 - 2013-10-29 12:35 - 00000000 ____D () C:\Program Files\EPSON Software
2014-10-03 16:45 - 2013-07-07 09:52 - 00000000 ____D () C:\Program Files\Lexmark Fax Solutions
2014-10-03 16:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-10-03 16:44 - 2013-10-29 12:34 - 00000000 ____D () C:\ProgramData\EPSON
2014-10-03 16:44 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32
2014-10-03 16:43 - 2012-02-22 15:13 - 00000000 ____D () C:\ProgramData\DatacardService
2014-10-03 16:42 - 2013-08-30 17:00 - 00000000 ____D () C:\Users\Dell\AppData\Local\Conduit
2014-10-03 16:42 - 2012-02-18 23:24 - 01984592 _____ () C:\Windows\WindowsUpdate.log
2014-10-03 16:36 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-03 16:36 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-03 16:28 - 2014-02-21 14:19 - 00006579 _____ () C:\Windows\setupact.log
2014-10-03 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-03 12:24 - 2013-10-29 13:24 - 00000284 _____ () C:\Windows\Tasks\FoxTab.job
2014-10-03 10:53 - 2014-06-18 14:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-10-01 21:00 - 2014-02-21 17:40 - 00000000 ____D () C:\Users\Dell\AppData\Roaming\iFunbox_UserCache
2014-09-21 17:00 - 2010-11-20 23:01 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-21 10:36 - 2014-02-21 14:18 - 00005216 _____ () C:\Windows\PFRO.log
2014-09-17 16:07 - 2013-09-08 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-17 16:07 - 2013-09-08 20:29 - 00000000 ____D () C:\Program Files\Avira
2014-09-17 16:03 - 2013-05-23 20:48 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-05 11:12 - 2012-08-05 18:22 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-09-05 10:25 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-04 19:49 - 2013-08-30 17:25 - 00000000 ____D () C:\ProgramData\Avira
2014-09-04 19:27 - 2013-09-08 20:31 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-09-04 19:27 - 2013-09-08 20:29 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-09-04 19:27 - 2013-09-08 20:29 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

Some content of TEMP:
====================
C:\Users\Dell\AppData\Local\Temp\21983uninstall.exe
C:\Users\Dell\AppData\Local\Temp\avgnt.exe
C:\Users\Dell\AppData\Local\Temp\Sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-27 11:54

==================== End Of Log ============================
         

--- --- ---

--- --- ---



Malware:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 03.10.2014
Suchlauf-Zeit: 16:54:48
Logdatei: AntiMaleware.txt
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.10.03.04
Rootkit Datenbank: v2014.09.19.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Dell

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 284243
Verstrichene Zeit: 13 Min, 44 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 3
PUP.Optional.Conduit.A, HKU\S-1-5-21-4264318807-1016488141-3849266651-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, , [9cb420f0d0ace25453228cd244c0b14f], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4264318807-1016488141-3849266651-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [73dd51bf225a15211b8c2a184fb4cb35], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4264318807-1016488141-3849266651-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [2c2442ce79038da98380c19848bcb44c], 

Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4264318807-1016488141-3849266651-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, , [2c2442ce79038da98380c19848bcb44c]

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 4
PUP.Optional.ClientConnect, C:\Users\Dell\AppData\Local\Temp\Hotspot_Shield\tbHot0.dll, , [ed63fc149ce0fa3c13d4f8b9cc3541bf], 
PUP.Optional.ClientConnect, C:\Users\Dell\AppData\Local\Conduit\Community Alerts\Alert.dll, , [420ef719a5d7e2546780ffb2fa07bc44], 
PUP.Optional.Searchqu.A, C:\Users\Dell\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}, , [4a060709a6d680b692def762828213ed], 
PUP.Optional.Conduit.A, C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\prefs.js, Gut: (), Schlecht: (user_pref("CT1561552.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT1561552&octid=CT1561552&SearchSource=15&CUI=UN74943373311082131&SSPV=&Lay=1&UM=1\"}");), ,[bb950d036f0d65d1721b52f409fc8d73]

Physische Sektoren: 0
(No malicious items detected)


(end)
         

Hätte dort jemand eventuell einfach mal kurz Zeit dort einen Blick drauf zu werfen. Das wäre spitze und ich bedanke mich recht herzlich im Voraus.

Viele Grüße

...und hier noch einmal der ADWCleanerlog

# AdwCleaner v3.311 - Bericht erstellt am 03/10/2014 um 17:22:12
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Dell - DELL-PC
# Gestartet von : C:\Users\Dell\Downloads\adwcleaner_3.311.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\END
Datei Gefunden : C:\Program Files\Mozilla Firefox\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
Datei Gefunden : C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\user.js
Datei Gefunden : C:\Windows\system32\roboot.exe
Ordner Gefunden : C:\Program Files\Conduit
Ordner Gefunden : C:\Program Files\Free Video Converter
Ordner Gefunden : C:\Program Files\MyPC Backup
Ordner Gefunden : C:\Users\Dell\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Dell\AppData\Local\Temp\hotspot shield
Ordner Gefunden : C:\Users\Dell\AppData\Local\Temp\Hotspot_Shield
Ordner Gefunden : C:\Users\Dell\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Dell\AppData\Roaming\hotspot shield
Ordner Gefunden : C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\Smartbar
Ordner Gefunden : C:\Users\Dell\AppData\Roaming\software4u
Ordner Gefunden : C:\Users\Dell\AppData\Roaming\Systweak
Ordner Gefunden : C:\Windows\system32\hotspot shield

***** [ Tasks ] *****

Task Gefunden : FoxTab

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\anchorfree
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Tbccint_HKLM
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT1561552
Schlüssel Gefunden : HKLM\SOFTWARE\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitUninstaller_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitUninstaller_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\systweak

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16457


-\\ Mozilla Firefox v32.0.3 (x86 de)

[ Datei : C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\prefs.js ]

Zeile gefunden : user_pref("CT1561552.1000082.isPlayDisplay", "true");
Zeile gefunden : user_pref("CT1561552.1000082.state", "{\"state\":\"stopped\",\"text\":\"Danceradio\",\"description\":\"Danceradio\",\"url\":\"hxxp://101danceradio.com/wmx/classicrockjukebox64k.wmx\"}");
Zeile gefunden : user_pref("CT1561552.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gefunden : user_pref("CT1561552.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gefunden : user_pref("CT1561552.FF19Solved", "true");
Zeile gefunden : user_pref("CT1561552.FirstTime", "true");
Zeile gefunden : user_pref("CT1561552.FirstTimeFF3", "true");
Zeile gefunden : user_pref("CT1561552.GK_HotspotShield_NOTIF_26_02_SENT.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gefunden : user_pref("CT1561552.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gefunden : user_pref("CT1561552.SearchAppState.enc", "Mg==");
Zeile gefunden : user_pref("CT1561552.UserID", "UN74943373311082131");
Zeile gefunden : user_pref("CT1561552.addressBarTakeOverEnabledInHidden", "true");
Zeile gefunden : user_pref("CT1561552.cbfirsttime.enc", "RnJpIEF1ZyAzMCAyMDEzIDE3OjAxOjIxIEdNVCswMjAw");
Zeile gefunden : user_pref("CT1561552.countryCode", "DE");
Zeile gefunden : user_pref("CT1561552.defaultSearch", "false");
Zeile gefunden : user_pref("CT1561552.enableAlerts", "true");
Zeile gefunden : user_pref("CT1561552.enableSearchFromAddressBar", "true");
Zeile gefunden : user_pref("CT1561552.firstTimeDialogOpened", "true");
Zeile gefunden : user_pref("CT1561552.fixPageNotFoundError", "true");
Zeile gefunden : user_pref("CT1561552.fixPageNotFoundErrorByUser", "true");
Zeile gefunden : user_pref("CT1561552.fixPageNotFoundErrorInHidden", "true");
Zeile gefunden : user_pref("CT1561552.fullUserID", "UN74943373311082131.IN.20130830170023");
Zeile gefunden : user_pref("CT1561552.installDate", "30/08/2013 17:00:26");
Zeile gefunden : user_pref("CT1561552.installId", "conduitinstaller.exe");
Zeile gefunden : user_pref("CT1561552.installSessionId", "-1");
Zeile gefunden : user_pref("CT1561552.installSp", "FALSE");
Zeile gefunden : user_pref("CT1561552.installType", "conduitnsisintegration");
Zeile gefunden : user_pref("CT1561552.installUsage", "2013-08-30T18:01:07.0321623+03:00");
Zeile gefunden : user_pref("CT1561552.installUsageEarly", "2013-08-30T18:00:58.3914267+03:00");
Zeile gefunden : user_pref("CT1561552.installerVersion", "1.6.1.2");
Zeile gefunden : user_pref("CT1561552.isCheckedStartAsHidden", true);
Zeile gefunden : user_pref("CT1561552.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gefunden : user_pref("CT1561552.isFirstTimeToolbarLoading", "false");
Zeile gefunden : user_pref("CT1561552.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gefunden : user_pref("CT1561552.keyword", "true");
Zeile gefunden : user_pref("CT1561552.lastVersion", "10.19.2.5");
Zeile gefunden : user_pref("CT1561552.mam_gk_appStateReportTime.enc", "MTM3Nzg3NDg3NzcyNw==");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_ACplus.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_DealPly.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_Find-a-Pro.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_PiclickV2-WebSearch.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gefunden : user_pref("CT1561552.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IkNvdXBvbkJ1ZGR5IiwidXJsIjoiaHR0cDovL3d3dy5zb2NpYWxncm93dGh0ZWNobm9sb2dpZXMuY29tL2NvdXBvbmJ1ZGR5X3YwMDMvaW5kZXgucGhwP2N0aWQ9RUJUT09MQkFS[...]
Zeile gefunden : user_pref("CT1561552.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gefunden : user_pref("CT1561552.mam_gk_calledSetupService.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IlBpY2xpY2tWMi1XZWJTZWFyY2giLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiI5MTU0ZDlkOS00MDZiLTQxNjYtYWFhZS04YTIwOTZlYTEyNGMiLCJ[...]
Zeile gefunden : user_pref("CT1561552.mam_gk_currentVersion.enc", "MS4xMC40LjA=");
Zeile gefunden : user_pref("CT1561552.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_first_time.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Zeile gefunden : user_pref("CT1561552.mam_gk_lastLoginTime.enc", "MTM3Nzg3NDg3NDA3MQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gefunden : user_pref("CT1561552.mam_gk_new_welcome_experience.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_settings1.10.4.0.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDlfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiVVMiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gefunden : user_pref("CT1561552.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gefunden : user_pref("CT1561552.mam_gk_userId.enc", "ZmI1MDJkNjUtMDM2Yi00Mjg1LTljMDktYjk4ZjdhMzVjYTYw");
Zeile gefunden : user_pref("CT1561552.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gefunden : user_pref("CT1561552.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about%3Ahome\",\"EB_MAIN_FRAME_TITLE\":\"Mozilla%20Firefox-Startseite\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp:[...]
Zeile gefunden : user_pref("CT1561552.openThankYouPage", "false");
Zeile gefunden : user_pref("CT1561552.openUninstallPage", "true");
Zeile gefunden : user_pref("CT1561552.originalSearchAddressUrl", "");
Zeile gefunden : user_pref("CT1561552.revertSettingsEnabled", "false");
Zeile gefunden : user_pref("CT1561552.search.searchAppId", "128491907208256770");
Zeile gefunden : user_pref("CT1561552.search.searchCount", "0");
Zeile gefunden : user_pref("CT1561552.searchInNewTabEnabledByUser", "false");
Zeile gefunden : user_pref("CT1561552.searchInNewTabEnabledInHidden", "true");
Zeile gefunden : user_pref("CT1561552.searchRevert", "false");
Zeile gefunden : user_pref("CT1561552.searchSuggestEnabledByUser", "true");
Zeile gefunden : user_pref("CT1561552.searchUserMode", "1");
Zeile gefunden : user_pref("CT1561552.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT1561552\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://HotspotShield.OurToolbar.com//xpi\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Hotspot Shield \"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_Configuration_lastUpdate", "1392827544234");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1377874861333");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_appsMetadata_lastUpdate", "1378235946290");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1377874861044");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1377874859458");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1377874868246");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_login_10.19.2.5_lastUpdate", "1392887678525");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1377874860851");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_searchAPI_lastUpdate", "1392827544271");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_serviceMap_lastUpdate", "1392827543991");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_toolbarContextMenu_lastUpdate", "1377874860936");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_toolbarSettings_lastUpdate", "1392887678488");
Zeile gefunden : user_pref("CT1561552.serviceLayer_services_translation_lastUpdate", "1392827545231");
Zeile gefunden : user_pref("CT1561552.settingsINI", true);
Zeile gefunden : user_pref("CT1561552.shouldFirstTimeDialog", "false");
Zeile gefunden : user_pref("CT1561552.showToolbarPermission", "false");
Zeile gefunden : user_pref("CT1561552.smartbar.CTID", "CT1561552");
Zeile gefunden : user_pref("CT1561552.smartbar.Uninstall", "0");
Zeile gefunden : user_pref("CT1561552.smartbar.isHidden", true);
Zeile gefunden : user_pref("CT1561552.smartbar.toolbarName", "Hotspot Shield ");
Zeile gefunden : user_pref("CT1561552.startPage", "false");
Zeile gefunden : user_pref("CT1561552.toolbarBornServerTime", "30-8-2013");
Zeile gefunden : user_pref("CT1561552.toolbarCurrentServerTime", "20-2-2014");
Zeile gefunden : user_pref("CT1561552.toolbarDisabled", "true");
Zeile gefunden : user_pref("CT1561552.toolbarLoginClientTime", "Fri Aug 30 2013 17:01:04 GMT+0200");
Zeile gefunden : user_pref("CT1561552.twitter_v1.8.0_twitter_app_open_t_f.enc", "ZmFsc2U=");
Zeile gefunden : user_pref("CT1561552.url_history0001.enc", "aHR0cHM6Ly9hZGRvbnMubW96aWxsYS5vcmcvZmlyZWZveC9kb3dubG9hZHMvbGF0ZXN0LzMwMDYvYWRkb24tMzAwNi1sYXRlc3QueHBpP3NyYz1kcC1idG4tcHJpbWFyeTo6OmNsaWNraGFuZGxlcjo6OjEz[...]
Zeile gefunden : user_pref("CT1561552.versionFromInstaller", "10.19.2.5");
Zeile gefunden : user_pref("CT1561552.xpeMode", "0");
Zeile gefunden : user_pref("CT1561552_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1392888992376,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gefunden : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gefunden : user_pref("smartbar.addressBarOwnerCTID", "CT1561552");
Zeile gefunden : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=2&CUI=UN74943373311082131&UM=1&q=");
Zeile gefunden : user_pref("smartbar.machineId", "QB8DTXFIUP9GUDFVLVPAC4NL2Q/+H3HIDIWITKGVLP3VUYYMAY4A8WUY4WONFCGWSYXFXGPPQJXY7WRMO5NMEW");

*************************

AdwCleaner[R0].txt - [15438 octets] - [03/10/2014 17:22:12]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [15499 octets] ##########
         

und so sieht adw nach dem Scan aus:

# AdwCleaner v3.311 - Bericht erstellt am 03/10/2014 um 17:26:18
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Dell - DELL-PC
# Gestartet von : C:\Users\Dell\Downloads\adwcleaner_3.311.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\Free Video Converter
Ordner Gelöscht : C:\Program Files\MyPC Backup
Ordner Gelöscht : C:\Windows\system32\hotspot shield
Ordner Gelöscht : C:\Users\Dell\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Dell\AppData\Local\Temp\hotspot shield
Ordner Gelöscht : C:\Users\Dell\AppData\Local\Temp\Hotspot_Shield
Ordner Gelöscht : C:\Users\Dell\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Dell\AppData\Roaming\hotspot shield
Ordner Gelöscht : C:\Users\Dell\AppData\Roaming\software4u
Ordner Gelöscht : C:\Users\Dell\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\Smartbar
Datei Gelöscht : C:\Program Files\Mozilla Firefox\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\system32\roboot.exe
Datei Gelöscht : C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\user.js

***** [ Tasks ] *****

Task Gelöscht : FoxTab

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitUninstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitUninstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT1561552
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Tbccint_HKLM
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16457


-\\ Mozilla Firefox v32.0.3 (x86 de)

[ Datei : C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\prefs.js ]

Zeile gelöscht : user_pref("CT1561552.1000082.isPlayDisplay", "true");
Zeile gelöscht : user_pref("CT1561552.1000082.state", "{\"state\":\"stopped\",\"text\":\"Danceradio\",\"description\":\"Danceradio\",\"url\":\"hxxp://101danceradio.com/wmx/classicrockjukebox64k.wmx\"}");
Zeile gelöscht : user_pref("CT1561552.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT1561552.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT1561552.FF19Solved", "true");
Zeile gelöscht : user_pref("CT1561552.FirstTime", "true");
Zeile gelöscht : user_pref("CT1561552.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT1561552.GK_HotspotShield_NOTIF_26_02_SENT.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT1561552.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT1561552.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT1561552.UserID", "UN74943373311082131");
Zeile gelöscht : user_pref("CT1561552.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT1561552.cbfirsttime.enc", "RnJpIEF1ZyAzMCAyMDEzIDE3OjAxOjIxIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT1561552.countryCode", "DE");
Zeile gelöscht : user_pref("CT1561552.defaultSearch", "false");
Zeile gelöscht : user_pref("CT1561552.enableAlerts", "true");
Zeile gelöscht : user_pref("CT1561552.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT1561552.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT1561552.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT1561552.fixPageNotFoundErrorByUser", "true");
Zeile gelöscht : user_pref("CT1561552.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT1561552.fullUserID", "UN74943373311082131.IN.20130830170023");
Zeile gelöscht : user_pref("CT1561552.installDate", "30/08/2013 17:00:26");
Zeile gelöscht : user_pref("CT1561552.installId", "conduitinstaller.exe");
Zeile gelöscht : user_pref("CT1561552.installSessionId", "-1");
Zeile gelöscht : user_pref("CT1561552.installSp", "FALSE");
Zeile gelöscht : user_pref("CT1561552.installType", "conduitnsisintegration");
Zeile gelöscht : user_pref("CT1561552.installUsage", "2013-08-30T18:01:07.0321623+03:00");
Zeile gelöscht : user_pref("CT1561552.installUsageEarly", "2013-08-30T18:00:58.3914267+03:00");
Zeile gelöscht : user_pref("CT1561552.installerVersion", "1.6.1.2");
Zeile gelöscht : user_pref("CT1561552.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT1561552.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT1561552.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT1561552.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT1561552.keyword", "true");
Zeile gelöscht : user_pref("CT1561552.lastVersion", "10.19.2.5");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appStateReportTime.enc", "MTM3Nzg3NDg3NzcyNw==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_ACplus.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_DealPly.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_Find-a-Pro.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_PiclickV2-WebSearch.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IkNvdXBvbkJ1ZGR5IiwidXJsIjoiaHR0cDovL3d3dy5zb2NpYWxncm93dGh0ZWNobm9sb2dpZXMuY29tL2NvdXBvbmJ1ZGR5X3YwMDMvaW5kZXgucGhwP2N0aWQ9RUJUT09MQkFS[...]
Zeile gelöscht : user_pref("CT1561552.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IlBpY2xpY2tWMi1XZWJTZWFyY2giLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiI5MTU0ZDlkOS00MDZiLTQxNjYtYWFhZS04YTIwOTZlYTEyNGMiLCJ[...]
Zeile gelöscht : user_pref("CT1561552.mam_gk_currentVersion.enc", "MS4xMC40LjA=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_lastLoginTime.enc", "MTM3Nzg3NDg3NDA3MQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT1561552.mam_gk_new_welcome_experience.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_settings1.10.4.0.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDlfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiVVMiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT1561552.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT1561552.mam_gk_userId.enc", "ZmI1MDJkNjUtMDM2Yi00Mjg1LTljMDktYjk4ZjdhMzVjYTYw");
Zeile gelöscht : user_pref("CT1561552.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT1561552.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about%3Ahome\",\"EB_MAIN_FRAME_TITLE\":\"Mozilla%20Firefox-Startseite\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp:[...]
Zeile gelöscht : user_pref("CT1561552.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT1561552.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT1561552.originalSearchAddressUrl", "");
Zeile gelöscht : user_pref("CT1561552.revertSettingsEnabled", "false");
Zeile gelöscht : user_pref("CT1561552.search.searchAppId", "128491907208256770");
Zeile gelöscht : user_pref("CT1561552.search.searchCount", "0");
Zeile gelöscht : user_pref("CT1561552.searchInNewTabEnabledByUser", "false");
Zeile gelöscht : user_pref("CT1561552.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT1561552.searchRevert", "false");
Zeile gelöscht : user_pref("CT1561552.searchSuggestEnabledByUser", "true");
Zeile gelöscht : user_pref("CT1561552.searchUserMode", "1");
Zeile gelöscht : user_pref("CT1561552.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT1561552\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://HotspotShield.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Hotspot Shield \"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_Configuration_lastUpdate", "1392827544234");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1377874861333");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_appsMetadata_lastUpdate", "1378235946290");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1377874861044");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1377874859458");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1377874868246");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_login_10.19.2.5_lastUpdate", "1392887678525");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1377874860851");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_searchAPI_lastUpdate", "1392827544271");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_serviceMap_lastUpdate", "1392827543991");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_toolbarContextMenu_lastUpdate", "1377874860936");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_toolbarSettings_lastUpdate", "1392887678488");
Zeile gelöscht : user_pref("CT1561552.serviceLayer_services_translation_lastUpdate", "1392827545231");
Zeile gelöscht : user_pref("CT1561552.settingsINI", true);
Zeile gelöscht : user_pref("CT1561552.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT1561552.showToolbarPermission", "false");
Zeile gelöscht : user_pref("CT1561552.smartbar.CTID", "CT1561552");
Zeile gelöscht : user_pref("CT1561552.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT1561552.smartbar.isHidden", true);
Zeile gelöscht : user_pref("CT1561552.smartbar.toolbarName", "Hotspot Shield ");
Zeile gelöscht : user_pref("CT1561552.startPage", "false");
Zeile gelöscht : user_pref("CT1561552.toolbarBornServerTime", "30-8-2013");
Zeile gelöscht : user_pref("CT1561552.toolbarCurrentServerTime", "20-2-2014");
Zeile gelöscht : user_pref("CT1561552.toolbarDisabled", "true");
Zeile gelöscht : user_pref("CT1561552.toolbarLoginClientTime", "Fri Aug 30 2013 17:01:04 GMT+0200");
Zeile gelöscht : user_pref("CT1561552.twitter_v1.8.0_twitter_app_open_t_f.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT1561552.url_history0001.enc", "aHR0cHM6Ly9hZGRvbnMubW96aWxsYS5vcmcvZmlyZWZveC9kb3dubG9hZHMvbGF0ZXN0LzMwMDYvYWRkb24tMzAwNi1sYXRlc3QueHBpP3NyYz1kcC1idG4tcHJpbWFyeTo6OmNsaWNraGFuZGxlcjo6OjEz[...]
Zeile gelöscht : user_pref("CT1561552.versionFromInstaller", "10.19.2.5");
Zeile gelöscht : user_pref("CT1561552.xpeMode", "0");
Zeile gelöscht : user_pref("CT1561552_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1392888992376,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT1561552");
Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=2&CUI=UN74943373311082131&UM=1&q=");
Zeile gelöscht : user_pref("smartbar.machineId", "QB8DTXFIUP9GUDFVLVPAC4NL2Q/+H3HIDIWITKGVLP3VUYYMAY4A8WUY4WONFCGWSYXFXGPPQJXY7WRMO5NMEW");

*************************

AdwCleaner[R0].txt - [15580 octets] - [03/10/2014 17:22:12]
AdwCleaner[S0].txt - [15500 octets] - [03/10/2014 17:26:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15561 octets] ##########
         

hi,

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Danke für die schnelle Hilfe:

Hier die log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.7 (10.03.2014:1)
OS: Windows 7 Home Premium x86
Ran by Dell on 03.10.2014 at 17:34:56,30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-4264318807-1016488141-3849266651-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6F4BE9B1-9BCD-4988-94A5-7EF92477375A}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{0118B18F-0AA3-453D-B234-95920A97E963}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{11A18A5C-1900-4EF8-B21D-1A63AE7BA401}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{12FFECB9-9DE3-4D35-8A59-4D9FD737CE3F}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{16EBE2B6-8A3A-4ECD-A56F-23F4A5940755}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{2C4B6627-F261-406C-A46D-FD5761EF11B7}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{30B36148-DC9E-4C7E-801D-8528EC0CD19D}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{30C0648D-D375-4BAF-9556-10D61FEC5A86}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{35556613-D4AF-44F7-BE42-25B0CE932E92}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{49ED9E70-FDDA-4121-A10B-DFA543931C12}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{5567F59E-5845-43D6-AB36-9B405BA66B2F}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{6D87FC40-9536-4476-99CA-D9F8AC5B0160}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{6DFEF1C4-2B82-4D66-87EC-46D52C22B0B8}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{7BA43BC2-A8F5-4E3D-BA7E-C17E14CD68B4}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{95E05FD5-1B37-4CDA-9F69-FC9F8FDBA1FB}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{9FEBFE24-8D8E-401C-B5BA-FFB8F941825D}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{A367349A-25AC-4293-971C-E821296985E5}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{A39C7E46-D3F7-4150-B190-95EAE531D0D4}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{CC42CF31-3C50-4A78-A4BC-B5F772E0D032}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{D9BC4EDB-0F34-4963-ACEA-DDC29048E7E1}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{E3A67A69-3CD1-4605-BF2A-5A443E6741B1}
Successfully deleted: [Empty Folder] C:\Users\Dell\appdata\local\{F1DECA1E-CB3F-4DC1-ACCE-2221F182C056}



~~~ FireFox

Emptied folder: C:\Users\Dell\AppData\Roaming\mozilla\firefox\profiles\j71ll2yn.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2014 at 17:38:32,33
End of JRT log
         

FRST:


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-10-2014
Ran by Dell (administrator) on DELL-PC on 03-10-2014 17:41:22
Running from C:\Users\Dell\Downloads
Loaded Profile: Dell (Available profiles: Dell)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON Software\Event Manager\EEventManager.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(CANON INC.) C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMSWCS.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [OEM02Mon.exe] => C:\Windows\OEM02Mon.exe [36864 2007-05-09] (Creative Technology Ltd.)
HKLM\...\Run: [NVHotkey] => rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-09-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)
HKLM\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [449168 2012-03-26] (CANON INC.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {7c510a35-5a76-11e1-a442-806e6f6e6963} - E:\start.exe /auto
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {875c017b-5eb9-11e1-a2ed-0019b988e13c} - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {a8174f82-5d56-11e1-bb36-0019b988e13c} - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {a8174f94-5d56-11e1-bb36-0019b988e13c} - F:\AutoRun.exe
HKU\S-1-5-21-4264318807-1016488141-3849266651-1000\...\MountPoints2: {ad2977d4-5a73-11e1-bb6c-0019b988e13c} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7B4FE5D590EECC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Dell\AppData\Roaming\Mozilla\Firefox\Profiles\j71ll2yn.default\Extensions\abs@avira.com [2014-09-30]

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-01] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-08] (Avira GmbH)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-03 17:34 - 2014-10-03 17:34 - 00000000 ____D () C:\Windows\ERUNT
2014-10-03 17:22 - 2014-10-03 17:26 - 00000000 ____D () C:\AdwCleaner
2014-10-03 17:22 - 2014-10-03 17:22 - 01702068 _____ (Thisisu) C:\Users\Dell\Downloads\JRT.exe
2014-10-03 17:20 - 2014-10-03 17:20 - 01375089 _____ () C:\Users\Dell\Downloads\adwcleaner_3.311.exe
2014-10-03 17:05 - 2014-10-03 17:15 - 00023424 _____ () C:\Users\Dell\Downloads\Addition.txt
2014-10-03 17:04 - 2014-10-03 17:41 - 00010545 _____ () C:\Users\Dell\Downloads\FRST.txt
2014-10-03 17:04 - 2014-10-03 17:41 - 00000000 ____D () C:\FRST
2014-10-03 17:03 - 2014-10-03 17:04 - 01100800 _____ (Farbar) C:\Users\Dell\Downloads\FRST.exe
2014-10-03 16:54 - 2014-10-03 17:30 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-03 16:52 - 2014-10-03 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-03 16:52 - 2014-10-03 16:52 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-10-03 16:52 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-03 16:52 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-03 16:47 - 2014-10-03 16:47 - 00000087 _____ () C:\ProgramData\lxde.log
2014-10-03 16:47 - 2014-10-03 16:47 - 00000078 _____ () C:\lxde.log
2014-10-03 16:45 - 2014-10-03 16:45 - 00000047 _____ () C:\Windows\WinInit.Ini
2014-10-01 20:46 - 2014-10-01 20:46 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl_01009.Wdf
2014-10-01 20:40 - 2014-10-01 20:42 - 12255246 _____ () C:\Users\Dell\Downloads\WhatsAppMessenger 2.11.7.ipa
2014-09-17 16:07 - 2014-09-17 16:07 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-05 11:15 - 2014-09-05 11:15 - 00002036 _____ () C:\Users\Public\Desktop\WISO Steuer 2013.lnk
2014-09-05 11:15 - 2014-09-05 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer 2013
2014-09-04 19:49 - 2014-09-17 16:08 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-04 12:59 - 2014-09-05 11:23 - 00000000 ____D () C:\Users\Dell\Documents\Steuer
2014-09-04 11:44 - 2014-09-04 11:44 - 00000000 ____D () C:\Users\Dell\AppData\Roaming\Buhl Data Service
2014-09-04 11:44 - 2014-09-04 11:44 - 00000000 ____D () C:\Users\Dell\AppData\Local\Buhl Data Service
2014-09-04 11:43 - 2014-09-05 11:42 - 00000923 _____ () C:\Windows\wiso.ini
2014-09-04 11:43 - 2014-09-05 11:15 - 00000000 ____D () C:\Users\Dell\AppData\Local\Buhl
2014-09-04 11:43 - 2014-09-04 11:43 - 00002034 _____ () C:\Users\Public\Desktop\WISO Steuer 2012.lnk
2014-09-04 11:43 - 2014-09-04 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer 2012
2014-09-04 11:37 - 2014-09-05 11:17 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH
2014-09-04 11:37 - 2014-09-05 11:12 - 00000000 ____D () C:\Program Files\WISO

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-03 17:36 - 2012-02-18 23:24 - 02032910 _____ () C:\Windows\WindowsUpdate.log
2014-10-03 17:36 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-03 17:36 - 2009-07-14 06:34 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-03 17:28 - 2014-02-21 14:19 - 00006635 _____ () C:\Windows\setupact.log
2014-10-03 17:28 - 2014-02-21 14:18 - 00015380 _____ () C:\Windows\PFRO.log
2014-10-03 17:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-03 16:52 - 2013-05-22 18:52 - 00000000 ____D () C:\Users\Dell\AppData\Roaming\Malwarebytes
2014-10-03 16:52 - 2013-05-22 18:51 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-03 16:52 - 2013-05-22 18:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-03 16:50 - 2013-10-29 12:42 - 00000000 ____D () C:\ProgramData\ABBYY
2014-10-03 16:46 - 2013-03-10 14:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-10-03 16:46 - 2009-07-14 06:52 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-10-03 16:46 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Windows NT
2014-10-03 16:45 - 2014-01-14 20:36 - 00000000 ____D () C:\Program Files\Canon
2014-10-03 16:45 - 2013-10-29 13:25 - 00000000 ____D () C:\Program Files\JDownloader
2014-10-03 16:45 - 2013-10-29 12:36 - 00000000 ____D () C:\Program Files\EpsonNet
2014-10-03 16:45 - 2013-10-29 12:35 - 00000000 ____D () C:\Program Files\EPSON Software
2014-10-03 16:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-10-03 16:44 - 2013-10-29 12:34 - 00000000 ____D () C:\ProgramData\EPSON
2014-10-03 16:44 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32
2014-10-03 16:43 - 2012-02-22 15:13 - 00000000 ____D () C:\ProgramData\DatacardService
2014-10-03 10:53 - 2014-06-18 14:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-10-01 21:00 - 2014-02-21 17:40 - 00000000 ____D () C:\Users\Dell\AppData\Roaming\iFunbox_UserCache
2014-09-21 17:00 - 2010-11-20 23:01 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-17 16:07 - 2013-09-08 20:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-17 16:07 - 2013-09-08 20:29 - 00000000 ____D () C:\Program Files\Avira
2014-09-17 16:03 - 2013-05-23 20:48 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-05 11:12 - 2012-08-05 18:22 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-09-05 10:25 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-04 19:49 - 2013-08-30 17:25 - 00000000 ____D () C:\ProgramData\Avira
2014-09-04 19:27 - 2013-09-08 20:31 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-09-04 19:27 - 2013-09-08 20:29 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-09-04 19:27 - 2013-09-08 20:29 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

Some content of TEMP:
====================
C:\Users\Dell\AppData\Local\Temp\21983uninstall.exe
C:\Users\Dell\AppData\Local\Temp\avgnt.exe
C:\Users\Dell\AppData\Local\Temp\Quarantine.exe
C:\Users\Dell\AppData\Local\Temp\Sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-27 11:54

==================== End Of Log ============================
         

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?