MBAM Logfile?

Mittlerweile müsste einigermaßen Ruhe sein mit Popups oder?

Scan heute.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 10.04.2015
Suchlauf-Zeit: 08:26:41
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.04.10.02
Rootkit Datenbank: v2015.03.31.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Natalie

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 315141
Verstrichene Zeit: 16 Min, 0 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         

Wenn die Frau zwischen Tür und Angel, bzw. zw. Kinder und Haushalt noch am PC arbeitet, kommt es vor wichtiges zu vergessen. Popups haben sich inzwischen "beruhigt" ;-) Schöne Grüße

Prioritäten anders setzen



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=0272f828cf3d0f4d8ba6c24019fada12
# engine=23331
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-11 01:20:55
# local_time=2015-04-11 03:20:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 177261 180389646 0 0
# scanned=132119
# found=50
# cleaned=0
# scan_time=14465
sh=2133E6DF6DFB0A57D655061E7096F931297B5736 ft=1 fh=dda11d203fb38e2a vn="Variante von Win32/ELEX.BF evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WPM\update\update.exe.vir"
sh=C815221D273F1987BB3E21B386CAF2B1352CEC53 ft=1 fh=0391e6ad229f1788 vn="Win32/Verti.G evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\PricePeep\PricePeepUpdater.exe.vir"
sh=B5ED1E639B7D9AD3C0F3C81E5AA2E9F88DDFEB65 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\102_dealply_m.js.vir"
sh=066D67D3C0F4110A52C2843171BCB750FA7A6E6B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\103_intext_5_m.js.vir"
sh=8BFBBD749FDAA46297DA7F28A30E29C55FD72880 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\104_jollywallet_m.js.vir"
sh=0B21E41A47E579081215969619861996F43524B1 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\105_corticas_m.js.vir"
sh=30AFCC1D03C04E68202593C239C4964A29BA2E15 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\108_icm_m.js.vir"
sh=7F7359D9F0900191297BFDF5B85D5CDF588CD9EA ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\117_coupons_intext_ads_5_m.js.vir"
sh=FE3704EEF2BFB9DCA552518E7AEC9D6AFC1ED15C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\119_similar_web_m.js.vir"
sh=35CE3B76158991DDEA79CAF0C1F826A7EE18A820 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\120_luck_m.js.vir"
sh=E106EF12FBA54AD37717391E3A2A8B7416B0A30E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\123_intext_adv_m.js.vir"
sh=6376FE6DF3E7E394FAE45C47A1FDE1CF41CAFBFD ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\124_superfish_no_search_no_coupons_m.js.vir"
sh=D295E3F253D0942BD3114F61DEF5D78DD0FC5BFB ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\125_arcadi2_m.js.vir"
sh=3CFE90E3825BB08EB9B4222552FAC05360188207 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\126_revizer_ws_m.js.vir"
sh=031F6CD140ED363E0F137E627AE1FE4DED5714E2 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\127_revizer_p_m.js.vir"
sh=EF36C9502A12C97CF29A90C0ACE3DCF72ACD389E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\128_superfish_pricora_m.js.vir"
sh=BB2946641B9FEB2F76D281220A52220336E454E1 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\135_arcadi3_m.js.vir"
sh=8BD506BDCB470B73FE581B4DA1769AD9FBCAF0D8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\138_getdeal_m.js.vir"
sh=90A4F559561CF603A203F93D56C80B17B8152325 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\141_corticas_ru_m.js.js.vir"
sh=8395A2B6D59D2F3EDDCFC863DDA2F674396DC74C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\142_intext_fa_m.js.vir"
sh=AE2D5CE395EE9CD2595F77F616E574F4794B1152 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\155_ibario_pops_m.js.vir"
sh=0CEB1A073B87956FD1F21F8425B8F76015B1BCD8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\158_50onred_ads_only_no_fb_m.js.vir"
sh=441E98540BDEC21B7E534C2B317AE91925F6CEE7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\159_cortica_rollover_m.js.vir"
sh=C8B01A1511A63AEC3D40B1D045034D76B1E85EFD ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\171_arcadi2_sourceID_m.js.vir"
sh=078C314715CCC0DE7547172AD4B810FD754115C6 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js.vir"
sh=220B01F705C009D135199A26C85EB536B16C9D6E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\175_coolmirage_m.js.vir"
sh=CFFCA6A4EE3A0DF2319440491BB297ADEC6EEF37 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\178_revizer_ws_dynamic_m.js.vir"
sh=ADB54DE323736C99B4191A45B478B70DF1B7B945 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\179_revizer_p_dynamic_m.js.vir"
sh=B683C210045A4133B80E4ECC0C23BC3196B66514 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\180_bpo_serp_m.js.vir"
sh=24E6E5A06D24A5CC24C0B705FDB089FD4FEC70AC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\184_noproblemppc_m.js.vir"
sh=C98AEA90C3721B5A74EEAA39FD98797405C0187B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\189_active_sanity.js.vir"
sh=6B3C17F9D4BD40BFCF87831196C40DBA3C4DB14C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\190_pops_5_m.js.vir"
sh=BD99029E3E064DE3BDC009BED86CE5F9F6556130 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\191_ciuvo_m.js.vir"
sh=F913C9EE03B4CCE8680961DBF505FA17BAC140F0 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\192_revizer_ws_dynamic_b2b_m.js.vir"
sh=E77FB0FFA453EF58E1FAD775B922C3A1916B07EE ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\193_revizer_p_dynamic_b2b_m.js.vir"
sh=B44C8AF7102A3B6686E1F8911D96FFB3CC2A784B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\194_retargeting_bi_m.js.js.vir"
sh=DA00D43895202044AAF7EFA3BD388B190B155367 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\195_icm_convertmedia_m.js.vir"
sh=0A113BDC19C5B96609992E6C9D972B814B918109 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\197_kreapixel_pops_m.js.vir"
sh=9A67AB016B12405F2FF8E65A64A035E46421F243 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\198_superfish_no_search_no_coupons_plushd_m.js.vir"
sh=6DF0914CB2A51AA8E7F1BDDEC414B8969C38A6F7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\199_superfish_no_coupons_plushd_m.js.vir"
sh=FBB7D706F207407D497E9D92FFAEB182CCDEECC6 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\1_base.js.vir"
sh=61DB672F16D1D9053F6B8D591E51C53BA3165770 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\200_foxydeal_m.js.vir"
sh=392B3EB529AF22E57C2AC4076E7702176010694C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\204_pricedetect_m.js.vir"
sh=5902FC10054355A5B8B9CC41620445BAA0F1D0AB ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\21_debug.js.vir"
sh=57F2136CD86B69E88017E3346CF16BE0C2A51A2B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\28_initializer.js.vir"
sh=8E02D18AFFA3BAC8870F82D66A5E330076CF251F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\91_monetizationLoader.js.js.vir"
sh=0C5AC30A082628E85A9A8B68EF5E5EAFA46F0CC7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\93_superfish_no_coupons_m.js.vir"
sh=9E77E1D2FD7B77B0FD8A71A70C35DD5A16836CF3 ft=1 fh=b241df9fafd25e77 vn="Win32/Systweak.G evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Natalie\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=5E41AB693AF0FEB0F33E013CF7FAA7CA91AABDE3 ft=1 fh=b9176d4f2bb0ec62 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir"
sh=9267528CB56BD964A6BF414F16F47EE6751AAF4D ft=1 fh=96c305064e75c60c vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Natalie\Downloads\CCleaner - CHIP-Downloader.exe"
         

 Results of screen317's Security Check version 1.00  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 CCleaner     
 Adobe Flash Player 10 Flash Player out of Date! 
  Adobe Flash Player 	16.0.0.305 Flash Player out of Date!  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox (37.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 windows defender MpCmdRun.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Natalie (administrator) on NATALIE-MSI on 11-04-2015 15:42:57
Running from C:\Users\Natalie\Desktop
Loaded Profiles: Natalie (Available profiles: Natalie)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-19] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7739936 2009-09-11] (Realtek Semiconductor)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-11-11] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49636;https=127.0.0.1:49636
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPA2AF4D4D-C670-448C-825B-13D2A56EE1A8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2013-05-08] (Adobe Systems Incorporated)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-04-07] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Natalie\AppData\Local\Google\Chrome\User Data\default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-02-11] (Freemake) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-11] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R3 nuviocir; C:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [29696 2009-06-19] (Nuvoton Technology Corp.)
R3 RTHDMIAzAudService; C:\windows\System32\drivers\RtHDMIV.sys [155648 2009-07-17] (Realtek Semiconductor Corp.)
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Natalie\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-11 15:36 - 2015-04-11 15:36 - 00852616 _____ () C:\Users\Natalie\Desktop\SecurityCheck.exe
2015-04-11 11:14 - 2015-04-11 11:14 - 02347384 _____ (ESET) C:\Users\Natalie\Desktop\esetsmartinstaller_deu.exe
2015-04-10 09:07 - 2015-04-10 09:07 - 00001210 _____ () C:\Users\Natalie\Desktop\MBAM.txt
2015-04-09 14:10 - 2015-04-09 14:10 - 00000946 _____ () C:\Users\Natalie\Desktop\JRT.txt
2015-04-09 14:05 - 2015-04-09 14:05 - 00000207 _____ () C:\windows\tweaking.com-regbackup-NATALIE-MSI-Windows-7-Home-Premium-(32-bit).dat
2015-04-09 14:05 - 2015-04-09 14:05 - 00000000 ____D () C:\RegBackup
2015-04-09 14:03 - 2015-04-09 14:03 - 02686959 _____ (Thisisu) C:\Users\Natalie\Desktop\JRT.exe
2015-04-09 13:59 - 2015-04-09 14:00 - 00014085 _____ () C:\Users\Natalie\Desktop\AdwCleaner[S1]..txt
2015-04-09 13:32 - 2015-04-09 13:54 - 00000000 ____D () C:\AdwCleaner
2015-04-09 13:32 - 2015-04-09 13:32 - 02217984 _____ () C:\Users\Natalie\Desktop\AdwCleaner_4.201.exe
2015-04-09 13:15 - 2015-04-09 13:23 - 00212626 _____ () C:\Users\Natalie\Desktop\Malware.txt
2015-04-09 12:48 - 2015-04-11 15:41 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-09 12:46 - 2015-04-09 12:46 - 00001074 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-04-09 12:46 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-09 12:46 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-09 12:46 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-09 12:44 - 2015-04-09 12:44 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Natalie\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-09 12:42 - 2015-04-09 12:42 - 00002199 _____ () C:\Users\Natalie\Desktop\next ste.txt
2015-04-08 20:10 - 2015-04-08 20:11 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-08 19:53 - 2015-04-08 19:53 - 00033956 _____ () C:\Users\Natalie\Desktop\combifix.txt
2015-04-08 19:46 - 2015-04-08 19:46 - 00033956 _____ () C:\ComboFix.txt
2015-04-08 19:19 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2015-04-08 19:19 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2015-04-08 19:19 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2015-04-08 19:18 - 2015-04-08 19:46 - 00000000 ____D () C:\Qoobox
2015-04-08 19:18 - 2015-04-08 19:42 - 00000000 ____D () C:\windows\erdnt
2015-04-08 19:16 - 2015-04-08 19:17 - 05617275 ____R (Swearware) C:\Users\Natalie\Desktop\ComboFix.exe
2015-04-08 18:16 - 2015-04-08 18:16 - 00001236 _____ () C:\Users\Natalie\Desktop\Revo Uninstaller.lnk
2015-04-08 18:16 - 2015-04-08 18:16 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-04-08 18:14 - 2015-04-08 18:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Natalie\Desktop\revosetup95.exe
2015-04-07 14:23 - 2015-04-07 14:25 - 00000000 ____D () C:\windows\rescache
2015-04-07 13:25 - 2015-04-07 13:28 - 00027726 _____ () C:\Users\Natalie\Desktop\Addition.txt
2015-04-07 13:21 - 2015-04-11 15:42 - 00009041 _____ () C:\Users\Natalie\Desktop\FRST.txt
2015-04-07 13:20 - 2015-04-11 15:43 - 00000000 ____D () C:\FRST
2015-04-07 13:19 - 2015-04-07 13:19 - 01135104 _____ (Farbar) C:\Users\Natalie\Desktop\FRST.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-11 15:40 - 2013-11-06 15:18 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-11 15:38 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-11 15:38 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-11 15:11 - 2013-10-31 10:04 - 01907710 _____ () C:\windows\WindowsUpdate.log
2015-04-11 11:11 - 2014-07-03 18:31 - 00001064 _____ () C:\windows\setupact.log
2015-04-11 11:11 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-10 18:49 - 2014-01-21 09:26 - 02592768 ___SH () C:\Users\Natalie\Desktop\Thumbs.db
2015-04-10 11:40 - 2014-03-04 14:21 - 00000180 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2015-04-10 11:40 - 2009-07-14 06:52 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-04-10 08:22 - 2014-07-03 18:31 - 00381742 _____ () C:\windows\PFRO.log
2015-04-09 13:55 - 2013-11-06 10:32 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-09 13:55 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2015-04-09 13:53 - 2013-10-31 11:27 - 00001166 _____ () C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-09 11:01 - 2013-11-06 12:22 - 00000000 ____D () C:\Users\Natalie\AppData\Roaming\Skype
2015-04-09 10:17 - 2009-10-17 04:37 - 01618320 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-08 19:46 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-04-08 19:39 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2015-04-08 19:37 - 2009-07-14 04:03 - 45875200 _____ () C:\windows\system32\config\software.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 19398656 _____ () C:\windows\system32\config\system.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00524288 _____ () C:\windows\system32\config\default.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-04-07 10:40 - 2013-11-06 15:18 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-04-07 10:40 - 2013-11-06 15:18 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-03-04 14:21 - 2015-04-10 11:40 - 0000180 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2013-12-09 09:36 - 2014-05-25 18:48 - 0006144 _____ () C:\Users\Natalie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Users\Natalie\AppData\Local\temp\Quarantine.exe
C:\Users\Natalie\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-07 14:16

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Hallo lieber Schrauber,

bevor wir uns für Weile trennen (dass wir uns hier wieder treffen bin ich mir sicher), kannst Du mir bitte alle mögliche Kindersicherungen, die so ein Rechner braucht, empfehlen. Wie schon erwähnt, wechselt dieser rechner seinen Besitzer.
Noch etwas zu dem ganzen Schlamassel hier, dieser Rechner war bei einem PC Doktor, das Ergebnis lässt sich ja sehen.
Und noch eine Frage, was hälst Du von der Seite Serienjjunnkiiess?
Wünsche Dir ein schönes WE.

Flash Player und Adobe Reader updaten.

Noch was zu lesen:
CHIP-Installer - was ist das? - Anleitungen



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

RemoveProxy:
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Frisches FRST log bitte.

Zum Abschluss gibt es nen Text zum Aufräumen und Absichern, dann ist die Kiste gut abgesichert. Aber nix hilft wenn man unbedingt Malware haben will (Surf- und Downloadverhalten).
Dann muss man schon explizit auch Seiten und Downloads sperren, für Kinder zB.

Serienjunkies ist i.O.

Hatt mich vertan, wieder zu schnell reagiert ;-)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015
Ran by Natalie at 2015-04-12 13:16:03 Run:2
Running from C:\Users\Natalie\Desktop
Loaded Profiles: Natalie (Available profiles: Natalie)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
RemoveProxy:
Emptytemp:
*****************


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.


========= End of RemoveProxy: =========

EmptyTemp: => Removed 283.3 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 13:16:49 ====
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Natalie (administrator) on NATALIE-MSI on 12-04-2015 13:22:52
Running from C:\Users\Natalie\Desktop
Loaded Profiles: Natalie (Available profiles: Natalie)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-19] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7739936 2009-09-11] (Realtek Semiconductor)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-11-11] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPA2AF4D4D-C670-448C-825B-13D2A56EE1A8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2013-05-08] (Adobe Systems Incorporated)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-04-07] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Natalie\AppData\Local\Google\Chrome\User Data\default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-02-11] (Freemake) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R3 nuviocir; C:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [29696 2009-06-19] (Nuvoton Technology Corp.)
R3 RTHDMIAzAudService; C:\windows\System32\drivers\RtHDMIV.sys [155648 2009-07-17] (Realtek Semiconductor Corp.)
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Natalie\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-11 15:54 - 2013-09-21 19:00 - 653600701 _____ () C:\Users\Natalie\Desktop\Avanture.neustrasivog.Teda.2012..mkv
2015-04-11 15:53 - 2013-12-01 14:04 - 376703167 _____ () C:\Users\Natalie\Desktop\Kratki.spojevi.mkv
2015-04-11 15:36 - 2015-04-11 15:36 - 00852616 _____ () C:\Users\Natalie\Desktop\SecurityCheck.exe
2015-04-11 11:14 - 2015-04-11 11:14 - 02347384 _____ (ESET) C:\Users\Natalie\Desktop\esetsmartinstaller_deu.exe
2015-04-10 09:07 - 2015-04-10 09:07 - 00001210 _____ () C:\Users\Natalie\Desktop\MBAM.txt
2015-04-09 14:10 - 2015-04-09 14:10 - 00000946 _____ () C:\Users\Natalie\Desktop\JRT.txt
2015-04-09 14:05 - 2015-04-09 14:05 - 00000207 _____ () C:\windows\tweaking.com-regbackup-NATALIE-MSI-Windows-7-Home-Premium-(32-bit).dat
2015-04-09 14:05 - 2015-04-09 14:05 - 00000000 ____D () C:\RegBackup
2015-04-09 14:03 - 2015-04-09 14:03 - 02686959 _____ (Thisisu) C:\Users\Natalie\Desktop\JRT.exe
2015-04-09 13:59 - 2015-04-09 14:00 - 00014085 _____ () C:\Users\Natalie\Desktop\AdwCleaner[S1]..txt
2015-04-09 13:32 - 2015-04-09 13:54 - 00000000 ____D () C:\AdwCleaner
2015-04-09 13:32 - 2015-04-09 13:32 - 02217984 _____ () C:\Users\Natalie\Desktop\AdwCleaner_4.201.exe
2015-04-09 13:15 - 2015-04-09 13:23 - 00212626 _____ () C:\Users\Natalie\Desktop\Malware.txt
2015-04-09 12:48 - 2015-04-12 13:20 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-09 12:46 - 2015-04-09 12:46 - 00001074 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-04-09 12:46 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-09 12:46 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-09 12:46 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-09 12:44 - 2015-04-09 12:44 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Natalie\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-09 12:42 - 2015-04-09 12:42 - 00002199 _____ () C:\Users\Natalie\Desktop\next ste.txt
2015-04-08 20:10 - 2015-04-08 20:11 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-08 19:53 - 2015-04-08 19:53 - 00033956 _____ () C:\Users\Natalie\Desktop\combifix.txt
2015-04-08 19:46 - 2015-04-08 19:46 - 00033956 _____ () C:\ComboFix.txt
2015-04-08 19:19 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2015-04-08 19:19 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2015-04-08 19:19 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2015-04-08 19:18 - 2015-04-08 19:46 - 00000000 ____D () C:\Qoobox
2015-04-08 19:18 - 2015-04-08 19:42 - 00000000 ____D () C:\windows\erdnt
2015-04-08 19:16 - 2015-04-08 19:17 - 05617275 ____R (Swearware) C:\Users\Natalie\Desktop\ComboFix.exe
2015-04-08 18:16 - 2015-04-08 18:16 - 00001236 _____ () C:\Users\Natalie\Desktop\Revo Uninstaller.lnk
2015-04-08 18:16 - 2015-04-08 18:16 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-04-08 18:14 - 2015-04-08 18:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Natalie\Desktop\revosetup95.exe
2015-04-07 14:23 - 2015-04-07 14:25 - 00000000 ____D () C:\windows\rescache
2015-04-07 13:25 - 2015-04-07 13:28 - 00027726 _____ () C:\Users\Natalie\Desktop\Addition.txt
2015-04-07 13:21 - 2015-04-12 13:22 - 00008909 _____ () C:\Users\Natalie\Desktop\FRST.txt
2015-04-07 13:20 - 2015-04-12 13:22 - 00000000 ____D () C:\FRST
2015-04-07 13:19 - 2015-04-07 13:19 - 01135104 _____ (Farbar) C:\Users\Natalie\Desktop\FRST.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 13:20 - 2014-01-21 09:26 - 02600448 ___SH () C:\Users\Natalie\Desktop\Thumbs.db
2015-04-12 13:20 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-12 13:19 - 2014-07-03 18:31 - 00001232 _____ () C:\windows\setupact.log
2015-04-12 13:19 - 2013-10-31 10:04 - 01934227 _____ () C:\windows\WindowsUpdate.log
2015-04-12 13:01 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-12 13:01 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-12 12:54 - 2013-11-06 12:22 - 00000000 ____D () C:\Users\Natalie\AppData\Roaming\Skype
2015-04-12 12:40 - 2013-11-06 15:18 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-12 11:01 - 2014-07-03 18:31 - 00382532 _____ () C:\windows\PFRO.log
2015-04-10 11:40 - 2014-03-04 14:21 - 00000180 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2015-04-10 11:40 - 2009-07-14 06:52 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-04-09 13:55 - 2013-11-06 10:32 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-09 13:55 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2015-04-09 13:53 - 2013-10-31 11:27 - 00001166 _____ () C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-09 10:17 - 2009-10-17 04:37 - 01618320 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-08 19:46 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-04-08 19:39 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2015-04-08 19:37 - 2009-07-14 04:03 - 45875200 _____ () C:\windows\system32\config\software.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 19398656 _____ () C:\windows\system32\config\system.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00524288 _____ () C:\windows\system32\config\default.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-04-07 10:40 - 2013-11-06 15:18 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-04-07 10:40 - 2013-11-06 15:18 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-03-04 14:21 - 2015-04-10 11:40 - 0000180 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2013-12-09 09:36 - 2014-05-25 18:48 - 0006144 _____ () C:\Users\Natalie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-07 14:16

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Kennst Du Dich auch mit Tablets aus? :-) irgendwie werde ich das hier vermiessen, he,he,he...
Herzlichen Dank, ich habe schon einiges gelernt...
ach ja,was war das mit dem CHIP-Installer? Wie ich es verstanden habe, der ist nicht zu empfehlen? Gut, Gut, ich werde es in Text Datei ausdrucken und in aller Ruhe lesen (lese nicht so gerne von dem Bildschirm). Ist die Seite von Chip.de auch nicht zu empfehlen? Von dort habe ich bisher immer alles heruntergeladen.
DANKE
Ich wünsche Dir einen schönen sonnigen Tag

Das steht alles in dem Text. Seit Einführung des Chip Installers ist Chip ne Adware-Schleuder.

Was haste denn mit dem Tablet?

Morgen dorthin,

danke für die Antwort, ich habe dies mit Chip installer gelesen, den muss ich von meinem anderen PC deinstallieren.
Mit dem Tablet? Mein Sohn meint, der ist ihm zu lahm wenn er ins interenet geht.

Schöne sonnige Grüße

Ist da ein Windows Betriebssystem drauf? Wenn ja dann bitte mal FRST logs davon

Sollen wir erstmal die Kiste hier fertig machen (falls nicht) und das mit dem Tablet überlege ich es mir noch :-)

ist fertig



Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

• Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  
• Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
• Klicke auf OK.
  Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
• Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Guten Morgen,
hier bin ich schon wieder, bin süchtig gewordne, he,he
Nun Spaß bei Seit, könntest Du bitte einen Blick daraug werfen, ob sich da inzwischen was eingenistet hat

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-06-2015 01
Ran by Natalie (administrator) on NATALIE-MSI on 23-06-2015 10:54:01
Running from C:\Users\Natalie\Desktop
Loaded Profiles: Natalie (Available Profiles: Natalie)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_160.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_160.exe
(Irfan Skiljan) C:\Program Files\IrfanView\i_view32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-19] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7739936 2009-09-11] (Realtek Semiconductor)
HKLM\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53282944 2015-06-16] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-11-11] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPA2AF4D4D-C670-448C-825B-13D2A56EE1A8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\ehyydt2x.default-1434703837058
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-19] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-06-22]

Chrome: 
=======
CHR Profile: C:\Users\Natalie\AppData\Local\Google\Chrome\User Data\default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-02-11] (Freemake) [File not signed]
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 nuviocir; C:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [29696 2009-06-19] (Nuvoton Technology Corp.)
R3 RTHDMIAzAudService; C:\windows\System32\drivers\RtHDMIV.sys [155648 2009-07-17] (Realtek Semiconductor Corp.)
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Natalie\AppData\Local\Temp\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-23 10:44 - 2015-06-23 10:45 - 00022531 _____ C:\Users\Natalie\Desktop\Addition.txt
2015-06-23 10:42 - 2015-06-23 10:54 - 00008849 _____ C:\Users\Natalie\Desktop\FRST.txt
2015-06-23 10:42 - 2015-06-23 10:54 - 00000000 ____D C:\FRST
2015-06-23 10:42 - 2015-06-23 10:42 - 01148928 _____ (Farbar) C:\Users\Natalie\Desktop\FRST.exe
2015-06-22 17:04 - 2015-06-22 17:06 - 00006742 _____ C:\windows\system32\lvcoinst.log
2015-06-22 17:04 - 2015-06-22 17:06 - 00000000 ____D C:\Program Files\Common Files\logishrd
2015-06-22 11:28 - 2015-06-22 11:29 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-06-21 13:46 - 2015-06-21 13:46 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-06-21 13:18 - 2015-06-21 13:30 - 00000000 ____D C:\Users\Natalie\Desktop\musik
2015-06-21 13:15 - 2015-06-23 08:54 - 00001831 _____ C:\windows\setupact.log
2015-06-21 13:15 - 2015-06-21 13:15 - 00000000 _____ C:\windows\setuperr.log
2015-06-19 11:15 - 2015-06-19 11:15 - 00000000 ____D C:\Users\Natalie\Tracing
2015-06-19 11:15 - 2015-06-19 11:15 - 00000000 ____D C:\Users\Natalie\AppData\Local\Skype
2015-06-19 11:13 - 2015-06-19 11:20 - 00000000 ___RD C:\Program Files\Skype
2015-06-19 11:13 - 2015-06-19 11:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-06-19 11:13 - 2015-06-19 11:13 - 00000000 ____D C:\Program Files\Common Files\Skype
2015-06-19 11:11 - 2015-06-19 11:11 - 01384064 _____ (Skype Technologies S.A.) C:\Users\Natalie\Downloads\SkypeSetup(1).exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-23 10:40 - 2013-11-06 15:18 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-06-23 10:27 - 2013-10-31 10:04 - 01126564 _____ C:\windows\WindowsUpdate.log
2015-06-23 10:20 - 2009-10-17 04:37 - 01618320 _____ C:\windows\system32\PerfStringBackup.INI
2015-06-23 09:55 - 2013-11-06 12:22 - 00000000 ____D C:\Users\Natalie\AppData\Roaming\Skype
2015-06-23 09:02 - 2009-07-14 06:34 - 00017376 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-23 09:02 - 2009-07-14 06:34 - 00017376 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-23 08:55 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-06-23 08:54 - 2013-11-06 10:32 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-06-22 21:29 - 2014-01-21 09:26 - 02675712 ___SH C:\Users\Natalie\Desktop\Thumbs.db
2015-06-22 17:06 - 2009-07-14 06:52 - 00000000 ____D C:\windows\twain_32
2015-06-21 17:41 - 2015-04-14 13:39 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2015-06-19 14:12 - 2013-11-06 15:18 - 00778416 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-06-19 14:12 - 2013-11-06 15:18 - 00142512 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2015-06-19 14:11 - 2013-11-06 15:17 - 00000000 ____D C:\Users\Natalie\AppData\Local\Adobe
2015-06-19 13:21 - 2013-11-06 10:29 - 00000000 ____D C:\Users\Natalie\AppData\Roaming\Adobe
2015-06-19 12:06 - 2009-10-17 05:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\msi
2015-06-19 12:06 - 2009-10-17 05:57 - 00000000 ____D C:\Program Files\msi
2015-06-19 12:01 - 2015-04-14 13:19 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware
2015-06-19 11:15 - 2013-10-31 10:06 - 00000000 ____D C:\Users\Natalie
2015-06-19 11:14 - 2009-10-17 05:59 - 00000000 ____D C:\ProgramData\Skype
2015-06-19 10:54 - 2013-10-31 11:14 - 00000000 ____D C:\ProgramData\Adobe

==================== Files in the root of some directories =======

2014-03-04 14:21 - 2015-04-10 11:40 - 0000180 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2013-12-09 09:36 - 2014-05-25 18:48 - 0006144 _____ () C:\Users\Natalie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-19 11:37

==================== End of log ============================
         

sieht gut aus. Hast Du Probleme mit dem Rechner?

Morgen, er ist ein wenig laaaaaangsam, anosten O.K.
Gruß
Tascha

definier das mal bitte genauer