Mengenweise Werbung in Moz Firefox

PowerBauer · 20.10.2014, 15:28

Hallo,

bisher war ich zufrieden mit Firefox - jetzt werde ich zugemüllt mit Werbung - trotz adblock - habe nun avant Browser installiert - aber irgendwas muss ich mir ja eingefangen haben - der neue Browser listet auch sehr lange Listen von Werbung auf, die er blockiert....

nun die Log-files:

#
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-10-2014
Ran by C (administrator) on CS on 20-10-2014 16:12:10
Running from C:\Users\C\Downloads
Loaded Profile: C (Available profiles: C & th)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC207\Monitor.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAE.EXE
(Dropbox, Inc.) C:\Users\C\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\avant.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\avantvw.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\ybrowser.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\ybrowser.exe
() C:\Program Files (x86)\Avant Browser\adownloader.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PAC207_Monitor] => C:\WINDOWS\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM-x32\...\Run: [EaseUS EPM tray] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\EpmNews.exe
HKLM-x32\...\Run: [fst_de_24] => [X]
HKLM-x32\...\Run: [t4pc_en_4] => [X]
HKU\S-1-5-21-3677390136-3846881265-2206516262-1001\...\Run: [EPSON SX525WD Series] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGAE.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3677390136-3846881265-2206516262-1001\...\MountPoints2: {487c7531-cd63-11e3-824c-806e6f6e6963} - "H:\setup.exe"
Startup: C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\C\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search.yahoo.com/?fr=avantsearch6
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: downloaditkeep -> {D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA} -> C:\ProgramData\downloaditkeep\dkKTCByw.x64.dll ()
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: downloaditkeep -> {D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA} -> C:\ProgramData\downloaditkeep\dkKTCByw.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default
FF SearchEngineOrder.1: SuchMaschine
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: downilooaditkeueip - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\eoaoy.p@bla-hdmrl.org [2014-10-06]
FF Extension: WEB.DE MailCheck - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\toolbar@web.de [2014-09-21]
FF Extension: DownloadHelper - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Adblock Plus - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-06]

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
S2 UpdaterSvcScanTack; "C:\Program Files (x86)\ScanTack\updater.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DRHARD64; C:\WINDOWS\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHARD64; C:\WINDOWS\SysWOW64\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHMSR64; C:\WINDOWS\system32\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R2 DRHMSR64; C:\WINDOWS\SysWOW64\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R3 MTsensor; C:\Windows\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
R3 PAC207; C:\Windows\system32\DRIVERS\PFC027.SYS [684544 2007-10-25] (PixArt Imaging Inc.)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 VBoxNetFlt; \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 16:12 - 2014-10-20 16:12 - 00010305 _____ () C:\Users\C\Downloads\FRST.txt
2014-10-20 16:12 - 2014-10-20 16:12 - 00000000 ____D () C:\FRST
2014-10-20 16:11 - 2014-10-20 16:11 - 02111488 _____ (Farbar) C:\Users\C\Downloads\FRST64.exe
2014-10-20 16:02 - 2014-10-20 16:02 - 01209840 _____ () C:\Users\C\Downloads\java_runtime_environment_jre.exe
2014-10-20 16:00 - 2014-10-20 16:00 - 00071536 _____ (Premium Installer ) C:\Users\C\Downloads\setup(1).exe
2014-10-20 15:53 - 2014-10-20 15:53 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-20 15:53 - 2014-10-20 15:53 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-10-20 15:39 - 2014-10-20 15:39 - 01976320 _____ () C:\Users\C\Downloads\adwcleaner_4.000.exe
2014-10-20 15:23 - 2014-10-20 15:23 - 00000000 ____D () C:\Users\C\AppData\Roaming\EPSON
2014-10-16 11:39 - 2014-10-16 11:39 - 01138688 _____ () C:\Users\C\Downloads\▶_I_Surrender_-_Hillsong_Live_(Cornerstone_2012_DVD_Album)_Lyrics_Subtitles_(Best_Worship_Song)_-_YouTube.flv
2014-10-15 19:37 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-15 19:37 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-15 19:37 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-15 19:37 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-15 19:37 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-15 19:37 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-15 19:37 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-15 19:37 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-15 19:37 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-15 19:37 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-15 19:37 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-10-15 19:37 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-10-15 19:37 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-15 19:37 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-15 19:37 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-10-15 19:37 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-10-15 19:37 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-15 19:37 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-10-15 19:37 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-15 19:37 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-15 19:37 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-15 19:37 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-15 19:37 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-15 19:37 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-15 19:37 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-15 19:37 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-15 19:37 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-15 19:37 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-15 19:37 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-10-15 19:37 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-15 19:37 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-10-15 19:37 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-10-15 19:37 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-10-15 19:37 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-10-15 19:37 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-10-15 19:37 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-10-15 19:37 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-10-15 19:37 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-10-15 19:37 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-10-15 19:37 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-10-15 19:37 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-10-15 19:37 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-10-15 19:37 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-10-15 19:37 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-10-15 19:37 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-10-15 19:37 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-10-15 19:37 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-10-15 19:37 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-10-15 19:35 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-15 19:35 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-15 19:35 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-15 19:35 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-15 19:35 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-10-15 19:35 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-10-15 19:35 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-15 19:35 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-10-15 19:35 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-10-15 19:35 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-10-15 19:35 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-10-15 19:35 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-10-15 19:35 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-15 19:35 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-10-15 19:35 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2014-10-15 19:35 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2014-10-15 19:35 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-10-15 19:35 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2014-10-15 19:35 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2014-10-15 19:35 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2014-10-15 19:35 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-10-15 19:35 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-10-15 19:35 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcsvDevice.dll
2014-10-15 19:35 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 19:35 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-10-15 19:35 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-10-15 19:35 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-10-15 19:35 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 19:35 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-10-15 19:35 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-10-15 19:35 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-10-15 19:35 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-15 19:35 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-10-15 19:35 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-10-15 19:35 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-10-15 19:35 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-10-15 19:35 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-15 19:35 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-10-15 19:35 - 2014-08-01 01:22 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-10-15 19:33 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-15 19:33 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-15 19:33 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2014-10-15 19:33 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-15 19:33 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-09 17:34 - 2014-10-09 17:34 - 00056756 _____ () C:\Users\C\Downloads\1412868853302.DownloadFile
2014-10-09 17:07 - 2014-10-09 17:11 - 00000000 ____D () C:\Program Files (x86)\FreeBASIC
2014-10-09 17:07 - 2014-10-09 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeBASIC
2014-10-09 16:59 - 2014-10-09 17:09 - 03083954 _____ () C:\Users\C\Downloads\FbEdit1076c.zip
2014-10-09 16:59 - 2014-10-09 16:59 - 00630493 _____ () C:\Users\C\Downloads\FBREF_09-25-2014D.ZIP
2014-10-09 16:55 - 2014-10-09 16:56 - 09432768 _____ () C:\Users\C\Downloads\FreeBASIC-1.00.0-win32.exe
2014-10-09 16:51 - 2014-10-09 17:02 - 00000000 ____D () C:\Program Files\FreeBASIC-1.00.0-win64
2014-10-09 16:49 - 2014-10-09 16:50 - 17963454 _____ () C:\Users\C\Downloads\FreeBASIC-1.00.0-win64.zip
2014-10-08 13:34 - 2014-10-08 13:34 - 00002141 _____ () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avant Browser.lnk
2014-10-08 13:30 - 2014-10-08 13:30 - 00000000 ____D () C:\Users\C\AppData\Roaming\Avant Downloader
2014-10-08 13:29 - 2014-10-08 13:29 - 00001933 _____ () C:\Users\Public\Desktop\Avant Browser.lnk
2014-10-08 13:29 - 2014-10-08 13:29 - 00000000 ____D () C:\Program Files (x86)\Avant Browser
2014-10-08 12:27 - 2014-10-08 12:27 - 01375089 _____ () C:\Users\C\Downloads\adwcleaner_3.311(1).exe
2014-10-06 19:35 - 2014-10-06 19:40 - 00000000 ____D () C:\Users\C\AppData\Roaming\BSW
2014-10-06 19:35 - 2014-10-06 19:35 - 03170210 _____ (BrettspielWelt GmbH) C:\Users\C\Downloads\BrettspielWelt.exe
2014-10-06 19:35 - 2014-10-06 19:35 - 00000000 ____D () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Brettspielwelt
2014-10-06 19:35 - 2014-10-06 19:35 - 00000000 ____D () C:\Program Files (x86)\BSW
2014-10-06 18:34 - 2014-10-06 18:34 - 00000000 ____D () C:\ProgramData\f45997a2166b5e02
2014-10-06 18:34 - 2014-10-06 18:34 - 00000000 ____D () C:\ProgramData\downloaditkeep
2014-10-05 20:16 - 2014-10-08 12:03 - 00000000 ____D () C:\Users\C\Tracing
2014-10-05 20:05 - 2014-10-05 20:05 - 00000000 ____D () C:\WINDOWS\de
2014-10-05 20:04 - 2014-10-05 20:04 - 00002502 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00001474 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00001390 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00001321 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-05 20:01 - 2014-10-05 20:04 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-10-05 20:01 - 2014-10-05 20:01 - 00003076 _____ () C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3677390136-3846881265-2206516262-1001
2014-10-05 20:01 - 2014-10-05 20:01 - 00000192 _____ () C:\WINDOWS\DirectX.log
2014-10-05 20:01 - 2014-10-05 20:01 - 00000000 ___RD () C:\Users\C\OneDrive
2014-10-05 20:01 - 2014-10-05 20:01 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-10-05 20:01 - 2014-10-05 20:01 - 00000000 ____D () C:\Program Files\Windows Live
2014-10-05 20:01 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_7.dll
2014-10-05 20:01 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_7.dll
2014-10-05 20:01 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_5.dll
2014-10-05 20:01 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_5.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_43.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_43.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_43.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_43.dll
2014-10-05 20:01 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_42.dll
2014-10-05 20:01 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_42.dll
2014-10-05 20:01 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_32.dll
2014-10-05 20:01 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_32.dll
2014-10-05 20:00 - 2014-10-16 11:03 - 00000000 ____D () C:\Users\C\AppData\Local\Windows Live
2014-10-05 20:00 - 2014-10-05 20:00 - 01245384 _____ (Microsoft Corporation) C:\Users\C\Downloads\wlsetup-web.exe
2014-10-04 07:48 - 2014-10-04 07:49 - 00000000 ____D () C:\Users\C\Desktop\03_10_2014
2014-10-01 16:21 - 2014-10-01 16:21 - 00319912 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-10-01 16:21 - 2014-10-01 16:21 - 00189352 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-10-01 16:21 - 2014-10-01 16:21 - 00189352 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe
2014-10-01 16:21 - 2014-10-01 16:21 - 00111016 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2014-10-01 16:21 - 2014-10-01 16:21 - 00000000 ____D () C:\Program Files\Java
2014-10-01 16:19 - 2014-10-01 16:20 - 31013800 _____ (Oracle Corporation) C:\Users\C\Downloads\jre-7u67-windows-x64(1).exe
2014-09-28 12:41 - 2014-09-28 12:41 - 00000000 ____D () C:\ProgramData\createonepart
2014-09-27 13:42 - 2014-09-27 13:42 - 00005934 _____ () C:\Users\C\AppData\Local\recently-used.xbel
2014-09-27 13:25 - 2014-09-27 13:25 - 00390878 _____ () C:\Users\C\Downloads\Bundesarchiv_Bild_183-R99542,_München,_Judenverfolgung,_Michael_Siegel.xcf
2014-09-26 21:40 - 2014-09-26 21:40 - 00001242 _____ () C:\Users\Public\Desktop\DiaShow 7 für YouTube.lnk
2014-09-26 21:40 - 2014-09-26 21:40 - 00000000 ____D () C:\Users\C\AppData\Roaming\AquaSoft
2014-09-26 21:40 - 2014-09-26 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AquaSoft
2014-09-26 21:40 - 2014-09-26 21:40 - 00000000 ____D () C:\Program Files (x86)\AquaSoft
2014-09-26 20:46 - 2014-09-26 20:52 - 24810224 _____ (AquaSoft GmbH ) C:\Users\C\Downloads\DiaShowYouTubeSetup.exe
2014-09-25 21:15 - 2014-10-20 15:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-22 16:28 - 2014-09-22 16:28 - 00001053 _____ () C:\Users\C\Desktop\AlleSchüler14_15_1HJ.xlsx - Verknüpfung.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 16:09 - 2014-06-02 20:28 - 01734165 _____ () C:\WINDOWS\WindowsUpdate.log
2014-10-20 16:06 - 2014-06-03 17:25 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-10-20 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-10-20 16:00 - 2013-08-22 16:46 - 00010082 _____ () C:\WINDOWS\setupact.log
2014-10-20 15:53 - 2014-06-02 23:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-20 15:46 - 2014-06-02 20:34 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-10-20 15:46 - 2013-08-23 01:24 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-10-20 15:46 - 2013-08-23 01:24 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-10-20 15:42 - 2014-08-19 17:58 - 00000000 ___RD () C:\Users\C\Dropbox
2014-10-20 15:42 - 2014-08-19 17:54 - 00000000 ____D () C:\Users\C\AppData\Roaming\Dropbox
2014-10-20 15:42 - 2014-06-02 20:25 - 00051956 _____ () C:\WINDOWS\PFRO.log
2014-10-20 15:42 - 2014-04-28 19:52 - 00000000 ___DO () C:\Users\C\SkyDrive
2014-10-20 15:42 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-10-20 15:41 - 2014-05-04 20:17 - 00000000 ____D () C:\AdwCleaner
2014-10-20 15:41 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-10-19 23:03 - 2014-04-26 19:54 - 00000000 ____D () C:\Users\C\Documents\BabasChess
2014-10-18 16:53 - 2014-06-02 20:37 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3677390136-3846881265-2206516262-1001
2014-10-16 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-10-16 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-10-16 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-10-16 19:58 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-10-16 19:58 - 2013-08-22 16:44 - 00482704 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-10-16 12:26 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-10-16 12:26 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-10-16 12:05 - 2014-06-03 17:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 12:04 - 2014-06-04 13:57 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-10-16 11:59 - 2014-06-04 13:57 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-10-14 18:36 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-10-09 17:02 - 2014-06-02 20:30 - 00000000 ____D () C:\Users\C\AppData\Local\VirtualStore
2014-10-05 20:16 - 2014-06-02 20:28 - 00000000 ____D () C:\Users\C
2014-10-05 20:04 - 2014-06-08 18:22 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-10-05 20:01 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-10-03 14:33 - 2014-09-01 15:43 - 00045938 _____ () C:\Users\C\Desktop\AlleSchüler14_15_1HJ.xlsx
2014-10-03 12:49 - 2014-06-02 20:28 - 00000000 ___RD () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-30 00:45 - 2013-08-22 17:38 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-30 00:45 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-27 15:25 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-09-27 14:00 - 2014-06-20 12:38 - 00000000 ____D () C:\Users\C\.gimp-2.8
2014-09-27 13:42 - 2014-09-04 15:58 - 00000000 ____D () C:\Users\C\AppData\Local\gtk-2.0
2014-09-25 20:38 - 2013-08-23 01:26 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\setup
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\InputMethod
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-09-25 20:38 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-09-22 18:13 - 2014-04-28 19:19 - 00000000 ____D () C:\Users\C\Documents\Visual Studio 2010
2014-09-22 08:42 - 2014-06-04 13:45 - 00278152 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-09-21 18:02 - 2014-08-19 17:58 - 00001017 _____ () C:\Users\C\Desktop\Dropbox.lnk
2014-09-21 18:02 - 2014-08-19 17:57 - 00000000 ____D () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\C\AppData\Local\Temp\BackupSetup.exe
C:\Users\C\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp2scgzo.dll
C:\Users\C\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\C\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\C\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\C\AppData\Local\Temp\optprosetup.exe
C:\Users\C\AppData\Local\Temp\ose00000.exe
C:\Users\C\AppData\Local\Temp\Quarantine.exe
C:\Users\C\AppData\Local\Temp\sqlite3.dll
C:\Users\C\AppData\Local\Temp\vcredist_x64.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-16 12:15

==================== End Of Log ============================
#

#
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-10-2014
Ran by C at 2014-10-20 16:12:45
Running from C:\Users\C\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3DFiBs Backgammon 4.0.79 (HKLM-x32\...\3DFiBs_is1) (Version: - )
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Any Audio Converter 4.0.1 (HKLM-x32\...\Any Audio Converter_is1) (Version: - Any-Audio-Converter.com)
AquaSoft "DiaShow 7 für YouTube" (HKLM-x32\...\{9DFDD0C5-5AC1-484B-ACF8-0F3E1041750B}_is1) (Version: 7.7.11.35343 - AquaSoft GmbH)
Avant Browser (remove only) (HKLM-x32\...\AvantBrowser) (Version: 12.5.0.0 - Avant Force)
BabasChess (HKLM-x32\...\{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}) (Version: 3.9.12275 - RRaf)
BrettspielWelt (HKLM-x32\...\BrettspielWelt) (Version: 1.0 - BrettspielWelt GmbH)
CloudReading (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.0.27.1025 - Foxit Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
downloaditkeep (HKLM-x32\...\{1C52B8B6-FFA2-12F6-0A5A-E8301F96A568}) (Version: - DDownloaditkeepp) <==== ATTENTION
Dr. Hardware 2014 14.0d (HKLM-x32\...\Dr. Hardware 2014_is1) (Version: - Peter A. Gebhard)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Druckerdeinstallation für EPSON SX525WD Series (HKLM\...\EPSON SX525WD Series) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
Epson Universal Laser P6 (HKLM\...\Epson Universal Laser P6) (Version: - )
Eye 110 (HKLM-x32\...\{C679F9B9-C65D-4C65-BD6C-BF90B859E281}) (Version: 1.0.414 - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.1.1025 - Foxit Corporation)
Free Disc Burner version 3.0.21.530 (HKLM-x32\...\Free Disc Burner_is1) (Version: 3.0.21.530 - DVDVideoSoft Ltd.)
FreeBASIC 1.00.0 (HKLM-x32\...\FreeBASIC) (Version: 1.00.0 - hxxp://www.freebasic.net/wiki)
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.0.0 - International GeoGebra Institute)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
GridGammon 3.8.0 (Build 896) (HKLM-x32\...\GridGammon) (Version: 3.8.0 (Build 896) - Jensen-Barclay, LLC)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.600 - Oracle)
Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.8 - Thibaut Lauziere)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{A106D33E-6B43-42C0-9BFC-D03303261FA7}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft Visual Basic 2010 Express - DEU (HKLM-x32\...\Microsoft Visual Basic 2010 Express - DEU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM-x32\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319 (HKLM\...\{94D70749-4281-39AC-AD90-B56A0E0A402E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM-x32\...\{616C6F39-4CE1-3434-A665-2F6A04C09A7F}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.30319 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 16.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 16.0.1 (x86 de)) (Version: 16.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 16.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.24482 - TeamViewer)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{CFCB8616-A5D1-4281-80E8-389F685BFAE2}) (Version: 4.0.8080.0 - Microsoft Corporation)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\C\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

01-10-2014 14:20:52 Removed Java 7 Update 67 (64-bit)
05-10-2014 18:00:27 Windows Live Essentials
16-10-2014 09:59:19 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {12A12094-A7FA-4487-AAD8-62BEF9DB46C6} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3677390136-3846881265-2206516262-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {15A45516-E4A9-47D6-8904-F94FF4A2C487} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-16] (Microsoft Corporation)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2A5D34F6-335F-4449-84D3-8D372579EFC6} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {499F0C29-AEBA-45D8-9CC1-9676DBCEA751} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {55619985-CEF7-4CA3-B0B1-DD839086C75D} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {95874035-A3F5-4DAA-9557-E71D2FD7C5E4} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {B2C592B4-C3AC-4C2D-BF4A-7995928D4541} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {BEF75E7E-FADD-48D4-A9AD-D4EFDE4AAFC8} - System32\Tasks\Microsoft\Windows\SysResetLogSuccess => Rundll32.exe ResetEng.dll,RjvLogSuccessEntryPoint
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D57A866E-E663-41C0-A28A-CDBA3E990B32} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {D62472D0-D5D6-4CE4-ABDC-4917AF0ABC50} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-09] (Adobe Systems Incorporated)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-09-29 11:56 - 2014-09-29 11:56 - 02199288 _____ () C:\Program Files (x86)\Avant Browser\adownloader.exe
2014-06-11 17:42 - 2014-06-11 17:42 - 03022960 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-06-11 17:42 - 2014-06-11 17:42 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-06-11 17:42 - 2014-06-11 17:42 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-10-20 15:42 - 2014-10-20 15:42 - 00043008 _____ () c:\users\c\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp2scgzo.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\C\AppData\Roaming\Dropbox\bin\libcef.dll
2014-10-20 15:53 - 2012-10-11 03:04 - 02294240 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-09-29 11:56 - 2014-09-29 11:56 - 00677376 _____ () C:\Program Files (x86)\Avant Browser\_sqlite3.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\C\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"

========================= Accounts: ==========================

Administrator (S-1-5-21-3677390136-3846881265-2206516262-500 - Administrator - Disabled)
C (S-1-5-21-3677390136-3846881265-2206516262-1001 - Administrator - Enabled) => C:\Users\C
Gast (S-1-5-21-3677390136-3846881265-2206516262-501 - Limited - Disabled)
th (S-1-5-21-3677390136-3846881265-2206516262-1003 - Limited - Enabled) => C:\Users\th

==================== Faulty Device Manager Devices =============

Name: Audiocontroller für Multimedia
Description: Audiocontroller für Multimedia
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (10/16/2014 00:16:06 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (10/16/2014 11:59:20 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (10/15/2014 07:42:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ybrowser.exe, Version: 12.5.0.0, Zeitstempel: 0x542a7c33
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc000041d
Fehleroffset: 0x77351a91
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xybrowser.exe0
Pfad der fehlerhaften Anwendung: ybrowser.exe1
Pfad des fehlerhaften Moduls: ybrowser.exe2
Berichtskennung: ybrowser.exe3
Vollständiger Name des fehlerhaften Pakets: ybrowser.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ybrowser.exe5

Error: (10/15/2014 07:42:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ybrowser.exe, Version: 12.5.0.0, Zeitstempel: 0x542a7c33
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xybrowser.exe0
Pfad der fehlerhaften Anwendung: ybrowser.exe1
Pfad des fehlerhaften Moduls: ybrowser.exe2
Berichtskennung: ybrowser.exe3
Vollständiger Name des fehlerhaften Pakets: ybrowser.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ybrowser.exe5

Error: (10/06/2014 06:34:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.3.5379, Zeitstempel: 0x54224e6b
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.3.5379, Zeitstempel: 0x54221b67
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1350
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (10/05/2014 08:01:05 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: CS)
Description: Die Anwendung oder der Dienst "OneDrive Sync Engine" konnte nicht heruntergefahren werden.

Error: (10/05/2014 08:00:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: skydrive.exe, Version: 6.3.9600.17230, Zeitstempel: 0x53be098d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0x00000000
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x10c
Startzeit der fehlerhaften Anwendung: 0xskydrive.exe0
Pfad der fehlerhaften Anwendung: skydrive.exe1
Pfad des fehlerhaften Moduls: skydrive.exe2
Berichtskennung: skydrive.exe3
Vollständiger Name des fehlerhaften Pakets: skydrive.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: skydrive.exe5

Error: (10/05/2014 08:00:28 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (10/04/2014 07:47:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17122, Zeitstempel: 0x537192fe
Name des fehlerhaften Moduls: Windows.UI.Xaml.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0d45c
Ausnahmecode: 0xc000027b
Fehleroffset: 0x000000000084a6f2
ID des fehlerhaften Prozesses: 0x13a0
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5

Error: (10/01/2014 04:20:53 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

System errors:
=============
Error: (10/20/2014 03:42:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UpdaterSvcScanTack" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/18/2014 09:09:17 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (10/18/2014 09:09:16 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (10/17/2014 05:13:41 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (10/17/2014 05:13:41 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (10/17/2014 04:38:25 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (10/16/2014 07:58:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UpdaterSvcScanTack" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/16/2014 04:12:51 PM) (Source: Ntfs) (EventID: 131) (User: NT-AUTORITÄT)
Description: Die Dateisystemstruktur auf Volume "C:" kann nicht korrigiert werden.
Führen Sie das Hilfsprogramm CHKDSK auf Volume "C:" aus.

Error: (10/16/2014 04:12:51 PM) (Source: Ntfs) (EventID: 131) (User: NT-AUTORITÄT)
Description: Die Dateisystemstruktur auf Volume "C:" kann nicht korrigiert werden.
Führen Sie das Hilfsprogramm CHKDSK auf Volume "C:" aus.

Error: (10/16/2014 00:27:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UpdaterSvcScanTack" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Microsoft Office Sessions:
=========================
Error: (10/16/2014 00:16:06 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (10/16/2014 11:59:20 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

Error: (10/15/2014 07:42:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ybrowser.exe12.5.0.0542a7c33unknown0.0.0.000000000c000041d77351a91123401cfe89c5be03b67C:\Program Files (x86)\Avant Browser\ybrowser.exeunknown9a145f97-5492-11e4-8261-f46d04ce286a

Error: (10/15/2014 07:42:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ybrowser.exe12.5.0.0542a7c33unknown0.0.0.000000000c000000500000000123401cfe89c5be03b67C:\Program Files (x86)\Avant Browser\ybrowser.exeunknown96b28a43-5492-11e4-8261-f46d04ce286a

Error: (10/06/2014 06:34:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe32.0.3.537954224e6bmozalloc.dll32.0.3.537954221b67800000030000141b135001cfe18152407d12C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlla00d5b0e-4d76-11e4-8260-f46d04ce286a

Error: (10/05/2014 08:01:05 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: CS)
Description: 9C:\Windows\System32\SkyDrive.exeOneDrive Sync Engine029172680

Error: (10/05/2014 08:00:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: skydrive.exe6.3.9600.1723053be098dunknown0.0.0.00000000000000000000000000000000010c01cfe0c3c8c4268cC:\Windows\System32\skydrive.exeunknown80bf8f4d-4cb9-11e4-8260-f46d04ce286a

Error: (10/05/2014 08:00:28 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

Error: (10/04/2014 07:47:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.17122537192feWindows.UI.Xaml.dll6.3.9600.1723853d0d45cc000027b000000000084a6f213a001cfdf96ab5328a0C:\WINDOWS\FileManager\PhotosA pp.exeC:\Windows\System32\Windows.UI.Xaml.dllf1047ef7-4b89-11e4-8260-f46d04ce286aFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager

Error: (10/01/2014 04:20:53 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

CodeIntegrity Errors:
===================================
Date: 2014-10-16 12:15:54.644
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-10-09 17:23:40.783
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-09-27 14:25:17.210
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-09-26 08:29:53.467
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-09-18 19:47:14.510
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-30 11:47:44.935
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-08-15 08:53:56.393
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-07-29 17:59:32.736
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-07-16 12:05:16.932
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2014-07-11 09:03:29.034
Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info ===========================

Processor: AMD Phenom(tm) II X4 955 Processor
Percentage of memory in use: 39%
Total physical RAM: 3839.16 MB
Available physical RAM: 2318.25 MB
Total Pagefile: 4479.16 MB
Available Pagefile: 2959.77 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.57 GB) (Free:121.66 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Volume) (Fixed) (Total:833.85 GB) (Free:747 GB) NTFS
Drive e: (Volume) (Fixed) (Total:97.66 GB) (Free:97.55 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 4E9B4E9A)
Partition 1: (Not Active) - (Size=833.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: AAC5E695)
Partition 1: (Active) - (Size=223.6 GB) - (Type=07 NTFS)

==================== End Of Log ============================
#

cosinus · 20.10.2014, 15:53

Hallo und

Zitat:

bisher war ich zufrieden mit Firefox - jetzt werde ich zugemüllt mit Werbung

Daran ist nicht dein Firefox schuld, sondern dein Verhalten, du hast bestimmt irgendeine Software installiert und vorher nicht aufgepasst, aus welcher Quelle oder beim Setup an sich nicht richtig gelesen.

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen aus den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

PowerBauer · 20.10.2014, 16:55

1. adware

#AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.000 - Bericht erstellt am 20/10/2014 um 15:41:32
# DB v2014-10-19.11
# Aktualisiert 12/10/2014 von Xplode
# Betriebssystem : Windows 8.1 Pro  (64 bits)
# Benutzername : C - CS
# Gestartet von : C:\Users\C\Downloads\adwcleaner_4.000.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v

[y4y2ad7x.default] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[y4y2ad7x.default] - Zeile gelöscht : user_pref("extensions.LbRJ9dgwr44.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumo[...]

*************************

AdwCleaner[R0].txt - [11718 octets] - [04/05/2014 20:17:29]
AdwCleaner[R1].txt - [1375 octets] - [03/06/2014 19:22:45]
AdwCleaner[R2].txt - [9205 octets] - [08/10/2014 12:19:09]
AdwCleaner[R3].txt - [1500 octets] - [08/10/2014 12:27:15]
AdwCleaner[R4].txt - [1726 octets] - [20/10/2014 15:39:46]
AdwCleaner[S0].txt - [9569 octets] - [04/05/2014 20:18:53]
AdwCleaner[S1].txt - [1457 octets] - [03/06/2014 19:31:52]
AdwCleaner[S2].txt - [9023 octets] - [08/10/2014 12:24:51]
AdwCleaner[S3].txt - [1639 octets] - [20/10/2014 15:41:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1699 octets] ##########

--- --- ---
#

2. junkware removal tool

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.14.2014:1)
OS: Windows 8.1 Pro x64
Ran by C on 20.10.2014 at 17:52:03,33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}

~~~ Files

Successfully deleted: [File] "C:\Users\C\favorites\links\startfenster.lnk"

~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\downloaditkeep

~~~ FireFox

Successfully deleted: [Folder] C:\Users\C\AppData\Roaming\mozilla\firefox\profiles\y4y2ad7x.default\extensions\toolbar@web.de
Successfully deleted the following from C:\Users\C\AppData\Roaming\mozilla\firefox\profiles\y4y2ad7x.default\prefs.js

user_pref("extensions.LbRJ9dgwr44.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\
user_pref("valueApps.storage.mam_gk_userId", "36383563396165372D333939622D343062372D613266302D656530333463383631313732");
Emptied folder: C:\Users\C\AppData\Roaming\mozilla\firefox\profiles\y4y2ad7x.default\minidumps [24 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.10.2014 at 17:53:23,27
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3. erneut farbar
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-10-2014
Ran by C (administrator) on CS on 20-10-2014 17:55:29
Running from C:\Users\C\Downloads
Loaded Profile: C (Available profiles: C & th)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC207\Monitor.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAE.EXE
(Dropbox, Inc.) C:\Users\C\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\avant.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\avantvw.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\ybrowser.exe
(Avant Force) C:\Program Files (x86)\Avant Browser\ybrowser.exe
() C:\Program Files (x86)\Avant Browser\adownloader.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PAC207_Monitor] => C:\WINDOWS\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM-x32\...\Run: [EaseUS EPM tray] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\EpmNews.exe
HKLM-x32\...\Run: [fst_de_24] => [X]
HKLM-x32\...\Run: [t4pc_en_4] => [X]
HKU\S-1-5-21-3677390136-3846881265-2206516262-1001\...\Run: [EPSON SX525WD Series] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGAE.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3677390136-3846881265-2206516262-1001\...\MountPoints2: {487c7531-cd63-11e3-824c-806e6f6e6963} - "H:\setup.exe" 
Startup: C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\C\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search.yahoo.com/?fr=avantsearch6
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: downloaditkeep -> {D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA} -> C:\ProgramData\downloaditkeep\dkKTCByw.x64.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default
FF SearchEngineOrder.1: SuchMaschine
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: downilooaditkeueip - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\eoaoy.p@bla-hdmrl.org [2014-10-06]
FF Extension: DownloadHelper - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Adblock Plus - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-06]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
S2 UpdaterSvcScanTack; "C:\Program Files (x86)\ScanTack\updater.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DRHARD64; C:\WINDOWS\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHARD64; C:\WINDOWS\SysWOW64\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHMSR64; C:\WINDOWS\system32\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R2 DRHMSR64; C:\WINDOWS\SysWOW64\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R3 MTsensor; C:\Windows\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
R3 PAC207; C:\Windows\system32\DRIVERS\PFC027.SYS [684544 2007-10-25] (PixArt Imaging Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 VBoxNetFlt; \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 17:53 - 2014-10-20 17:53 - 00002449 _____ () C:\Users\C\Desktop\JRT.txt
2014-10-20 17:52 - 2014-10-20 17:52 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-10-20 17:51 - 2014-10-20 17:51 - 01705698 _____ (Thisisu) C:\Users\C\Downloads\JRT.exe
2014-10-20 16:12 - 2014-10-20 17:55 - 00009910 _____ () C:\Users\C\Downloads\FRST.txt
2014-10-20 16:12 - 2014-10-20 17:55 - 00000000 ____D () C:\FRST
2014-10-20 16:12 - 2014-10-20 16:13 - 00034585 _____ () C:\Users\C\Downloads\Addition.txt
2014-10-20 16:11 - 2014-10-20 16:11 - 02111488 _____ (Farbar) C:\Users\C\Downloads\FRST64.exe
2014-10-20 16:02 - 2014-10-20 16:02 - 01209840 _____ () C:\Users\C\Downloads\java_runtime_environment_jre.exe
2014-10-20 16:00 - 2014-10-20 16:00 - 00071536 _____ (Premium Installer ) C:\Users\C\Downloads\setup(1).exe
2014-10-20 15:53 - 2014-10-20 15:53 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-20 15:53 - 2014-10-20 15:53 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-10-20 15:39 - 2014-10-20 15:39 - 01976320 _____ () C:\Users\C\Downloads\adwcleaner_4.000.exe
2014-10-20 15:23 - 2014-10-20 15:23 - 00000000 ____D () C:\Users\C\AppData\Roaming\EPSON
2014-10-16 11:39 - 2014-10-16 11:39 - 01138688 _____ () C:\Users\C\Downloads\▶_I_Surrender_-_Hillsong_Live_(Cornerstone_2012_DVD_Album)_Lyrics_Subtitles_(Best_Worship_Song)_-_YouTube.flv
2014-10-15 19:37 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-15 19:37 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-15 19:37 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-15 19:37 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-15 19:37 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-15 19:37 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-15 19:37 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-15 19:37 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-15 19:37 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-15 19:37 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-15 19:37 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-10-15 19:37 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-10-15 19:37 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-15 19:37 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-15 19:37 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-10-15 19:37 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-10-15 19:37 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-15 19:37 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-10-15 19:37 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-15 19:37 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-15 19:37 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-15 19:37 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-15 19:37 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-15 19:37 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-15 19:37 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-15 19:37 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-15 19:37 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-15 19:37 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-15 19:37 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-10-15 19:37 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-15 19:37 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-10-15 19:37 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-10-15 19:37 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-10-15 19:37 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-10-15 19:37 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-10-15 19:37 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-10-15 19:37 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-10-15 19:37 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-10-15 19:37 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-10-15 19:37 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-10-15 19:37 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-10-15 19:37 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-10-15 19:37 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-10-15 19:37 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-10-15 19:37 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-10-15 19:37 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-10-15 19:37 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-10-15 19:37 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-10-15 19:35 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-15 19:35 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-15 19:35 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-15 19:35 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-15 19:35 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-10-15 19:35 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-10-15 19:35 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-15 19:35 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-10-15 19:35 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-10-15 19:35 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-10-15 19:35 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-10-15 19:35 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-10-15 19:35 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-15 19:35 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-10-15 19:35 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2014-10-15 19:35 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2014-10-15 19:35 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-10-15 19:35 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2014-10-15 19:35 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2014-10-15 19:35 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2014-10-15 19:35 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-10-15 19:35 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-10-15 19:35 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcsvDevice.dll
2014-10-15 19:35 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 19:35 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-10-15 19:35 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-10-15 19:35 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-10-15 19:35 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 19:35 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-10-15 19:35 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-10-15 19:35 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-10-15 19:35 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-15 19:35 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-10-15 19:35 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-10-15 19:35 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-10-15 19:35 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-10-15 19:35 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-15 19:35 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-10-15 19:35 - 2014-08-01 01:22 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-10-15 19:33 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-15 19:33 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-15 19:33 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2014-10-15 19:33 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-15 19:33 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-09 17:34 - 2014-10-09 17:34 - 00056756 _____ () C:\Users\C\Downloads\1412868853302.DownloadFile
2014-10-09 17:07 - 2014-10-09 17:11 - 00000000 ____D () C:\Program Files (x86)\FreeBASIC
2014-10-09 17:07 - 2014-10-09 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeBASIC
2014-10-09 16:59 - 2014-10-09 17:09 - 03083954 _____ () C:\Users\C\Downloads\FbEdit1076c.zip
2014-10-09 16:59 - 2014-10-09 16:59 - 00630493 _____ () C:\Users\C\Downloads\FBREF_09-25-2014D.ZIP
2014-10-09 16:55 - 2014-10-09 16:56 - 09432768 _____ () C:\Users\C\Downloads\FreeBASIC-1.00.0-win32.exe
2014-10-09 16:51 - 2014-10-09 17:02 - 00000000 ____D () C:\Program Files\FreeBASIC-1.00.0-win64
2014-10-09 16:49 - 2014-10-09 16:50 - 17963454 _____ () C:\Users\C\Downloads\FreeBASIC-1.00.0-win64.zip
2014-10-08 13:34 - 2014-10-08 13:34 - 00002141 _____ () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avant Browser.lnk
2014-10-08 13:30 - 2014-10-08 13:30 - 00000000 ____D () C:\Users\C\AppData\Roaming\Avant Downloader
2014-10-08 13:29 - 2014-10-08 13:29 - 00001933 _____ () C:\Users\Public\Desktop\Avant Browser.lnk
2014-10-08 13:29 - 2014-10-08 13:29 - 00000000 ____D () C:\Program Files (x86)\Avant Browser
2014-10-08 12:27 - 2014-10-08 12:27 - 01375089 _____ () C:\Users\C\Downloads\adwcleaner_3.311(1).exe
2014-10-06 19:35 - 2014-10-06 19:40 - 00000000 ____D () C:\Users\C\AppData\Roaming\BSW
2014-10-06 19:35 - 2014-10-06 19:35 - 03170210 _____ (BrettspielWelt GmbH) C:\Users\C\Downloads\BrettspielWelt.exe
2014-10-06 19:35 - 2014-10-06 19:35 - 00000000 ____D () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Brettspielwelt
2014-10-06 19:35 - 2014-10-06 19:35 - 00000000 ____D () C:\Program Files (x86)\BSW
2014-10-06 18:34 - 2014-10-06 18:34 - 00000000 ____D () C:\ProgramData\f45997a2166b5e02
2014-10-05 20:16 - 2014-10-08 12:03 - 00000000 ____D () C:\Users\C\Tracing
2014-10-05 20:05 - 2014-10-05 20:05 - 00000000 ____D () C:\WINDOWS\de
2014-10-05 20:04 - 2014-10-05 20:04 - 00002502 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00001474 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00001390 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00001321 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-05 20:04 - 2014-10-05 20:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-05 20:01 - 2014-10-05 20:04 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-10-05 20:01 - 2014-10-05 20:01 - 00003076 _____ () C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3677390136-3846881265-2206516262-1001
2014-10-05 20:01 - 2014-10-05 20:01 - 00000192 _____ () C:\WINDOWS\DirectX.log
2014-10-05 20:01 - 2014-10-05 20:01 - 00000000 ___RD () C:\Users\C\OneDrive
2014-10-05 20:01 - 2014-10-05 20:01 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-10-05 20:01 - 2014-10-05 20:01 - 00000000 ____D () C:\Program Files\Windows Live
2014-10-05 20:01 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAudio2_7.dll
2014-10-05 20:01 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAudio2_7.dll
2014-10-05 20:01 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XAPOFX1_5.dll
2014-10-05 20:01 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XAPOFX1_5.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_43.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_43.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx11_43.dll
2014-10-05 20:01 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx11_43.dll
2014-10-05 20:01 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_42.dll
2014-10-05 20:01 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_42.dll
2014-10-05 20:01 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx9_32.dll
2014-10-05 20:01 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx9_32.dll
2014-10-05 20:00 - 2014-10-16 11:03 - 00000000 ____D () C:\Users\C\AppData\Local\Windows Live
2014-10-05 20:00 - 2014-10-05 20:00 - 01245384 _____ (Microsoft Corporation) C:\Users\C\Downloads\wlsetup-web.exe
2014-10-04 07:48 - 2014-10-04 07:49 - 00000000 ____D () C:\Users\C\Desktop\03_10_2014
2014-10-01 16:21 - 2014-10-01 16:21 - 00319912 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-10-01 16:21 - 2014-10-01 16:21 - 00189352 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-10-01 16:21 - 2014-10-01 16:21 - 00189352 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe
2014-10-01 16:21 - 2014-10-01 16:21 - 00111016 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2014-10-01 16:21 - 2014-10-01 16:21 - 00000000 ____D () C:\Program Files\Java
2014-10-01 16:19 - 2014-10-01 16:20 - 31013800 _____ (Oracle Corporation) C:\Users\C\Downloads\jre-7u67-windows-x64(1).exe
2014-09-28 12:41 - 2014-09-28 12:41 - 00000000 ____D () C:\ProgramData\createonepart
2014-09-27 13:42 - 2014-09-27 13:42 - 00005934 _____ () C:\Users\C\AppData\Local\recently-used.xbel
2014-09-27 13:25 - 2014-09-27 13:25 - 00390878 _____ () C:\Users\C\Downloads\Bundesarchiv_Bild_183-R99542,_München,_Judenverfolgung,_Michael_Siegel.xcf
2014-09-26 21:40 - 2014-09-26 21:40 - 00001242 _____ () C:\Users\Public\Desktop\DiaShow 7 für YouTube.lnk
2014-09-26 21:40 - 2014-09-26 21:40 - 00000000 ____D () C:\Users\C\AppData\Roaming\AquaSoft
2014-09-26 21:40 - 2014-09-26 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AquaSoft
2014-09-26 21:40 - 2014-09-26 21:40 - 00000000 ____D () C:\Program Files (x86)\AquaSoft
2014-09-26 20:46 - 2014-09-26 20:52 - 24810224 _____ (AquaSoft GmbH ) C:\Users\C\Downloads\DiaShowYouTubeSetup.exe
2014-09-25 21:15 - 2014-10-20 15:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-22 16:28 - 2014-09-22 16:28 - 00001053 _____ () C:\Users\C\Desktop\AlleSchüler14_15_1HJ.xlsx - Verknüpfung.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-20 17:40 - 2014-06-02 20:28 - 01781687 _____ () C:\WINDOWS\WindowsUpdate.log
2014-10-20 17:25 - 2014-06-02 20:37 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3677390136-3846881265-2206516262-1001
2014-10-20 17:20 - 2014-08-19 17:58 - 00000000 ___RD () C:\Users\C\Dropbox
2014-10-20 17:20 - 2014-08-19 17:54 - 00000000 ____D () C:\Users\C\AppData\Roaming\Dropbox
2014-10-20 17:20 - 2014-04-28 19:52 - 00000000 ___DO () C:\Users\C\SkyDrive
2014-10-20 17:20 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-10-20 16:06 - 2014-06-03 17:25 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-10-20 16:00 - 2013-08-22 16:46 - 00010082 _____ () C:\WINDOWS\setupact.log
2014-10-20 15:53 - 2014-06-02 23:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-20 15:46 - 2014-06-02 20:34 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-10-20 15:46 - 2013-08-23 01:24 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-10-20 15:46 - 2013-08-23 01:24 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-10-20 15:42 - 2014-06-02 20:25 - 00051956 _____ () C:\WINDOWS\PFRO.log
2014-10-20 15:42 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-10-20 15:41 - 2014-05-04 20:17 - 00000000 ____D () C:\AdwCleaner
2014-10-20 15:41 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-10-19 23:03 - 2014-04-26 19:54 - 00000000 ____D () C:\Users\C\Documents\BabasChess
2014-10-16 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-10-16 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-10-16 19:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-10-16 19:58 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-10-16 19:58 - 2013-08-22 16:44 - 00482704 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-10-16 12:26 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-10-16 12:26 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-10-16 12:05 - 2014-06-03 17:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 12:04 - 2014-06-04 13:57 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-10-16 11:59 - 2014-06-04 13:57 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-10-14 18:36 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-10-09 17:02 - 2014-06-02 20:30 - 00000000 ____D () C:\Users\C\AppData\Local\VirtualStore
2014-10-05 20:16 - 2014-06-02 20:28 - 00000000 ____D () C:\Users\C
2014-10-05 20:04 - 2014-06-08 18:22 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-10-05 20:01 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-10-03 14:33 - 2014-09-01 15:43 - 00045938 _____ () C:\Users\C\Desktop\AlleSchüler14_15_1HJ.xlsx
2014-10-03 12:49 - 2014-06-02 20:28 - 00000000 ___RD () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-30 00:45 - 2013-08-22 17:38 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-30 00:45 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-27 15:25 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-09-27 14:00 - 2014-06-20 12:38 - 00000000 ____D () C:\Users\C\.gimp-2.8
2014-09-27 13:42 - 2014-09-04 15:58 - 00000000 ____D () C:\Users\C\AppData\Local\gtk-2.0
2014-09-25 20:38 - 2013-08-23 01:26 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\setup
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\InputMethod
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2014-09-25 20:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-09-25 20:38 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-09-22 18:13 - 2014-04-28 19:19 - 00000000 ____D () C:\Users\C\Documents\Visual Studio 2010
2014-09-22 08:42 - 2014-06-04 13:45 - 00278152 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-09-21 18:02 - 2014-08-19 17:58 - 00001017 _____ () C:\Users\C\Desktop\Dropbox.lnk
2014-09-21 18:02 - 2014-08-19 17:57 - 00000000 ____D () C:\Users\C\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\C\AppData\Local\Temp\BackupSetup.exe
C:\Users\C\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyhgpq9.dll
C:\Users\C\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\C\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\C\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\C\AppData\Local\Temp\optprosetup.exe
C:\Users\C\AppData\Local\Temp\ose00000.exe
C:\Users\C\AppData\Local\Temp\Quarantine.exe
C:\Users\C\AppData\Local\Temp\sqlite3.dll
C:\Users\C\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-20 16:19

==================== End Of Log ============================

--- --- ---

4. Defender wieder aktiviert

Danke schon mal für die Hilfe!

PB

cosinus · 20.10.2014, 17:18

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

PowerBauer · 20.10.2014, 17:34

voila:FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-10-2014
Ran by C at 2014-10-20 18:35:34
Running from C:\Users\C\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3DFiBs Backgammon 4.0.79 (HKLM-x32\...\3DFiBs_is1) (Version:  - )
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Any Audio Converter 4.0.1 (HKLM-x32\...\Any Audio Converter_is1) (Version:  - Any-Audio-Converter.com)
AquaSoft "DiaShow 7 für YouTube" (HKLM-x32\...\{9DFDD0C5-5AC1-484B-ACF8-0F3E1041750B}_is1) (Version: 7.7.11.35343 - AquaSoft GmbH)
Avant Browser (remove only) (HKLM-x32\...\AvantBrowser) (Version: 12.5.0.0 - Avant Force)
BabasChess (HKLM-x32\...\{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}) (Version: 3.9.12275 - RRaf)
BrettspielWelt (HKLM-x32\...\BrettspielWelt) (Version: 1.0 - BrettspielWelt GmbH)
CloudReading (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.0.27.1025 - Foxit Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
downloaditkeep (HKLM-x32\...\{1C52B8B6-FFA2-12F6-0A5A-E8301F96A568}) (Version:  - DDownloaditkeepp) <==== ATTENTION
Dr. Hardware 2014 14.0d (HKLM-x32\...\Dr. Hardware 2014_is1) (Version:  - Peter A. Gebhard)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Druckerdeinstallation für EPSON SX525WD Series (HKLM\...\EPSON SX525WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
Epson Universal Laser P6 (HKLM\...\Epson Universal Laser P6) (Version:  - )
Eye 110 (HKLM-x32\...\{C679F9B9-C65D-4C65-BD6C-BF90B859E281}) (Version: 1.0.414 - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.1.1025 - Foxit Corporation)
Free Disc Burner version 3.0.21.530 (HKLM-x32\...\Free Disc Burner_is1) (Version: 3.0.21.530 - DVDVideoSoft Ltd.)
FreeBASIC 1.00.0 (HKLM-x32\...\FreeBASIC) (Version: 1.00.0 - hxxp://www.freebasic.net/wiki)
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.0.0 - International GeoGebra Institute)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
GridGammon 3.8.0 (Build 896) (HKLM-x32\...\GridGammon) (Version: 3.8.0 (Build 896) - Jensen-Barclay, LLC)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.600 - Oracle)
Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.8 - Thibaut Lauziere)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{A106D33E-6B43-42C0-9BFC-D03303261FA7}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft Visual Basic 2010 Express - DEU (HKLM-x32\...\Microsoft Visual Basic 2010 Express - DEU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM-x32\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319 (HKLM\...\{94D70749-4281-39AC-AD90-B56A0E0A402E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM-x32\...\{616C6F39-4CE1-3434-A665-2F6A04C09A7F}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.30319 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 16.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 16.0.1 (x86 de)) (Version: 16.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 16.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Paragon Partition Manager™ 2014 Free (HKLM-x32\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.24482 - TeamViewer)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{CFCB8616-A5D1-4281-80E8-389F685BFAE2}) (Version: 4.0.8080.0 - Microsoft Corporation)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\C\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3677390136-3846881265-2206516262-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\C\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

05-10-2014 18:00:27 Windows Live Essentials
16-10-2014 09:59:19 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {0BC5F2F3-D1BF-4F55-A392-9428651936C3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-16] (Microsoft Corporation)
Task: {12A12094-A7FA-4487-AAD8-62BEF9DB46C6} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3677390136-3846881265-2206516262-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2A5D34F6-335F-4449-84D3-8D372579EFC6} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {499F0C29-AEBA-45D8-9CC1-9676DBCEA751} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {55619985-CEF7-4CA3-B0B1-DD839086C75D} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {95874035-A3F5-4DAA-9557-E71D2FD7C5E4} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {B2C592B4-C3AC-4C2D-BF4A-7995928D4541} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {BEF75E7E-FADD-48D4-A9AD-D4EFDE4AAFC8} - System32\Tasks\Microsoft\Windows\SysResetLogSuccess => Rundll32.exe ResetEng.dll,RjvLogSuccessEntryPoint
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D57A866E-E663-41C0-A28A-CDBA3E990B32} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {D62472D0-D5D6-4CE4-ABDC-4917AF0ABC50} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-09] (Adobe Systems Incorporated)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-06-11 17:42 - 2014-06-11 17:42 - 03022960 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-06-11 17:42 - 2014-06-11 17:42 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-06-11 17:42 - 2014-06-11 17:42 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-09-29 11:56 - 2014-09-29 11:56 - 00677376 _____ () C:\Program Files (x86)\Avant Browser\_sqlite3.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\C\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKCU\...\StartupApproved\StartupFolder: => "Dropbox.lnk"

========================= Accounts: ==========================

Administrator (S-1-5-21-3677390136-3846881265-2206516262-500 - Administrator - Disabled)
C (S-1-5-21-3677390136-3846881265-2206516262-1001 - Administrator - Enabled) => C:\Users\C
Gast (S-1-5-21-3677390136-3846881265-2206516262-501 - Limited - Disabled)
th (S-1-5-21-3677390136-3846881265-2206516262-1003 - Limited - Enabled) => C:\Users\th

==================== Faulty Device Manager Devices =============

Name: Audiocontroller für Multimedia
Description: Audiocontroller für Multimedia
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (10/20/2014 06:02:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "UpdaterSvcScanTack" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-10-20 18:22:55.887
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-10-20 16:19:27.517
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-10-16 12:15:54.644
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-10-09 17:23:40.783
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-27 14:25:17.210
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-26 08:29:53.467
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-18 19:47:14.510
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-08-30 11:47:44.935
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-08-15 08:53:56.393
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-07-29 17:59:32.736
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: AMD Phenom(tm) II X4 955 Processor
Percentage of memory in use: 35%
Total physical RAM: 3839.16 MB
Available physical RAM: 2470.84 MB
Total Pagefile: 4479.16 MB
Available Pagefile: 3066.73 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.57 GB) (Free:121.79 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Volume) (Fixed) (Total:833.85 GB) (Free:747 GB) NTFS
Drive e: (Volume) (Fixed) (Total:97.66 GB) (Free:97.55 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 4E9B4E9A)
Partition 1: (Not Active) - (Size=833.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: AAC5E695)
Partition 1: (Active) - (Size=223.6 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

cosinus · 20.10.2014, 17:38

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
BHO: downloaditkeep -> {D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA} -> C:\ProgramData\downloaditkeep\dkKTCByw.x64.dll No File
FF Extension: downilooaditkeueip - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\eoaoy.p@bla-hdmrl.org [2014-10-06]
C:\ProgramData\downloaditkeep
C:\ProgramData\f45997a2166b5e02
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

PowerBauer · 20.10.2014, 17:49

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-10-2014
Ran by C at 2014-10-20 18:47:32 Run:1
Running from C:\FRST
Loaded Profile: C (Available profiles: C & th)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
BHO: downloaditkeep -> {D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA} -> C:\ProgramData\downloaditkeep\dkKTCByw.x64.dll No File
FF Extension: downilooaditkeueip - C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\eoaoy.p@bla-hdmrl.org [2014-10-06]
C:\ProgramData\downloaditkeep
C:\ProgramData\f45997a2166b5e02
EmptyTemp:
Hosts:

*****************

C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}" => Key deleted successfully.
"HKCR\CLSID\{D29ABD47-3BA4-2639-5B3D-71A4D5D36CBA}" => Key deleted successfully.
C:\Users\C\AppData\Roaming\Mozilla\Firefox\Profiles\y4y2ad7x.default\Extensions\eoaoy.p@bla-hdmrl.org => Moved successfully.
"C:\ProgramData\downloaditkeep" => File/Directory not found.
C:\ProgramData\f45997a2166b5e02 => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 1 GB temporary data.

The system needed a reboot.

==== End of Fixlog ====

cosinus · 20.10.2014, 17:50

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

PowerBauer · 20.10.2014, 18:12

dieses update von antimalware dauert ewig - ist das normal?

cosinus · 20.10.2014, 18:24

was heißt ewig

etwas dauern kann das schon, kommt auch drauf an wie stark ausgelastet deine Internetverbindung ist und so

Hab testweise bei mir MBAM aktualisiert, ging binnen 10 Sekunden...ich hab ne 32 MBit Leitung

PowerBauer · 20.10.2014, 18:31

bis jetzt hat es über 30min gedauert....

hab mal einen scan mit der alten database durchgeführt - hier der log.

Eset hab ich runtergeladen - aber das scheint keine ausführbare datei zu sein - ???

1413824365526.DownloadFile .... merkwürdig

also hier der malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 20.10.2014
Scan Time: 19:18:54
Logfile: malwarelog.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.09.19.05
Rootkit Database: v2014.10.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: C

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 347961
Time Elapsed: 5 min, 11 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.Tuto4PC.A, HKLM\SOFTWARE\WOW6432NODE\T4pc, Quarantined, [b5ccb83794e74fe7ba31dc30d1321ee2],
PUP.Optional.Feven.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Friven_s_Pro_16, Quarantined, [bcc520cff982cf6712bea576669d629e],

Registry Values: 3
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_24, Quarantined, [a7da06e973084fe7075ecd58b94a8977],
PUP.Optional.Tuto4PC.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|t4pc_en_4, Quarantined, [8cf5935ca7d4082ecd1cb55726dd04fc],
PUP.Optional.QuickStart.A, HKU\S-1-5-21-3677390136-3846881265-2206516262-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, Quarantined, [4a37a24d6d0e8caa927829ee649f41bf]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 3
PUP.Optional.OptimumInstaller.A, C:\Users\C\Downloads\Setup.exe, Quarantined, [28596788eb9042f464dbbf9f1ae7a25e],
PUP.Optional.OpenCandy, C:\Users\C\Downloads\SetupImgBurn_2.5.8.0.exe, Quarantined, [027f856aeb90df573de6aa818d78b050],
PUP.Optional.Soft32, C:\Users\C\Downloads\mozilla thunderbird setup.exe, Quarantined, [a1e06887512ad462a2b3b50322dff709],

Physical Sectors: 0
(No malicious items detected)

(end)

cosinus · 20.10.2014, 18:33

Windows neustarten, MBAM-Update nochmal probieren

PowerBauer · 20.10.2014, 18:49

hab win neu gestartet - update geht leider trotzdem nicht - eset online scanner wird auch nicht heruntergeladen (bleibt bei 5% hängen) ... - ich versuche es morgen nochmal

LG

PB

cosinus · 20.10.2014, 20:26

Vllt musst du auch mal deinen Router neu starten

PowerBauer · 21.10.2014, 17:49

also heute hat das update von antimalware geklappt - hier der Log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 21.10.2014
Scan Time: 17:27:30
Logfile: malware.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.10.21.05
Rootkit Database: v2014.10.20.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: C

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 351635
Time Elapsed: 5 min, 32 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.PremiumInstaller, C:\Users\C\Downloads\setup(1).exe, Quarantined, [4c0d6cab7903c76fadde67b412f35ba5],

Physical Sectors: 0
(No malicious items detected)

(end)

eset online-scanner hat leider nicht geklappt - aber eset antivir (Wollte ich mir sowieseo zulegen) der Log (mit vielen Bedrohungen) im Anhang - es sind ja auch viele Objekte, die Adware schon in Quarantäne geschoben hat - wie soll ich damit umgehen? Eset möchte "säubern" ich habe noch nichts veranlasst.

20.10.2014, 17:18	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Mengenweise Werbung in Moz Firefox Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. __________________ Logfiles bitte immer in CODE-Tags posten

20.10.2014, 18:24	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Mengenweise Werbung in Moz Firefox was heißt ewig etwas dauern kann das schon, kommt auch drauf an wie stark ausgelastet deine Internetverbindung ist und so Hab testweise bei mir MBAM aktualisiert, ging binnen 10 Sekunden...ich hab ne 32 MBit Leitung __________________ Logfiles bitte immer in CODE-Tags posten

20.10.2014, 18:33	#12
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Mengenweise Werbung in Moz Firefox Windows neustarten, MBAM-Update nochmal probieren __________________ Logfiles bitte immer in CODE-Tags posten

20.10.2014, 20:26	#14
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Mengenweise Werbung in Moz Firefox Vllt musst du auch mal deinen Router neu starten __________________ Logfiles bitte immer in CODE-Tags posten

Mengenweise Werbung in Moz Firefox

Plagegeister aller Art und deren Bekämpfung: Mengenweise Werbung in Moz Firefox