Immer noch in chrome, obwohl Du ihn wie oben beschrieben deinstalliert, neu installiert und zurückgesetzt hast?

Ja, ich habe Google Chrome deinstalilert und neu runtergeladen.

Gruß

Astrid

auch zurückgesetzt?

Verbindest Du Chrome mit einem Google Konto?

Ja, danach wurde ich gefragt und habe es auch gemacht.

Gruß

Astrid

Ich habe jetzt noch mal Google Chrome deinstaliert, habe alles nach Anweisung ausgeführt, aber die Werbung erscheint immer noch.


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Astrid (administrator) on ASTRIDBÖTTCHER on 27-01-2015 19:12:58
Running from C:\Users\Astrid \Downloads
Loaded Profiles: Astrid (Available profiles: Astrid 
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Update\LenovoSmartConnectService.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\QuickStartUtil\VAWinService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Lenovo) C:\Program Files\Lenovo\BootShield\BootShield.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
() C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe
() C:\QuickStartUtil\VAWinAgent.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Buyond GmbH) C:\Program Files (x86)\Buyond_GmbH\GloboFleet_CC\GloboFleet_CC.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Spotify Ltd) C:\Users\Astrid \AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\Astrid \AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\btvstack.exe [1022592 2012-04-28] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\athbttray.exe [801920 2012-04-28] (Atheros Commnucations)
HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-08-21] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2012-08-21] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-08-21] (Lenovo)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LockKey] => C:\Program Files (x86)\LockKey\LockKey.exe [329624 2012-06-22] ( )
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2012-01-26] (Lenovo, Inc.)
HKLM-x32\...\Run: [Intelligent Touchpad] => C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe [291272 2011-12-08] ()
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [VAWinAgent] => C:\QuickStartUtil\VAWinAgent.exe [45480 2012-06-04] ()
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-08-21] (Lenovo)
HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [GloboFleet CC] => C:\Program Files (x86)\Buyond_GmbH\GloboFleet_CC\GloboFleet_CC.exe [235328 2013-08-08] (Buyond GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-08-21] (Google Inc.)
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Run: [Spotify] => C:\Users\Astrid Böttcher\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-17] (Spotify Ltd)
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Run: [Spotify Web Helper] => C:\Users\Astrid Böttcher\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-17] (Spotify Ltd)
Startup: C:\Users\Astrid Böttcher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} =>  No File
ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3392072093-3665888848-192803557-1000 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE537
SearchScopes: HKU\S-1-5-21-3392072093-3665888848-192803557-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE537
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-3392072093-3665888848-192803557-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.188.1
Tcpip\..\Interfaces\{0A6F295B-354E-441C-9445-C5444681D645}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{75E76526-9C40-4A25-A1DB-649B8E2A3BFC}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{C2A62BED-086A-4DC6-AB12-3938572A2CCB}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{CF5D4A81-BF43-4D86-AD28-45A03D6C1711}: [NameServer] 81.218.119.15,199.203.35.75

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
CHR StartupUrls: Default -> "hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108", "hxxp://www.google.de/"
CHR Profile: C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-23]
CHR Extension: (Google Docs) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-23]
CHR Extension: (Google Drive) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Astrid Böttcher\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-27]
CHR Extension: (YouTube) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-23]
CHR Extension: (Google Search) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-23]
CHR Extension: (Google Sheets) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-23]
CHR Extension: (AdBlock) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-23]
CHR Extension: (Bookmark Manager) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-01-26]
CHR Extension: (Google Wallet) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-23]
CHR Extension: (Gmail) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S2 BootShieldSvc; C:\Windows\System32\BootShieldSvc.exe [123952 2012-02-06] (Lenovo)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-21] (Intel Corporation)
R2 LenovoSmartConnectService; C:\Program Files (x86)\Lenovo\Lenovo Smart Update\LenovoSmartConnectService.exe [66608 2012-02-20] (Lenovo)
R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [61992 2014-02-18] (Haufe-Lexware GmbH & Co. KG)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [239968 2013-10-17] ()
R2 VideAceWindowsService; C:\QuickStartUtil\VAWinService.exe [91464 2011-03-25] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [163456 2012-04-28] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
R0 BootShield; C:\Windows\System32\drivers\BootShield.sys [31536 2012-04-16] (Lenovo Corporation")
R1 BootShieldfltr; C:\Windows\System32\drivers\BootShieldfltr.sys [61744 2012-02-16] (Lenovo Corporation)
R3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [191224 2014-04-05] (HID Global Corporation)
R3 LAD; C:\Windows\System32\DRIVERS\LAD.sys [8192 2012-01-12] (TODO: <Company name>)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
S3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27960 2012-07-13] (Synaptics Incorporated)
S3 TTHID; C:\Windows\System32\DRIVERS\Cinergy_Hybrid-Stick_HID.sys [27944 2012-09-27] (DTV-DVB)
S3 UDXTTM6010; C:\Windows\System32\DRIVERS\UDXTTM6010.sys [841384 2012-09-27] ()
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
U3 BcmSqlStartupSvc; No ImagePath
S1 BdfNdisf; \??\c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 CLKMSVC10_3A60B698; No ImagePath
U2 CLKMSVC10_C3B3B687; No ImagePath
U2 DriverService; No ImagePath
U2 iATAgentService; No ImagePath
U2 idealife Update Service; No ImagePath
U3 IGRS; No ImagePath
U2 IviRegMgr; No ImagePath
U2 Oasis2Service; No ImagePath
U2 PCCarerService; No ImagePath
U2 ReadyComm.DirectRouter; No ImagePath
U2 RichVideo; No ImagePath
U2 RtLedService; No ImagePath
U2 SeaPort; No ImagePath
U2 SoftwareService; No ImagePath
U3 SQLWriter; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 19:00 - 2015-01-27 19:00 - 00002258 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-27 19:00 - 2015-01-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-27 18:03 - 2015-01-27 18:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Astrid \Downloads\revosetup95 (6).exe
2015-01-26 12:54 - 2015-01-26 12:54 - 00000000 ____D () C:\Users\Astrid \Downloads\FRST-OlderVersion
2015-01-23 14:54 - 2015-01-23 14:54 - 00000526 _____ () C:\Users\Astrid \Desktop\FRST3.txt
2015-01-23 14:49 - 2015-01-27 19:05 - 00000545 _____ () C:\Users\Astrid \Desktop\Fixlist.txt
2015-01-23 14:43 - 2015-01-27 18:59 - 00000000 ____D () C:\Users\Astrid \AppData\Local\Deployment
2015-01-23 14:43 - 2015-01-23 14:43 - 00000000 ____D () C:\Users\Astrid \AppData\Local\Apps\2.0
2015-01-23 14:18 - 2015-01-23 14:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Astrid \Downloads\revosetup95 (5).exe
2015-01-23 14:14 - 2015-01-23 14:15 - 10801480 _____ (VS Revo Group ) C:\Users\Astrid \Downloads\RevoUninProSetup (1).exe
2015-01-23 14:13 - 2015-01-23 14:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Astrid \Downloads\revosetup95 (4).exe
2015-01-23 14:13 - 2015-01-23 14:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Astrid \Downloads\revosetup95 (3).exe
2015-01-23 09:51 - 2015-01-23 09:51 - 00908921 _____ () C:\Users\Astrid \Downloads\0000851500_15.01.2015 (2).ZIP
2015-01-23 09:50 - 2015-01-23 09:50 - 00908921 _____ () C:\Users\Astrid \Downloads\0000851500_15.01.2015 (1).ZIP
2015-01-23 09:46 - 2015-01-23 09:47 - 00908921 _____ () C:\Users\Astrid \Downloads\0000851500_15.01.2015.ZIP
2015-01-22 15:23 - 2015-01-21 14:54 - 00016488 _____ () C:\Users\Astrid \Documents\Aktuell%20offene%20Rechnungen.xls_0_1.ods
2015-01-22 11:45 - 2015-01-22 11:45 - 00038657 _____ () C:\Users\Astrid \Desktop\FRST2.txt
2015-01-22 11:40 - 2015-01-22 11:40 - 00000949 _____ () C:\Users\Astrid \Desktop\checkup.txt
2015-01-22 11:34 - 2015-01-22 11:34 - 00852504 _____ () C:\Users\Astrid \Downloads\SecurityCheck (3).exe
2015-01-21 22:14 - 2015-01-21 22:14 - 00852504 _____ () C:\Users\Astrid \Downloads\SecurityCheck (2).exe
2015-01-21 22:11 - 2015-01-21 22:11 - 00852504 _____ () C:\Users\Astrid \Downloads\SecurityCheck (1).exe
2015-01-21 22:08 - 2015-01-21 22:08 - 00852504 _____ () C:\Users\Astrid \Downloads\SecurityCheck.exe
2015-01-21 20:02 - 2015-01-21 20:02 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-21 20:01 - 2015-01-21 20:02 - 02347384 _____ (ESET) C:\Users\Astrid \Downloads\esetsmartinstaller_deu.exe
2015-01-21 14:30 - 2015-01-21 14:30 - 00002166 _____ () C:\Users\Astrid \Desktop\JRT.txt
2015-01-21 14:24 - 2015-01-21 14:24 - 00000000 ____D () C:\Windows\ERUNT
2015-01-21 14:23 - 2015-01-21 14:24 - 01707939 _____ (Thisisu) C:\Users\Astrid \Downloads\JRT.exe
2015-01-21 14:05 - 2015-01-21 14:05 - 02186752 _____ () C:\Users\Astrid \Downloads\AdwCleaner_4.108 (1).exe
2015-01-21 14:02 - 2015-01-21 14:22 - 00007780 _____ () C:\Users\Astrid \Desktop\mbam.txt
2015-01-21 14:00 - 2015-01-21 12:18 - 00016436 _____ () C:\Users\Astrid \Documents\Aktuell%20offene%20Rechnungen.xls_0.ods
2015-01-21 12:56 - 2015-01-21 12:56 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-21 12:54 - 2015-01-21 12:55 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Astrid \Downloads\mbam-setup-2.0.4.1028.exe
2015-01-21 08:43 - 2015-01-21 08:44 - 05608785 ____R (Swearware) C:\Users\Astrid \Downloads\ComboFix (1).exe
2015-01-21 08:31 - 2015-01-21 08:31 - 00038222 _____ () C:\Users\Astrid \Desktop\Combofix.txt
2015-01-21 08:26 - 2015-01-21 08:26 - 00038318 _____ () C:\ComboFix.txt
2015-01-21 07:59 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-21 07:59 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-21 07:59 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-21 07:59 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-21 07:59 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-21 07:59 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-21 07:59 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-21 07:59 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-21 07:58 - 2015-01-21 08:26 - 00000000 ____D () C:\Qoobox
2015-01-21 07:58 - 2015-01-21 08:23 - 00000000 ____D () C:\Windows\erdnt
2015-01-21 07:57 - 2015-01-21 07:58 - 05608785 ____R (Swearware) C:\Users\Astrid \Downloads\ComboFix.exe
2015-01-21 07:44 - 2015-01-21 07:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Astrid \Downloads\revosetup95 (2).exe
2015-01-21 07:43 - 2015-01-21 07:43 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Astrid \Downloads\revosetup95 (1).exe
2015-01-20 18:39 - 2015-01-20 18:40 - 00280840 _____ () C:\Windows\Minidump\012015-21793-01.dmp
2015-01-20 18:33 - 2015-01-20 18:34 - 00031755 _____ () C:\Users\Astrid \Desktop\gmer.txt
2015-01-20 18:31 - 2015-01-20 18:31 - 00033488 _____ () C:\Users\Astrid \Desktop\Addition.txt
2015-01-20 18:29 - 2015-01-20 18:29 - 00037558 _____ () C:\Users\Astrid \Desktop\FRST.txt
2015-01-20 18:24 - 2015-01-20 18:24 - 00000478 _____ () C:\Users\Astrid \Desktop\defogger_disable.log
2015-01-20 18:19 - 2015-01-20 18:33 - 00031899 _____ () C:\Users\Astrid \Downloads\gmer.txt
2015-01-20 17:14 - 2015-01-20 17:14 - 00380416 _____ () C:\Users\Astrid \Downloads\Gmer-19357.exe
2015-01-20 16:55 - 2015-01-20 16:57 - 00033598 _____ () C:\Users\Astrid \Downloads\Addition.txt
2015-01-20 16:53 - 2015-01-27 19:13 - 00000000 ____D () C:\FRST
2015-01-20 16:53 - 2015-01-27 19:12 - 00024466 _____ () C:\Users\Astrid \Downloads\FRST.txt
2015-01-20 16:52 - 2015-01-26 12:54 - 02129920 _____ (Farbar) C:\Users\Astrid \Downloads\FRST64.exe
2015-01-20 16:50 - 2015-01-20 16:50 - 00050477 _____ () C:\Users\Astrid \Downloads\Defogger (1).exe
2015-01-20 16:37 - 2015-01-20 18:23 - 00000478 _____ () C:\Users\Astrid \Downloads\defogger_disable.log
2015-01-20 16:37 - 2015-01-20 16:37 - 00000000 _____ () C:\Users\Astrid \defogger_reenable
2015-01-20 16:36 - 2015-01-20 16:36 - 00050477 _____ () C:\Users\Astrid \Downloads\Defogger.exe
2015-01-20 15:08 - 2015-01-20 15:09 - 02186752 _____ () C:\Users\Astrid \Downloads\adwcleaner_4.108.exe
2015-01-14 10:06 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 10:06 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 10:06 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 10:06 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 10:06 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 10:06 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 10:05 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 10:05 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 10:05 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 10:05 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 10:05 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 10:05 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 10:05 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-12 11:36 - 2015-01-09 13:20 - 00017770 _____ () C:\Users\Astrid \Documents\Ohne%20Mwst%204.%20Quartal%202014.xls_0.ods
2015-01-12 11:36 - 2015-01-09 13:00 - 00023337 _____ () C:\Users\Astrid \Documents\4.%20Quartal%202014.xls_0.ods
2015-01-12 11:36 - 2015-01-08 21:19 - 00017217 _____ () C:\Users\Astrid \Documents\Essensplan%202015.xls_1.ods
2015-01-08 17:02 - 2015-01-08 17:02 - 00083456 _____ () C:\Users\Astrid \Downloads\Polen Reiseeinzelheiten IV Quartal 2014- UMSATZSTEUER Polen.xls
2014-12-28 19:04 - 2015-01-27 14:30 - 00010752 _____ () C:\Users\Astrid \Desktop\Essensplan 2015.xls
2014-12-28 17:08 - 2014-12-30 17:43 - 00015872 _____ () C:\Users\Astrid \Desktop\Essensplan2014.xls
2014-12-28 14:03 - 2014-12-28 14:03 - 16766700 _____ (Adobe Systems Incorporated) C:\Users\Astrid \Downloads\hauptantrag.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 19:12 - 2014-01-29 13:07 - 00000000 ___RD () C:\Users\Astrid \Dropbox
2015-01-27 19:12 - 2014-01-29 13:06 - 00000000 ____D () C:\Users\Astrid \AppData\Roaming\Dropbox
2015-01-27 19:11 - 2014-04-23 12:37 - 00000000 ____D () C:\Users\Astrid \AppData\Roaming\Spotify
2015-01-27 19:11 - 2012-08-21 08:06 - 00307197 _____ () C:\Windows\system32\fastboot.set
2015-01-27 19:10 - 2012-08-21 07:57 - 00000000 ____D () C:\ProgramData\VeriFace
2015-01-27 19:09 - 2013-05-21 09:30 - 03228686 _____ () C:\FaceProv.log
2015-01-27 19:08 - 2012-08-21 07:58 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-27 19:08 - 2010-11-21 04:47 - 01081272 _____ () C:\Windows\PFRO.log
2015-01-27 19:08 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-27 19:08 - 2009-07-14 05:51 - 00134874 _____ () C:\Windows\setupact.log
2015-01-27 19:07 - 2012-08-21 06:56 - 02047622 _____ () C:\Windows\WindowsUpdate.log
2015-01-27 18:58 - 2012-08-21 07:58 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-27 18:53 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-27 18:53 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-27 18:37 - 2013-09-05 07:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-27 18:04 - 2014-11-19 09:41 - 00001275 _____ () C:\Users\Astrid \Desktop\Revo Uninstaller.lnk
2015-01-27 18:04 - 2014-11-19 09:41 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-26 15:36 - 2014-12-10 12:06 - 00010752 _____ () C:\Users\Astrid \Desktop\Aktuell offene Rechnungen.xls
2015-01-25 20:49 - 2013-09-05 07:49 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 20:49 - 2013-09-05 07:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 20:49 - 2013-09-05 07:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-23 14:44 - 2013-05-21 09:38 - 00000000 ____D () C:\Users\Astrid \AppData\Local\Google
2015-01-23 14:44 - 2012-08-21 07:58 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-23 14:15 - 2014-11-19 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-01-21 19:57 - 2012-08-21 16:34 - 00714910 _____ () C:\Windows\system32\perfh007.dat
2015-01-21 19:57 - 2012-08-21 16:34 - 00154704 _____ () C:\Windows\system32\perfc007.dat
2015-01-21 19:57 - 2009-07-14 06:13 - 01651208 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-21 14:09 - 2014-02-17 11:57 - 00000000 ____D () C:\AdwCleaner
2015-01-21 13:59 - 2014-09-02 20:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-21 13:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-01-21 12:56 - 2014-09-02 20:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-21 12:56 - 2014-09-02 20:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-21 08:26 - 2009-07-14 04:20 - 00000000 ___HD () C:\Users\Default
2015-01-21 08:23 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-20 18:39 - 2014-03-24 13:42 - 689318057 _____ () C:\Windows\MEMORY.DMP
2015-01-20 18:39 - 2014-03-24 13:42 - 00000000 ____D () C:\Windows\Minidump
2015-01-20 16:46 - 2014-07-18 10:18 - 00000000 ____D () C:\Users\Astrid \Desktop\Handybilder Vladi
2015-01-20 16:37 - 2013-05-21 09:30 - 00000000 ____D () C:\Users\Astrid 
2015-01-19 11:29 - 2014-08-28 10:22 - 00000000 ____D () C:\Users\Astrid \AppData\Local\Windows Live
2015-01-14 22:34 - 2013-10-23 06:12 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 22:23 - 2013-10-23 06:12 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-10 20:05 - 2013-05-21 09:33 - 00124184 _____ () C:\Users\Astrid \AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-10 20:03 - 2009-07-14 05:45 - 00479480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-08 13:46 - 2013-06-03 13:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-08 13:46 - 2013-05-22 14:39 - 00000000 ____D () C:\Users\Astrid \AppData\Local\CrashDumps
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-12-28 14:17 - 2014-10-20 16:56 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

==================== Files in the root of some directories =======

2014-08-22 08:50 - 2014-08-22 08:50 - 0033193 _____ () C:\Users\Astrid \AppData\Roaming\UserTile.png
2014-01-13 13:52 - 2014-09-02 09:18 - 0000264 _____ () C:\Users\Astrid \AppData\Roaming\WB.CFG
2014-01-13 13:52 - 2014-01-31 07:36 - 0000005 _____ () C:\Users\Astrid \AppData\Roaming\WBPU-TTL.DAT
2014-11-24 19:00 - 2014-11-24 19:00 - 0003584 _____ () C:\Users\Astrid \AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-08-21 08:07 - 2012-08-21 08:07 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Astrid Böttcher\AppData\Local\Temp\avgnt.exe
C:\Users\Astrid Böttcher\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzogdty.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-06 09:26

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Meine Frage mit dem Google Konto? Wenn Du ein Google Konto verbindest können wir so viel bereinigen wie wir wollen, Google synct die Malware immer wieder in den Browser.

Hallo,

ich bin alles noch mal durchgegangen, habe google chrom ohne Kontoanmeldung neu installiert. Es ist alles beim alten. Immer noch geht die Werbung auf.

Im Gegensatz zum ersten mal wurde aber beim durchlauf der Programme keine Infizierungen mehr gefunden.

Gruß

Astrid

Ok, die Werbung geht auf bei frisch installiertem, zurückgesetzten Chrome, ohne ne Kontoverbindung?

Bitte mal testen ob auch Werbung in Firefox und/oder Internet Explorer sind.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

CHR HomePage: Default -> hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
CHR StartupUrls: Default -> "hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108", "hxxp://www.google.de/"
Tcpip\Parameters: [DhcpNameServer] 192.168.188.1
Tcpip\..\Interfaces\{0A6F295B-354E-441C-9445-C5444681D645}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{75E76526-9C40-4A25-A1DB-649B8E2A3BFC}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{C2A62BED-086A-4DC6-AB12-3938572A2CCB}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{CF5D4A81-BF43-4D86-AD28-45A03D6C1711}: [NameServer] 81.218.119.15,199.203.35.75
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Hallo,

Firefox hab ich nicht installiert und bei Internet Explorer geht die Werbung genauso auf.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-02-2015 02
Ran by Astrid Böttcher at 2015-02-12 13:54:27 Run:3
Running from C:\Users\Astrid Böttcher\Downloads
Loaded Profiles: Astrid Böttcher (Available profiles: Astrid Böttcher)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HomePage: Default -> hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
CHR StartupUrls: Default -> "hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108", "hxxp://www.google.de/"
Tcpip\Parameters: [DhcpNameServer] 192.168.188.1
Tcpip\..\Interfaces\{0A6F295B-354E-441C-9445-C5444681D645}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{75E76526-9C40-4A25-A1DB-649B8E2A3BFC}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{C2A62BED-086A-4DC6-AB12-3938572A2CCB}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{CF5D4A81-BF43-4D86-AD28-45A03D6C1711}: [NameServer] 81.218.119.15,199.203.35.75
Emptytemp:
         
*****************

Chrome HomePage not detected.
Chrome StartupUrls not detected.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer => value deleted successfully.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0A6F295B-354E-441C-9445-C5444681D645}\\NameServer => value deleted successfully.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{75E76526-9C40-4A25-A1DB-649B8E2A3BFC}\\NameServer => value deleted successfully.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C2A62BED-086A-4DC6-AB12-3938572A2CCB}\\NameServer => value deleted successfully.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CF5D4A81-BF43-4D86-AD28-45A03D6C1711}\\NameServer => value deleted successfully.
EmptyTemp: => Removed 566.2 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 13:56:36 ====
         

Hallo,

nach dem Neustart erscheint die lästige Werbung nicht mehr. Vielen Dank. Spende folgt. Wie kann ich meinen Rechner jetzt am besten schützen?

Gruß

Astrid

Dazu gibt es im Anschluss ne Info, bitte nochmal ein frisches FRST log