Windows Vista SP2 - Firefox und Chrome voll mit Werbung

Grolltar · 19.12.2014, 10:40

Hallo zusammen,
ich sitze hier vor einem Laptop, der

sehr langsam Programme startet
mit Verzögerung auf Eingaben reagiert
In den beiden Browsern Firefox und Chrome wird auf jeder Webseite Werbung an jeder erdenklichen Stelle angezeigt. Die Werbung ist gekennzeichnet mit "ads by Cloudscout".
das Klicken auf Links in den Webseiten unregelmäßig zum Öffnen von Werbefenstern.

Leider bin ich erst spät im Problem lösen auf das Forum hier gestoßen. Deswegen habe ich bereits folgende Dinge vorab in loser Reihenfolge gemacht:

ADWcleaner (diverse Funde, alle beseitigen lassen)
MbAm (dto.)
Spybot (nichts schwerwiegendes gefunden)
Avira (dto.)
MS SE (dto.)

.

Gestern abend/ heute früh habe ich dann gemäß eurer Anleitung für Hilfesuchende die erforderlichen Schritte ausgeführt:
Defogger

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:40 on 19/12/2014 (Annette)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014
Ran by Annette (administrator) on ANNETTE-PC on 18-12-2014 23:06:22
Running from C:\Users\Annette\Downloads
Loaded Profiles: Annette & UpdatusUser (Available profiles: Annette & Martin & UpdatusUser)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(DATA BECKER GmbH & Co KG) C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Windows\tsnp2uvc.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-02-11] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor)
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [745472 2009-05-07] (Sentelic Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3767030355-871562723-3547516361-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3767030355-871562723-3547516361-1000\...\MountPoints2: {925f7360-8423-11de-9d2d-001f162172cc} - G:\EasySuite.exe
HKU\S-1-5-21-3767030355-871562723-3547516361-1000\...\MountPoints2: {925f7363-8423-11de-9d2d-001f162172cc} - G:\EasySuite.exe
HKU\S-1-5-21-3767030355-871562723-3547516361-1000\...\MountPoints2: {925f7368-8423-11de-9d2d-001f162172cc} - G:\EasySuite.exe
HKU\S-1-5-21-3767030355-871562723-3547516361-1002\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3767030355-871562723-3547516361-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-3767030355-871562723-3547516361-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.gmx.de/tab2
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3767030355-871562723-3547516361-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll No File
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3767030355-871562723-3547516361-1000 -> &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\ongyvymx.default-1415995136612
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @pack.google.com/Google Updater;version=13 -> C:\Program Files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll (Google)
FF Plugin: @popularscreensavers.com/Plugin -> C:\Program Files\PopularScreensavers\NPp5Stub.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Annette\AppData\Roaming\mozilla\plugins\np-mswmp.dll (Microsoft Corporation)
FF Extension: Adblock Plus - C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\ongyvymx.default-1415995136612\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-04]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-11-23]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-11-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-09]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKU\S-1-5-21-3767030355-871562723-3547516361-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2014-10-17]

Chrome: 
=======
CHR Profile: C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-03]
CHR Extension: (Google Docs) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-03]
CHR Extension: (Google Drive) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-03]
CHR Extension: (YouTube) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-03]
CHR Extension: (Google-Suche) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-03]
CHR Extension: (Google Tabellen) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-03]
CHR Extension: (Google Wallet) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Mail) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-03]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DBService; C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
S4 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S4 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] () [File not signed]
S4 Rezip; C:\Windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [247152 2009-02-25] ()
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [9344 2009-04-17] (GARMIN Corp.) [File not signed]
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [35992 2014-12-03] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799808 2008-12-29] ()
S3 WINIO; C:\Windows\system32\WinIo.sys [9336 2007-01-04] (hxxp://www.internals.com) [File not signed]
R3 WsAudioDevice_383; C:\Windows\System32\drivers\WsAudioDevice_383.sys [16640 2013-01-08] (Wondershare) [File not signed]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-18 23:06 - 2014-12-18 23:07 - 00016149 _____ () C:\Users\Annette\Downloads\FRST.txt
2014-12-18 23:06 - 2014-12-18 23:06 - 00000000 ____D () C:\FRST
2014-12-18 23:05 - 2014-12-18 23:05 - 01113600 _____ (Farbar) C:\Users\Annette\Downloads\FRST.exe
2014-12-18 22:27 - 2014-11-07 02:33 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-18 22:27 - 2014-11-04 01:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-18 22:13 - 2014-12-18 22:13 - 00001019 _____ () C:\Users\Annette\Desktop\JRT.txt
2014-12-18 22:09 - 2014-12-18 22:09 - 00000000 ____D () C:\Windows\ERUNT
2014-12-18 22:09 - 2014-12-03 03:06 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-12-18 22:08 - 2014-12-18 22:09 - 01707646 _____ (Thisisu) C:\Users\Annette\Downloads\JRT.exe
2014-12-18 22:06 - 2014-11-24 21:44 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-12-18 22:06 - 2014-11-24 21:41 - 12369920 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-18 22:06 - 2014-11-24 21:40 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-18 22:06 - 2014-11-24 21:37 - 09740800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-18 22:06 - 2014-11-24 21:35 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-18 22:06 - 2014-11-24 21:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-18 22:06 - 2014-11-24 21:34 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-18 22:06 - 2014-11-24 21:34 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-12-18 22:06 - 2014-11-24 21:33 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-18 22:06 - 2014-11-24 21:33 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-12-18 22:06 - 2014-11-24 21:33 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-18 22:06 - 2014-11-24 21:33 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-18 22:06 - 2014-11-24 21:33 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 22:06 - 2014-11-24 21:33 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-18 22:06 - 2014-11-24 21:33 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-12-18 22:06 - 2014-11-24 21:32 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-18 22:06 - 2014-11-24 21:32 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-18 22:06 - 2014-11-24 21:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-18 22:06 - 2014-11-24 21:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-18 22:06 - 2014-11-24 21:32 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-18 22:06 - 2014-11-24 21:32 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-12-18 22:06 - 2014-11-24 21:32 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-12-18 22:03 - 2014-12-18 22:03 - 00000000 ____D () C:\81196b3a429ba13c560e
2014-12-18 21:56 - 2014-12-18 21:57 - 02166272 _____ () C:\Users\Annette\Downloads\adwcleaner_4.105.exe
2014-12-03 22:17 - 2014-12-03 22:17 - 02347384 _____ (ESET) C:\Users\Annette\Downloads\esetsmartinstaller_deu.exe
2014-12-03 22:17 - 2014-12-03 22:17 - 00000000 ____D () C:\Program Files\ESET
2014-12-03 22:06 - 2014-12-18 22:59 - 00000644 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-12-03 22:06 - 2014-12-04 18:25 - 00000616 _____ () C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2014-12-03 22:06 - 2014-12-04 18:25 - 00000446 _____ () C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job
2014-12-03 22:06 - 2014-12-03 22:06 - 00001974 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-12-03 22:06 - 2014-12-03 22:06 - 00001962 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-12-03 22:06 - 2014-12-03 22:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-12-03 22:05 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe
2014-12-03 22:00 - 2014-12-03 22:00 - 00035992 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-12-03 21:59 - 2014-12-03 21:59 - 00011924 _____ () C:\Windows\system32\.crusader
2014-12-03 21:44 - 2014-12-03 21:44 - 00001748 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-12-03 21:44 - 2014-12-03 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-12-03 21:44 - 2014-12-03 21:44 - 00000000 ____D () C:\Program Files\HitmanPro
2014-12-03 21:43 - 2014-12-03 21:59 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-12-03 21:43 - 2014-12-03 21:43 - 10284408 _____ (SurfRight B.V.) C:\Users\Annette\Downloads\HitmanPro.exe
2014-12-03 21:42 - 2014-12-03 21:43 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Annette\Downloads\spybot-2.4 (1).exe
2014-12-03 21:37 - 2014-12-03 22:01 - 00001967 _____ () C:\Users\Annette\Desktop\Google Chrome.lnk
2014-12-03 21:36 - 2014-12-03 21:36 - 00001967 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-03 21:36 - 2014-12-03 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-03 21:35 - 2014-12-03 21:35 - 00880784 _____ (Google Inc.) C:\Users\Annette\Downloads\ChromeSetup(1).exe
2014-12-03 21:34 - 2014-12-03 21:34 - 00000034 _____ () C:\Windows\setupact.log
2014-12-03 21:34 - 2014-12-03 21:34 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-03 21:12 - 2014-12-03 21:12 - 00109862 _____ () C:\Users\Annette\Documents\bookmarks_03.12.14.html
2014-12-02 21:14 - 2014-12-02 21:14 - 00001061 _____ () C:\Users\Annette\Desktop\Revo Uninstaller.lnk
2014-12-02 21:14 - 2014-12-02 21:14 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-02 21:13 - 2014-12-02 21:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Annette\Downloads\revosetup95.exe
2014-11-23 12:29 - 2014-11-23 12:30 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-23 12:02 - 2014-11-23 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2014-11-23 12:02 - 2014-11-23 12:02 - 00002503 _____ () C:\Users\Public\Desktop\Nero StartSmart.lnk
2014-11-23 11:54 - 2014-11-23 11:56 - 33177736 _____ (Nero AG) C:\Users\Annette\Downloads\Nero-9.4.12.708b_lite.exe
2014-11-23 11:43 - 2014-12-18 22:14 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-23 11:42 - 2014-12-04 21:58 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-23 11:42 - 2014-12-04 21:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-23 11:42 - 2014-12-04 21:58 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-11-23 11:42 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-23 11:42 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-23 11:42 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-23 11:39 - 2014-11-23 11:43 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Annette\Downloads\mbam-setup-2.0.3.1025 (1).exe
2014-11-22 10:04 - 2014-12-18 22:59 - 00001342 _____ () C:\Windows\Tasks\KLEM.job
2014-11-22 09:53 - 2014-12-18 22:58 - 00013522 _____ () C:\Windows\PFRO.log
2014-11-22 00:24 - 2014-12-18 22:59 - 00001342 _____ () C:\Windows\Tasks\VAUH.job
2014-11-22 00:23 - 2014-11-23 10:31 - 00000000 ___HD () C:\Users\Public\Temp
2014-11-22 00:17 - 2014-11-22 00:17 - 00000004 _____ () C:\Users\Annette\Downloads\C
2014-11-22 00:14 - 2014-11-22 00:14 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\DriverFinder
2014-11-22 00:05 - 2014-11-22 00:36 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\{37E99E86-D615-4B08-937F-F8F935C455F3}_ANZHUANG
2014-11-21 23:57 - 2014-11-21 23:57 - 01307192 _____ ( ) C:\Users\Annette\Downloads\Nero_BurningROM2015_setup-16.0c_trial (1).exe
2014-11-21 23:49 - 2014-11-21 23:49 - 01307192 _____ ( ) C:\Users\Annette\Downloads\Nero_BurningROM2015_setup-16.0c_trial.exe
2014-11-21 23:42 - 2014-11-21 23:42 - 00150480 _____ (GreeTree Applications SRL) C:\Users\Annette\Downloads\FreeRIPstub.exe
2014-11-21 19:32 - 2014-10-24 02:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-18 23:05 - 2006-11-02 11:33 - 01717700 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-18 23:02 - 2009-08-07 18:55 - 01941871 _____ () C:\Windows\WindowsUpdate.log
2014-12-18 23:01 - 2009-06-17 09:21 - 00000868 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-12-18 22:59 - 2014-11-08 17:08 - 00001344 _____ () C:\Windows\Tasks\WLTFY.job
2014-12-18 22:59 - 2010-07-06 19:22 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-18 22:59 - 2010-04-03 22:21 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-18 22:58 - 2009-06-10 13:30 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-18 22:58 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-18 22:58 - 2006-11-02 13:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-18 22:58 - 2006-11-02 13:47 - 00004016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-18 22:57 - 2006-11-02 14:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-18 22:56 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-12-18 22:49 - 2009-06-17 09:21 - 00000000 ____D () C:\ProgramData\Google Updater
2014-12-18 22:41 - 2010-07-06 19:22 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-18 22:27 - 2013-08-23 17:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-18 22:12 - 2006-11-02 11:24 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-12-18 22:05 - 2014-01-10 17:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-18 22:03 - 2014-02-08 20:23 - 00000000 ____D () C:\AdwCleaner
2014-12-18 22:00 - 2012-07-01 12:01 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-12-18 22:00 - 2012-07-01 12:01 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-04 21:56 - 2009-12-20 12:52 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Uqyded
2014-12-04 21:55 - 2009-08-07 20:27 - 00000000 ____D () C:\Users\Annette\Bilder für Verkäufe
2014-12-04 21:55 - 2009-08-07 20:27 - 00000000 ____D () C:\Users\Annette\Annette
2014-12-04 21:55 - 2009-08-07 20:18 - 00000000 ___RD () C:\Users\Annette\Eigene Bilder
2014-12-04 21:55 - 2009-08-07 20:17 - 00000000 ___RD () C:\Users\Annette\Musik
2014-12-04 21:55 - 2009-08-07 20:16 - 00000000 ____D () C:\Users\Annette\Mutti
2014-12-03 22:13 - 2014-07-16 20:03 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-12-03 22:05 - 2009-08-19 09:23 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-12-03 21:35 - 2009-06-17 09:21 - 00000000 ____D () C:\Program Files\Google
2014-12-02 22:13 - 2009-08-07 19:00 - 00082288 _____ () C:\Users\Annette\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-02 22:10 - 2012-05-04 17:22 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-02 22:10 - 2006-11-02 13:47 - 00330904 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-02 20:57 - 2009-06-10 15:36 - 00000000 ____D () C:\ProgramData\Corel
2014-12-02 20:52 - 2009-06-10 15:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Corel Home Office
2014-12-02 20:47 - 2014-02-08 21:39 - 00000000 ____D () C:\ProgramData\ProductData
2014-11-23 12:06 - 2009-08-07 21:09 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Nero
2014-11-23 12:03 - 2009-06-10 16:30 - 00000000 ____D () C:\Program Files\Common Files\Nero
2014-11-23 12:02 - 2009-06-10 16:30 - 00000000 ____D () C:\Program Files\Nero
2014-11-23 12:00 - 2009-06-10 16:30 - 00000000 ____D () C:\ProgramData\Nero
2014-11-23 11:20 - 2010-09-05 17:50 - 00000000 ____D () C:\ProgramData\Real
2014-11-23 11:20 - 2010-09-05 17:50 - 00000000 ____D () C:\Program Files\Real
2014-11-23 11:20 - 2010-09-05 17:49 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Real
2014-11-23 11:10 - 2013-10-19 19:21 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Skype
2014-11-23 11:10 - 2013-10-19 19:20 - 00000000 ____D () C:\ProgramData\Skype
2014-11-23 11:09 - 2013-10-03 12:28 - 00000000 ____D () C:\Program Files\MyHeritage
2014-11-23 11:08 - 2012-01-14 11:27 - 00000000 ____D () C:\Program Files\Adobe
2014-11-23 11:01 - 2014-10-17 21:43 - 00000983 _____ () C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-23 11:01 - 2011-05-08 15:57 - 00000862 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-22 09:56 - 2014-10-17 22:06 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-11-22 01:40 - 2009-06-09 19:25 - 00000000 ____D () C:\Windows\Panther
2014-11-22 00:30 - 2009-08-23 16:47 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-11-22 00:29 - 2009-08-23 16:47 - 00000953 _____ () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-22 00:25 - 2014-10-17 22:22 - 00000000 ____D () C:\Program Files\Reimageplus.com
2014-11-22 00:23 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-11-21 23:45 - 2014-02-09 10:30 - 00000073 _____ () C:\Windows\cdplayer.ini
2014-11-21 23:44 - 2014-02-09 10:30 - 00001534 _____ () C:\ProgramData\ss.ini

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.3000.dll
C:\Users\Public\AlexaNSISPlugin.5864.dll


Some content of TEMP:
====================
C:\Users\Annette\AppData\Local\Temp\Quarantine.exe
C:\Users\Annette\AppData\Local\Temp\sqlite3.dll
C:\Users\Annette\AppData\Local\Temp\Uninst.exe
C:\Users\Martin\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-18 23:05

==================== End Of Log ============================

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2014
Ran by Annette at 2014-12-18 23:07:46
Running from C:\Users\Annette\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Advertising Center (Version: 0.0.0.2 - Nero AG) Hidden
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
Audacity 1.3.6 (Unicode) (HKLM\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel Painter Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CyberLink MediaShow (HKLM\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.2325 - CyberLink Corp.)
CyberLink PhotoNow (HKLM\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.5615 - CyberLink Corp.)
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2625 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2606a - CyberLink Corp.)
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1412 - CyberLink Corp.)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.2521 - CyberLink Corp.)
DivX Converter (HKLM\...\{B13A7C41581B411290FBC0395694E2A9}) (Version: 7.1.0 - DivX, Inc.)
DivX Plus DirectShow Filters (HKLM\...\DivX Plus DirectShow Filters) (Version:  - DivX, Inc.)
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.90 - DivX, LLC)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.3.14949 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - SEIKO EPSON Corporation)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
Finger-sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.4.1.5 - FSP)
Foxlink Webcam (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.51000.202_WHQL - Sonix)
Free Studio version 2014 (HKLM\...\Free Studio_is1) (Version: 6.3.10.923 - DVDVideoSoft Ltd.)
Free Video to MP3 Converter version 5.0.48.923 (HKLM\...\Free Video to MP3 Converter_is1) (Version: 5.0.48.923 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.46.1009 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.46.1009 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.46.1009 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.46.1009 - DVDVideoSoft Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Earth (HKLM\...\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}) (Version: 4.3.7284.3916 - Google)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Updater (HKLM\...\Google Updater) (Version: 2.4.1487.6512 - Google Inc.)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.232 - SurfRight B.V.)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.710 - Oracle)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Age of Empires II (HKLM\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package) (Version:  - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Lite (HKLM\...\{ced65f63-a23c-4d50-98d0-5f3313f639e8}) (Version:  - Nero AG)
NVIDIA 3D Vision Treiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 307.83 - NVIDIA Corporation)
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0604 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
QuickTime (HKLM\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5730 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20111 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.01.0092 - REALTEK Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{0AF398C8-E8E1-21db-5734-6fe6f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{0CD1A340-7FAB-8174-fa61-b39af26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{0E7589F8-3F4A-aaf6-dffa-5834f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{109D12C4-4EB6-1bc7-ae32-27c6f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{17A833B2-F647-2fc7-f821-4013f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{2EE319C4-8593-c319-da18-a546f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{3801CA43-C9A5-0bd9-8d73-1eabf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{3A952499-3A8C-5ac7-8eab-31bbf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{4735E322-568B-d217-c9c4-6079f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{4C735EC7-E94E-8169-a195-155ef26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{4C756328-2F47-c567-e795-82acf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{4CC24160-A50F-52e4-76a0-bca6f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{65027E39-AEAF-e747-04a1-9536f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{6E38DC65-4180-9af3-1709-aea1f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{71B4EE53-E932-2b17-849e-dc6cf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{8A291A46-46B3-6126-045f-31a2f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{8E932745-E80C-d66a-eaea-55baf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{AACA9EA2-6F92-1212-37d8-6aeff26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{F6D87F96-D010-005f-4deb-6fecf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{F78FB21B-A447-3beb-5d2f-f0f5f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1000_Classes\CLSID\{FDECAF97-6F7B-da9f-a49d-a330f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{0AF398C8-E8E1-21db-5734-6fe6f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{0CD1A340-7FAB-8174-fa61-b39af26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{0E7589F8-3F4A-aaf6-dffa-5834f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{109D12C4-4EB6-1bc7-ae32-27c6f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{17A833B2-F647-2fc7-f821-4013f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{2EE319C4-8593-c319-da18-a546f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{3801CA43-C9A5-0bd9-8d73-1eabf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{3A952499-3A8C-5ac7-8eab-31bbf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{4735E322-568B-d217-c9c4-6079f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{4C735EC7-E94E-8169-a195-155ef26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{4C756328-2F47-c567-e795-82acf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{4CC24160-A50F-52e4-76a0-bca6f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{65027E39-AEAF-e747-04a1-9536f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{6E38DC65-4180-9af3-1709-aea1f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{71B4EE53-E932-2b17-849e-dc6cf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{8A291A46-46B3-6126-045f-31a2f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{8E932745-E80C-d66a-eaea-55baf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{AACA9EA2-6F92-1212-37d8-6aeff26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{F6D87F96-D010-005f-4deb-6fecf26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{F78FB21B-A447-3beb-5d2f-f0f5f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAI~1.DLL No File
CustomCLSID: HKU\S-1-5-21-3767030355-871562723-3547516361-1002_Classes\CLSID\{FDECAF97-6F7B-da9f-a49d-a330f26a631f}\InprocServer32 -> C:\Windows\system32\OLE32.DLL (Microsoft Corporation)

==================== Restore Points  =========================

08-11-2014 17:11:00 Installed Java 7 Update 51
08-11-2014 17:28:09 Smileys We Love Toolbar for IE wird entfernt
12-11-2014 21:11:42 Windows Update
12-11-2014 22:22:04 Windows Update
13-11-2014 06:32:36 Windows Update
14-11-2014 20:23:31 Installed Java 7 Update 71
14-11-2014 21:45:51 Gerätetreiber-Paketinstallation: NVIDIA Grafikkarte
14-11-2014 21:50:12 Gerätetreiber-Paketinstallation: NVIDIA Corporation Audio-, Video- und Gamecontroller
14-11-2014 22:19:56 Removed Nero 8 Essentials. Available with Windows Installer version 1.2 and later.
21-11-2014 19:13:54 Windows Update
21-11-2014 19:32:03 Windows Update
22-11-2014 01:04:59 Removed Shopping Helper Smartbar
22-11-2014 01:22:34 Removed Shopping Helper Smartbar
23-11-2014 11:09:55 Removed Skype™ 6.3
23-11-2014 12:00:00 Installed Nero 9 Lite 4.4.9.0
02-12-2014 20:51:38 Windows Update
02-12-2014 21:18:33 Revo Uninstaller's restore point - Shopping Helper Smartbar
02-12-2014 21:26:39 Revo Uninstaller's restore point - Ask Toolbar
03-12-2014 20:56:06 Removed CorelDRAW Essentials 4 - Windows Shell Extension.
03-12-2014 21:57:25 Prüfpunkt von HitmanPro
03-12-2014 21:58:48 Prüfpunkt von HitmanPro
04-12-2014 19:08:23 Geplanter Prüfpunkt
04-12-2014 21:41:57 Removed Amazon Music Importer
04-12-2014 21:43:17 Garmin Training Center wird entfernt
04-12-2014 21:43:46 Removed Garmin Training Center
04-12-2014 21:44:34 Removed Garmin USB Drivers
18-12-2014 21:47:03 Windows Update
18-12-2014 22:09:08 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2014-12-03 06:03 - 00450853 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	www.123fporn.info
127.0.0.1	123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {02348697-70EF-4C04-AAAE-34F4A46D9139} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1001 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
Task: {075B9AC9-F929-46BE-AECE-F98A2E2DC832} - System32\Tasks\WLTFY => C:\Users\Annette\AppData\Roaming\WLTFY.exe <==== ATTENTION
Task: {10426E20-5134-4843-81D4-71C1252B2443} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-03] (Google Inc.)
Task: {1132BFC8-F3B0-4A96-B56C-D4017DC22784} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
Task: {3250BE7F-2824-4C2A-A494-A10385343C43} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {3773D171-CFD3-41E3-8C3B-8C5252501298} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3767030355-871562723-3547516361-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {45FE95EE-8D8B-412E-93CE-2DCB86A5C01C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {4EDAF0DC-9937-4952-B5C3-30D8380AE3FB} - System32\Tasks\{0F61F012-A1A0-47A7-A576-A0095A9BABC4} => pcalua.exe -a c:\Users\Annette\Downloads\avira_free_antivirus_de(1).exe
Task: {55D8940A-117A-460C-9F73-22B5FA22DFD4} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1001 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {6446D17A-04E2-4B17-82F2-6931F239D3C5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-18] (Adobe Systems Incorporated)
Task: {6ECD2878-38D3-4456-A6A9-6CDA6757E10E} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {72002A5B-7ABF-464B-BAA8-20774441BEB9} - System32\Tasks\Microsoft\Windows\RestartManager\{54B6744A-6F10-40bc-B4EC-2C1AAC795568} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {7C8827D3-8AF4-413A-B214-F7750A5CDE72} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {84F52287-B872-47F2-A463-D9F9524D48FF} - System32\Tasks\{D1CF79E4-683D-4592-85CC-8A89D5E93D1B} => pcalua.exe -a C:\Users\Annette\Downloads\Age2upA-GER.exe -d "C:\Program Files\Mozilla Firefox"
Task: {87818E4B-CBFC-471D-9159-BF8731CDFD48} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-17] (Google)
Task: {896C36CF-AC2D-4D8A-8F44-116206E786E1} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {92A84474-47EE-459B-B36A-090D841ABCFA} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3767030355-871562723-3547516361-1001 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {96F2DDD1-EBA0-48B1-ACD1-B855C20C2BD7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-03] (Google Inc.)
Task: {B61B3DB6-834D-439B-B63C-5D23C705C3CD} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C6B2573E-A575-4C76-9539-778B4B1F55DA} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {C91B32F3-78AC-48AE-A493-B689BE3470A9} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {C93FEB90-2C50-4182-88BC-4D70CBF534D6} - System32\Tasks\VAUH => C:\Users\Annette\AppData\Roaming\VAUH.exe <==== ATTENTION
Task: {D30473DD-FC0F-4241-A955-C09FCF6A2BE9} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2013-11-15] ()
Task: {D9257F2F-5CFD-45FD-8E17-FE2F8B7A59CA} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {E6A2B99E-8E0E-4AD4-9696-05166E76039F} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3767030355-871562723-3547516361-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: {F10D97D0-0560-430E-A786-50A070267150} - System32\Tasks\KLEM => C:\Users\Annette\AppData\Roaming\KLEM.exe <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\KLEM.job => C:\Users\Annette\AppData\Roaming\KLEM.exe <==== ATTENTION
Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
Task: C:\Windows\Tasks\VAUH.job => C:\Users\Annette\AppData\Roaming\VAUH.exe <==== ATTENTION
Task: C:\Windows\Tasks\WLTFY.job => C:\Users\Annette\AppData\Roaming\WLTFY.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2009-06-10 21:13 - 2009-02-25 07:13 - 00247152 _____ () C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2014-12-03 22:05 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-03 22:05 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-03 22:05 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-03 22:05 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-03 22:05 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2009-06-10 14:00 - 2008-08-28 14:03 - 00233472 _____ () C:\Windows\tsnp2uvc.exe
2009-06-08 17:14 - 2009-02-17 11:26 - 00053248 _____ () C:\Program Files\FSP\KbdHook.dll
2009-06-08 17:14 - 2009-04-23 14:29 - 00073728 _____ () C:\Program Files\FSP\FspLib.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Annette\Downloads\Schnee 12-2010.avi:TOC.WMV

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: globalUpdate => 2
MSCONFIG\Services: globalUpdatem => 3
MSCONFIG\Services: ProtexisLicensing => 2
MSCONFIG\Services: PSI_SVC_2 => 2
MSCONFIG\Services: rcores => 2
MSCONFIG\Services: RealNetworks Downloader Resolver Service => 2
MSCONFIG\Services: resetWinService => 2
MSCONFIG\Services: Rezip => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: WindowsMangerProtect => 2
MSCONFIG\startupreg: Amazon Cloud Player => "C:\Users\Annette\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe"
MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\Annette\AppData\Local\Smartbar\Application\Smartbar.exe startup
MSCONFIG\startupreg: BullGuard => "C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe" -boot
MSCONFIG\startupreg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
MSCONFIG\startupreg: MsgCenterExe => "C:\Program Files\Real\RealPlayer\update\RealOneMessageCenter.exe"  -osboot
MSCONFIG\startupreg: NBKeyScan => "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
MSCONFIG\startupreg: Only-search => C:\Users\Annette\AppData\Local\onlysearch\onlysearch\1.3.14.11\onlysearch.exe
MSCONFIG\startupreg: PDVD8LanguageShortcut => "C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-3767030355-871562723-3547516361-500 - Administrator - Disabled)
Annette (S-1-5-21-3767030355-871562723-3547516361-1000 - Administrator - Enabled) => C:\Users\Annette
Gast (S-1-5-21-3767030355-871562723-3547516361-501 - Limited - Disabled)
Martin (S-1-5-21-3767030355-871562723-3547516361-1001 - Limited - Enabled) => C:\Users\Martin
UpdatusUser (S-1-5-21-3767030355-871562723-3547516361-1002 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/18/2014 10:59:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/18/2014 10:19:04 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (12/18/2014 10:19:02 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4


System errors:
=============
Error: (12/18/2014 10:59:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/18/2014 10:27:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.191.328.0){861C3CD6-7464-44AE-917E-EB0BFB15F697}201

Error: (12/18/2014 10:27:31 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %Annette-PC60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 

	Aktualisierungsquelle: %Annette-PC15

	Aktualisierungsphase: 4.6.0305.00

	Quellpfad: 4.6.0305.01

	Signaturtyp: %Annette-PC602

	Aktualisierungstyp: %Annette-PC604

	Benutzer: Annette-PC\Annette

	Aktuelle Modulversion: %Annette-PC605

	Vorherige Modulversion: %Annette-PC606

	Fehlercode: %Annette-PC607

	Fehlerbeschreibung: %Annette-PC608


Microsoft Office Sessions:
=========================
Error: (12/18/2014 10:59:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/18/2014 10:19:04 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (12/18/2014 10:19:02 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4


CodeIntegrity Errors:
===================================
  Date: 2014-12-18 23:07:27.922
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:27.470
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:27.033
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:26.534
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:25.910
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:25.504
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:25.083
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 23:07:24.615
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 22:23:48.982
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-18 22:23:48.545
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T6500 @ 2.10GHz
Percentage of memory in use: 49%
Total physical RAM: 3065.95 MB
Available physical RAM: 1535.03 MB
Total Pagefile: 6338.18 MB
Available Pagefile: 4765.05 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.93 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:268.79 GB) (Free:175.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:29.28 GB) (Free:14.35 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 9338ECFC)
Partition 1: (Active) - (Size=268.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=29.3 GB) - (Type=0C)

==================== End Of Log ============================

Gmer

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-19 09:19:06
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Annette\AppData\Local\Temp\fwdiqfow.sys


---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtCreateFile + 6                7794426A 4 Bytes  [28, E4, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtCreateFile + B                7794426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtMapViewOfSection + 6          779449BA 4 Bytes  [28, E7, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtMapViewOfSection + B          779449BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenFile + 6                  77944A4A 4 Bytes  [68, E4, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenFile + B                  77944A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenProcess + 6               77944ACA 4 Bytes  [A8, E5, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenProcess + B               77944ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenProcessToken + B          77944ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenProcessTokenEx + 6        77944AEA 4 Bytes  [A8, E6, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenProcessTokenEx + B        77944AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenThread + 6                77944B3A 4 Bytes  [68, E5, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenThread + B                77944B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenThreadToken + 6           77944B4A 4 Bytes  [68, E6, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenThreadToken + B           77944B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtOpenThreadTokenEx + B         77944B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtQueryAttributesFile + 6       77944BEA 4 Bytes  [A8, E4, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtQueryAttributesFile + B       77944BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtQueryFullAttributesFile + B   77944C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtSetInformationFile + 6        7794517A 4 Bytes  [28, E5, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtSetInformationFile + B        7794517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtSetInformationThread + 6      779451CA 4 Bytes  [28, E6, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtSetInformationThread + B      779451CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtUnmapViewOfSection + 6        7794546A 4 Bytes  [68, E7, 97, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[528] ntdll.dll!NtUnmapViewOfSection + B        7794546F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtCreateFile + 6                7794426A 4 Bytes  [28, B4, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtCreateFile + B                7794426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtMapViewOfSection + 6          779449BA 4 Bytes  [28, B7, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtMapViewOfSection + B          779449BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenFile + 6                  77944A4A 4 Bytes  [68, B4, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenFile + B                  77944A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenProcess + 6               77944ACA 4 Bytes  [A8, B5, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenProcess + B               77944ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenProcessToken + B          77944ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenProcessTokenEx + 6        77944AEA 4 Bytes  [A8, B6, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenProcessTokenEx + B        77944AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenThread + 6                77944B3A 4 Bytes  [68, B5, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenThread + B                77944B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenThreadToken + 6           77944B4A 4 Bytes  [68, B6, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenThreadToken + B           77944B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtOpenThreadTokenEx + B         77944B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtQueryAttributesFile + 6       77944BEA 4 Bytes  [A8, B4, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtQueryAttributesFile + B       77944BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtQueryFullAttributesFile + B   77944C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtSetInformationFile + 6        7794517A 4 Bytes  [28, B5, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtSetInformationFile + B        7794517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtSetInformationThread + 6      779451CA 4 Bytes  [28, B6, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtSetInformationThread + B      779451CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtUnmapViewOfSection + 6        7794546A 4 Bytes  [68, B7, CA, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[544] ntdll.dll!NtUnmapViewOfSection + B        7794546F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtCreateFile + 6               7794426A 4 Bytes  [28, 54, 88, 00] {SUB [EAX+ECX*4+0x0], DL}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtCreateFile + B               7794426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtMapViewOfSection + 6         779449BA 4 Bytes  [28, 57, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtMapViewOfSection + B         779449BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenFile + 6                 77944A4A 4 Bytes  [68, 54, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenFile + B                 77944A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenProcess + 6              77944ACA 4 Bytes  [A8, 55, 88, 00] {TEST AL, 0x55; MOV [EAX], AL}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenProcess + B              77944ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenProcessToken + B         77944ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenProcessTokenEx + 6       77944AEA 4 Bytes  [A8, 56, 88, 00] {TEST AL, 0x56; MOV [EAX], AL}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenProcessTokenEx + B       77944AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenThread + 6               77944B3A 4 Bytes  [68, 55, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenThread + B               77944B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenThreadToken + 6          77944B4A 4 Bytes  [68, 56, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenThreadToken + B          77944B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtOpenThreadTokenEx + B        77944B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtQueryAttributesFile + 6      77944BEA 4 Bytes  [A8, 54, 88, 00] {TEST AL, 0x54; MOV [EAX], AL}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtQueryAttributesFile + B      77944BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtQueryFullAttributesFile + B  77944C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtSetInformationFile + 6       7794517A 4 Bytes  [28, 55, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtSetInformationFile + B       7794517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtSetInformationThread + 6     779451CA 4 Bytes  [28, 56, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtSetInformationThread + B     779451CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtUnmapViewOfSection + 6       7794546A 4 Bytes  [68, 57, 88, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[1416] ntdll.dll!NtUnmapViewOfSection + B       7794546F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtCreateFile + 6               7794426A 4 Bytes  [28, 8C, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtCreateFile + B               7794426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtMapViewOfSection + 6         779449BA 4 Bytes  [28, 8F, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtMapViewOfSection + B         779449BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenFile + 6                 77944A4A 4 Bytes  [68, 8C, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenFile + B                 77944A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenProcess + 6              77944ACA 4 Bytes  [A8, 8D, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenProcess + B              77944ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenProcessToken + B         77944ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenProcessTokenEx + 6       77944AEA 4 Bytes  [A8, 8E, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenProcessTokenEx + B       77944AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenThread + 6               77944B3A 4 Bytes  [68, 8D, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenThread + B               77944B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenThreadToken + 6          77944B4A 4 Bytes  [68, 8E, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenThreadToken + B          77944B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtOpenThreadTokenEx + B        77944B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtQueryAttributesFile + 6      77944BEA 4 Bytes  [A8, 8C, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtQueryAttributesFile + B      77944BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtQueryFullAttributesFile + B  77944C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtSetInformationFile + 6       7794517A 4 Bytes  [28, 8D, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtSetInformationFile + B       7794517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtSetInformationThread + 6     779451CA 4 Bytes  [28, 8E, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtSetInformationThread + B     779451CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtUnmapViewOfSection + 6       7794546A 4 Bytes  [68, 8F, 49, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4508] ntdll.dll!NtUnmapViewOfSection + B       7794546F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtCreateFile + 6               7794426A 4 Bytes  [28, B4, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtCreateFile + B               7794426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtMapViewOfSection + 6         779449BA 4 Bytes  [28, B7, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtMapViewOfSection + B         779449BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenFile + 6                 77944A4A 4 Bytes  [68, B4, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenFile + B                 77944A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenProcess + 6              77944ACA 4 Bytes  [A8, B5, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenProcess + B              77944ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenProcessToken + B         77944ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenProcessTokenEx + 6       77944AEA 4 Bytes  [A8, B6, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenProcessTokenEx + B       77944AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenThread + 6               77944B3A 4 Bytes  [68, B5, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenThread + B               77944B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenThreadToken + 6          77944B4A 4 Bytes  [68, B6, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenThreadToken + B          77944B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtOpenThreadTokenEx + B        77944B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtQueryAttributesFile + 6      77944BEA 4 Bytes  [A8, B4, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtQueryAttributesFile + B      77944BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtQueryFullAttributesFile + B  77944C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtSetInformationFile + 6       7794517A 4 Bytes  [28, B5, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtSetInformationFile + B       7794517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtSetInformationThread + 6     779451CA 4 Bytes  [28, B6, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtSetInformationThread + B     779451CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtUnmapViewOfSection + 6       7794546A 4 Bytes  [68, B7, 4D, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4904] ntdll.dll!NtUnmapViewOfSection + B       7794546F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtCreateFile + 6               7794426A 4 Bytes  [28, 64, 57, 00] {SUB [EDI+EDX*2+0x0], AH}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtCreateFile + B               7794426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtMapViewOfSection + 6         779449BA 4 Bytes  [28, 67, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtMapViewOfSection + B         779449BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenFile + 6                 77944A4A 4 Bytes  [68, 64, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenFile + B                 77944A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenProcess + 6              77944ACA 4 Bytes  [A8, 65, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenProcess + B              77944ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenProcessToken + B         77944ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenProcessTokenEx + 6       77944AEA 4 Bytes  [A8, 66, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenProcessTokenEx + B       77944AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenThread + 6               77944B3A 4 Bytes  [68, 65, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenThread + B               77944B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenThreadToken + 6          77944B4A 4 Bytes  [68, 66, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenThreadToken + B          77944B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtOpenThreadTokenEx + B        77944B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtQueryAttributesFile + 6      77944BEA 4 Bytes  [A8, 64, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtQueryAttributesFile + B      77944BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtQueryFullAttributesFile + B  77944C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtSetInformationFile + 6       7794517A 4 Bytes  [28, 65, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtSetInformationFile + B       7794517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtSetInformationThread + 6     779451CA 4 Bytes  [28, 66, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtSetInformationThread + B     779451CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtUnmapViewOfSection + 6       7794546A 4 Bytes  [68, 67, 57, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5084] ntdll.dll!NtUnmapViewOfSection + B       7794546F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5904] ntdll.dll!NtMapViewOfSection + 6         779449BA 4 Bytes  [18, 20, 08, 74]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[5904] ntdll.dll!NtMapViewOfSection + B         779449BF 1 Byte  [E2]

---- User IAT/EAT - GMER 2.1 ----

IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [746A7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [746E5EFD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [746ABB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [7469F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [746A75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [7469E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [746F92D5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [746ADA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [7469FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [7469FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [746971CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [7472CB4F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [746CC840] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [7469D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [74696853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [7469687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[3912] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [746A2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19227_none_9e528838ca1611c0\gdiplus.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                             fltmgr.sys

---- EOF - GMER 2.1 ----

Sonstige Logs:
ADWcleaner

Code:

ATTFilter

# AdwCleaner v4.105 - Bericht erstellt am 18/12/2014 um 22:00:04
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-16.1 [Live]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Annette - ANNETTE-PC
# Gestartet von : C:\Users\Annette\Downloads\adwcleaner_4.105.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage
Datei Gefunden : C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage-journal
Datei Gefunden : C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gefunden : C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gefunden : C:\Users\Annette\AppData\Roaming\Opera Software\Opera Stable\databases\chrome-extension_plimopelmdneikoknbgpopffpbmlhgpa_0
Datei Gefunden : C:\Users\Annette\AppData\Roaming\Opera Software\Opera Stable\Local Extension Settings\plimopelmdneikoknbgpopffpbmlhgpa

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16592


-\\ Mozilla Firefox v33.1.1 (x86 de)


-\\ Google Chrome v39.0.2171.71


-\\ Comodo Dragon v


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [34241 octets] - [08/02/2014 20:23:50]
AdwCleaner[R10].txt - [25754 octets] - [14/11/2014 20:38:04]
AdwCleaner[R11].txt - [25816 octets] - [14/11/2014 20:46:49]
AdwCleaner[R12].txt - [24374 octets] - [23/11/2014 10:58:15]
AdwCleaner[R13].txt - [4559 octets] - [03/12/2014 20:47:20]
AdwCleaner[R14].txt - [2736 octets] - [04/12/2014 21:36:20]
AdwCleaner[R15].txt - [2097 octets] - [18/12/2014 22:00:04]
AdwCleaner[R1].txt - [1475 octets] - [08/02/2014 20:33:14]
AdwCleaner[R2].txt - [1386 octets] - [08/02/2014 20:52:47]
AdwCleaner[R3].txt - [1704 octets] - [08/02/2014 21:46:00]
AdwCleaner[R4].txt - [3250 octets] - [08/02/2014 21:51:37]
AdwCleaner[R5].txt - [3467 octets] - [08/02/2014 22:28:05]
AdwCleaner[R6].txt - [5451 octets] - [09/02/2014 10:52:54]
AdwCleaner[R7].txt - [1926 octets] - [22/02/2014 13:44:17]
AdwCleaner[R8].txt - [3098 octets] - [09/03/2014 01:13:14]
AdwCleaner[R9].txt - [2209 octets] - [18/04/2014 20:46:44]
AdwCleaner[S0].txt - [31070 octets] - [08/02/2014 20:25:01]
AdwCleaner[S10].txt - [22517 octets] - [23/11/2014 11:01:08]
AdwCleaner[S11].txt - [4911 octets] - [03/12/2014 20:49:15]
AdwCleaner[S12].txt - [2798 octets] - [04/12/2014 21:38:31]
AdwCleaner[S1].txt - [1536 octets] - [08/02/2014 20:35:40]
AdwCleaner[S2].txt - [1447 octets] - [08/02/2014 20:53:42]
AdwCleaner[S3].txt - [3315 octets] - [08/02/2014 21:52:17]
AdwCleaner[S4].txt - [3582 octets] - [08/02/2014 22:28:41]
AdwCleaner[S5].txt - [5178 octets] - [09/02/2014 10:53:32]
AdwCleaner[S6].txt - [1987 octets] - [22/02/2014 13:45:42]
AdwCleaner[S7].txt - [3031 octets] - [09/03/2014 01:14:17]
AdwCleaner[S8].txt - [2272 octets] - [18/04/2014 20:47:51]
AdwCleaner[S9].txt - [25527 octets] - [14/11/2014 20:50:03]

########## EOF - C:\AdwCleaner\AdwCleaner[R15].txt - [3484 octets] ##########

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Annette on 18.12.2014 at 22:09:36,58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{81AE3262-DB46-43AC-A1C4-7CA2279D989B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{966B8354-A162-407F-AC45-EF3CC862BCC4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C6EED45D-E810-4403-B2BC-97F428CCA70C}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.12.2014 at 22:13:33,31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und zu guter Letzt MbAM

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 18.12.2014
Suchlauf-Zeit: 22:15:08
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.18.05
Rootkit Datenbank: v2014.12.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Annette

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 420405
Verstrichene Zeit: 40 Min, 47 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 2
Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{6EF1B4EB-1134-4AB9-8FBB-CEE5E3C3499A}|NameServer, 31.168.224.106,5.135.12.52, Gut: (), Schlecht: (31.168.224.106,5.135.12.52),Ersetzt,[222b77ed8fed49ede53e680e669fd32d]
Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{8B7CBA12-E6ED-4B51-BDE1-9F32F3DDD5A8}|NameServer, 31.168.224.106,5.135.12.52, Gut: (), Schlecht: (31.168.224.106,5.135.12.52),Ersetzt,[a4a9c2a2fb81ab8b49da7402c63fa957]

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 2
PUP.Optional.CloudScout.A, C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cloudscout.utop.it_0.localstorage, In Quarantäne, [ae9f23412a52f93d466367f00300758b], 
PUP.Optional.CloudScout.A, C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cloudscout.utop.it_0.localstorage-journal, In Quarantäne, [71dc055f5329f83e7f2a550227dc37c9], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Danach lief der Rechner relativ flüssig und ohne Werbung. Nach einem Neustart heute vormittag traten die gleichen Symptome erneut auf. Zum Teil konnte ich in Chrome nichts mehr machen.

Gibt es neben dem Neuaufsetzen des Rechners noch andere lohnenswerte Alternativen?
Viele Grüße
Grolltar

Windows Vista SP2 - Firefox und Chrome voll mit Werbung

Log-Analyse und Auswertung: Windows Vista SP2 - Firefox und Chrome voll mit Werbung

Windows Vista SP2 - Firefox und Chrome voll mit Werbung

Ähnliche Themen: Windows Vista SP2 - Firefox und Chrome voll mit Werbung