Trojaner-Board - Trojaner TR/Rogue.4087238

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojaner TR/Rogue.4087238 (https://www.trojaner-board.de/139153-trojaner-tr-rogue-4087238-a.html)

Trojaner TR/Rogue.4087238

Hallo,

danke schon mal im voraus für Eure Hilfe. :dankeschoen:

Wenn ich einige Zeit an meinem Laptop gearbeitet habe, wird der Bildschirm plötzlich schwarz. Der Laptop fährt aber nicht von alleine runter. Ich muß ihn dann runter fahren. Wenn ich Ihn dann nach kurzer Zeit wieder hochfahre, erhalte ich die Information Systemtemperatur erreicht und ich soll das Support Center von HP kontaktieren. Wenn ich das System wieder start kann ganz normal weiterarbeiten.

Das Antivirenprogramm hat mir vor ein paar Tagen nun den Trojaner TR/Rouge gemeldet. Der Trojaner wurde in der Datei vom Support-Center gefunden. Trojaner ist in Quaratäne. Das Problem war dann 1 Tag weg und hat sich dann wieder eingestellt.
Ich hatte vor einiger Zeit schon mal einen Trojaner gefunden (TR/Dldr.Agent.589032) der auch in Quarantäne sitz, aber keine Probleme gemacht hat. Das Programm mit dem ich den Trojaner TR/Dldr runtergezogen habe, habe ich auch deinstalliert.

Wo ich den Trojaner TR/Rogue her habe, weiß ich nicht.

Der Scanner Gmer hat die Fehlermeldung "gmer_2.1.19163.exe funktioniert nicht mehr" angezeigt. Der Scanner blieb stehen bei der Datei " Library: C:\Windows\system32\svchost.exe@c:\windows\system32\sstpsvc.dll "

Viele Grüße
sk_muecke

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hallo,

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03

Ran by Leonie (administrator) on 01-08-2013 09:34:13

Running from C:\Users\Leonie\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

( ) C:\Windows\system32\lxdicoms.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Telefónica) C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

() C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe

(Lexmark) C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\loggingserver.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe

() C:\Program Files (x86)\AVG Secure Search\vprot.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2010-09-13] (Synaptics Incorporated)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2010-09-22] (Realtek Semiconductor)

HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)

HKLM\...\Run: [lxdimon.exe] - C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe [435120 2007-03-06] ()

HKLM\...\Run: [lxdiamon] - C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe [20480 2007-03-05] (Lexmark)

HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)

HKLM\...\Run: [LXDICATS] - rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXDItime.dll,RunDLLEntry [x]

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!

HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-08-16] (Hewlett-Packard Company)

HKCU\...\Run: [Facebook Update] - C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-01-13] (Facebook Inc.)

HKCU\...\Policies\system: [DisableLockWorkstation] 0

HKCU\...\Policies\system: [DisableChangePassword] 0

MountPoints2: {00e7ad8b-a005-11e2-9cee-984be18dc335} - F:\AutoRun.exe

MountPoints2: {17dd0ae7-e51d-11e1-b588-984be18dc335} - F:\AutoRun.exe

MountPoints2: {3357ff6e-e4a4-11e1-ac8f-984be18dc335} - F:\AutoRun.exe

MountPoints2: {3357ff7c-e4a4-11e1-ac8f-984be18dc335} - F:\AutoRun.exe

MountPoints2: {7b1ec912-9be4-11e2-a5f2-984be18dc335} - F:\AutoRun.exe

MountPoints2: {a8a64b3f-9bc1-11e2-80a8-984be18dc335} - F:\AutoRun.exe

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [584760 2010-09-28] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2010-08-30] (EasyBits Software AS)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [FaxCenterServer] - C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe [312240 2007-03-06] ()

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)

HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2285232 2013-07-30] ()

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)

HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-12-07] (Nullsoft, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk

ShortcutTarget: Snapfish PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-search.com/?affID=119747&tt=gc_&babsrc=HP_ss&mntrId=088090004E29D055

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4

SearchScopes: HKLM - DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF

SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF

SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}

SearchScopes: HKLM - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKLM-x32 - DefaultScope {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20130307131859535&tb_oid=07-03-2013&tb_mrud=07-03-2013

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF

SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF

SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}

SearchScopes: HKLM-x32 - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKLM-x32 - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20130307131859535&tb_oid=07-03-2013&tb_mrud=07-03-2013

SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={F9B6455A-2302-4BBE-A1FC-BDA72F3C89BC}&mid=8a2383b5b3244956a5f87691a63c70b2-7136129bcf6b9104cbd87ddb8225dadfc1435089&lang=de&ds=hk011&pr=sa&d=2012-07-12 15:13:43&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=119747&tt=gc_&babsrc=SP_ss&mntrId=088090004E29D055

SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF

SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={F9B6455A-2302-4BBE-A1FC-BDA72F3C89BC}&mid=8a2383b5b3244956a5f87691a63c70b2-7136129bcf6b9104cbd87ddb8225dadfc1435089&lang=de&ds=hk011&pr=sa&d=2012-07-12 15:13:43&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}

SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF

SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}

SearchScopes: HKCU - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20130307131859535&tb_oid=07-03-2013&tb_mrud=07-03-2013

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)

BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.4.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)

BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.4.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.4.0\ViProtocol.dll (AVG Secure Search)

ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2010-10-22] (EasyBits Software Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()

FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.4.0\\npsitesafety.dll (AVG Technologies)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Leonie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml

FF Extension: No Name - C:\Users\Leonie\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\

FF Extension: Symantec IPS - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2

FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox

FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox

FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\

FF Extension: No Name - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\

FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\

FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\

FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] C:\ProgramData\AVG Secure Search\FireFoxExt\15.4.0.5

FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\15.4.0.5
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR Extension: (DealPly  Shopping  ) - C:\Users\Leonie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.0.0_0

CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\15.4.0.5\avg.crx
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)

R2 lxdi_device; C:\Windows\system32\lxdicoms.exe [876976 2007-03-06] ( )

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)

R2 TGCM_ImportWiFiSvc; C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201080 2011-06-14] (Telefónica)

R2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [1616048 2013-07-30] (AVG Secure Search)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-07-30] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-13] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-13] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [132656 2010-08-13] (Symantec Corporation)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [463408 2010-06-27] (Symantec Corporation)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [463408 2010-06-27] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS [117808 2010-08-13] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS [117808 2010-08-13] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS [1791536 2010-08-13] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS [1791536 2010-08-13] (Symantec Corporation)

S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-05-12] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-01 09:34 - 2013-08-01 09:34 - 00000000 ____D C:\FRST

2013-08-01 09:33 - 2013-08-01 09:33 - 01781589 _____ (Farbar) C:\Users\Leonie\Downloads\FRST64.exe

2013-07-31 23:29 - 2013-07-31 23:36 - 00011826 _____ C:\Users\Leonie\Downloads\OTL.7z

2013-07-31 23:24 - 2013-07-31 23:24 - 01110476 _____ C:\Users\Leonie\Downloads\7z920.exe

2013-07-31 23:24 - 2013-07-31 23:24 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-07-31 23:14 - 2013-07-31 23:14 - 00001448 _____ C:\Users\Leonie\Downloads\Ereignisse.txt

2013-07-28 13:25 - 2013-07-28 13:25 - 00377856 _____ C:\Users\Leonie\Downloads\gmer_2.1.19163.exe

2013-07-28 13:15 - 2013-07-28 13:15 - 00097358 _____ C:\Users\Leonie\Downloads\Extras.Txt

2013-07-28 13:12 - 2013-07-28 13:12 - 00108072 _____ C:\Users\Leonie\Downloads\OTL.Txt

2013-07-28 12:47 - 2013-07-28 12:47 - 00602112 _____ (OldTimer Tools) C:\Users\Leonie\Downloads\OTL.exe

2013-07-28 12:45 - 2013-07-28 12:46 - 00000474 _____ C:\Users\Leonie\Downloads\defogger_disable.log

2013-07-28 12:45 - 2013-07-28 12:45 - 00050477 _____ C:\Users\Leonie\Downloads\Defogger.exe

2013-07-28 12:45 - 2013-07-28 12:45 - 00000000 _____ C:\Users\Leonie\defogger_reenable

2013-07-23 05:19 - 2013-07-23 05:19 - 00000000 ____D C:\Users\Leonie\AppData\Local\{3ABD061A-80D6-40C3-9F2E-887EBAE3D34E}

2013-07-11 06:53 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-11 06:53 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-11 06:53 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-11 06:53 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-11 06:53 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-11 06:53 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 06:41 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 06:41 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 06:41 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 06:41 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 06:41 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 06:40 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 06:40 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-03 11:01 - 2013-07-03 14:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
 

==================== One Month Modified Files and Folders =======
 

2013-08-01 09:33 - 2013-08-01 09:33 - 01781589 _____ (Farbar) C:\Users\Leonie\Downloads\FRST64.exe

2013-08-01 09:10 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-01 09:10 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-01 09:06 - 2011-02-10 01:44 - 01151724 _____ C:\Windows\WindowsUpdate.log

2013-08-01 09:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing

2013-08-01 09:02 - 2013-06-08 06:29 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job

2013-08-01 09:02 - 2013-06-03 15:55 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job

2013-08-01 09:02 - 2013-04-03 01:35 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-08-01 09:02 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-01 09:02 - 2009-07-14 06:51 - 00310680 _____ C:\Windows\setupact.log

2013-08-01 07:39 - 2012-10-28 01:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-31 23:44 - 2011-05-11 08:35 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{42BF9262-E7A9-407C-911C-24AC5E56FE86}

2013-07-31 23:36 - 2013-07-31 23:29 - 00011826 _____ C:\Users\Leonie\Downloads\OTL.7z

2013-07-31 23:28 - 2013-01-13 18:20 - 00000932 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001UA.job

2013-07-31 23:24 - 2013-07-31 23:24 - 01110476 _____ C:\Users\Leonie\Downloads\7z920.exe

2013-07-31 23:24 - 2013-07-31 23:24 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-07-31 23:14 - 2013-07-31 23:14 - 00001448 _____ C:\Users\Leonie\Downloads\Ereignisse.txt

2013-07-31 11:51 - 2011-05-08 10:41 - 00000000 ____D C:\ProgramData\Lx_cats

2013-07-31 09:23 - 2011-04-28 20:22 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForLEONIE-HP$

2013-07-31 09:23 - 2011-04-28 20:22 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForLEONIE-HP$.job

2013-07-30 07:46 - 2012-09-04 12:32 - 00045856 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys

2013-07-30 07:46 - 2012-07-12 15:13 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search

2013-07-29 17:28 - 2013-01-13 18:20 - 00000910 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001Core.job

2013-07-28 13:51 - 2011-05-08 10:42 - 00000000 ____D C:\Users\Leonie\AppData\Local\CrashDumps

2013-07-28 13:25 - 2013-07-28 13:25 - 00377856 _____ C:\Users\Leonie\Downloads\gmer_2.1.19163.exe

2013-07-28 13:15 - 2013-07-28 13:15 - 00097358 _____ C:\Users\Leonie\Downloads\Extras.Txt

2013-07-28 13:12 - 2013-07-28 13:12 - 00108072 _____ C:\Users\Leonie\Downloads\OTL.Txt

2013-07-28 12:47 - 2013-07-28 12:47 - 00602112 _____ (OldTimer Tools) C:\Users\Leonie\Downloads\OTL.exe

2013-07-28 12:46 - 2013-07-28 12:45 - 00000474 _____ C:\Users\Leonie\Downloads\defogger_disable.log

2013-07-28 12:45 - 2013-07-28 12:45 - 00050477 _____ C:\Users\Leonie\Downloads\Defogger.exe

2013-07-28 12:45 - 2013-07-28 12:45 - 00000000 _____ C:\Users\Leonie\defogger_reenable

2013-07-28 12:45 - 2011-04-28 19:28 - 00000000 ____D C:\Users\Leonie

2013-07-28 00:24 - 2010-10-23 00:00 - 00697550 _____ C:\Windows\system32\perfh007.dat

2013-07-28 00:24 - 2010-10-23 00:00 - 00148556 _____ C:\Windows\system32\perfc007.dat

2013-07-28 00:24 - 2009-07-14 07:13 - 01614964 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-27 11:48 - 2012-03-31 11:50 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-07-27 11:48 - 2011-05-07 22:36 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-07-23 05:19 - 2013-07-23 05:19 - 00000000 ____D C:\Users\Leonie\AppData\Local\{3ABD061A-80D6-40C3-9F2E-887EBAE3D34E}

2013-07-22 10:46 - 2011-04-29 17:11 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\SoftGrid Client

2013-07-21 03:46 - 2010-10-23 01:20 - 00000000 ____D C:\ProgramData\Recovery

2013-07-19 18:27 - 2013-03-07 15:18 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Winamp

2013-07-19 17:28 - 2011-04-29 17:41 - 00000000 ___RD C:\Users\Leonie\Desktop\Sabine

2013-07-16 14:33 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-12 09:54 - 2012-12-30 17:08 - 00000000 ___RD C:\Users\Leonie\Desktop\Leonie 1

2013-07-11 08:34 - 2009-07-14 06:45 - 00286280 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-11 08:32 - 2013-03-13 09:32 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 08:32 - 2013-03-13 09:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 08:32 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 08:32 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-11 06:54 - 2011-05-09 07:41 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-03 17:05 - 2011-05-14 20:20 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForLeonie

2013-07-03 17:05 - 2011-05-14 20:20 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForLeonie.job

2013-07-03 16:23 - 2012-04-27 07:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-03 14:36 - 2013-07-03 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-29 10:02
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-07-2013 03

Ran by Leonie at 2013-08-01 09:34:44

Running from C:\Users\Leonie\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

7-Zip 9.20 (x32)

ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.1990.41618)

Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)

Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)

Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)

Adobe Shockwave Player 11.5 (x32 Version: 11.5.8.612)

Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)

Apple Application Support (x32 Version: 2.1.7)

Apple Software Update (x32 Version: 2.1.3.127)

ATI Catalyst Install Manager (Version: 3.0.790.0)

AVG Security Toolbar (x32 Version: 15.4.0.5)

Avira Free Antivirus (x32 Version: 12.1.9.2400)

Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)

Bing Bar (x32 Version: 6.0.2282.0)

Bing Bar Platform (x32 Version: 6.0.2282.0)

Blasterball 3 (x32 Version: 2.2.0.95)

Bounce Symphony (x32 Version: 2.2.0.95)

Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95)

Cake Mania (x32 Version: 2.2.0.95)

Catalyst Control Center - Branding (x32 Version: 1.00.0000)

Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0909.1412.23625)

Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0909.1412.23625)

Catalyst Control Center InstallProxy (x32 Version: 2010.0909.1412.23625)

Catalyst Control Center Localization All (x32 Version: 2010.0909.1412.23625)

CCC Help Chinese Standard (x32 Version: 2010.0909.1411.23625)

CCC Help Chinese Traditional (x32 Version: 2010.0909.1411.23625)

CCC Help Czech (x32 Version: 2010.0909.1411.23625)

CCC Help Danish (x32 Version: 2010.0909.1411.23625)

CCC Help Dutch (x32 Version: 2010.0909.1411.23625)

CCC Help English (x32 Version: 2010.0909.1411.23625)

CCC Help Finnish (x32 Version: 2010.0909.1411.23625)

CCC Help French (x32 Version: 2010.0909.1411.23625)

CCC Help German (x32 Version: 2010.0909.1411.23625)

CCC Help Greek (x32 Version: 2010.0909.1411.23625)

CCC Help Hungarian (x32 Version: 2010.0909.1411.23625)

CCC Help Italian (x32 Version: 2010.0909.1411.23625)

CCC Help Japanese (x32 Version: 2010.0909.1411.23625)

CCC Help Korean (x32 Version: 2010.0909.1411.23625)

CCC Help Norwegian (x32 Version: 2010.0909.1411.23625)

CCC Help Polish (x32 Version: 2010.0909.1411.23625)

CCC Help Portuguese (x32 Version: 2010.0909.1411.23625)

CCC Help Russian (x32 Version: 2010.0909.1411.23625)

CCC Help Spanish (x32 Version: 2010.0909.1411.23625)

CCC Help Swedish (x32 Version: 2010.0909.1411.23625)

CCC Help Thai (x32 Version: 2010.0909.1411.23625)

CCC Help Turkish (x32 Version: 2010.0909.1411.23625)

ccc-core-static (x32 Version: 2010.0909.1412.23625)

ccc-utility64 (Version: 2010.0909.1412.23625)

Chuzzle Deluxe (x32 Version: 2.2.0.95)

CyberLink DVD Suite (x32 Version: 7.0.3320)

CyberLink PowerDVD 9 (x32 Version: 9.0.1.4604)

CyberLink YouCam (x32 Version: 3.2.3321)

D3DX10 (x32 Version: 15.4.2368.0902)

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)

dm-Fotowelt (x32 Version: 5.0.1)

DomaIQ (x32)

Download Updater (AOL LLC) (x32)

ElsterFormular (x32 Version: 14.0.0.10960)

Energy Star Digital Logo (x32 Version: 1.0.1)

ESU for Microsoft Windows 7 (x32 Version: 1.0.0)

Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)

Farm Frenzy (x32 Version: 2.2.0.95)

FATE (x32 Version: 2.2.0.95)

fotokasten comfort 5.0 (x32)

Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)

HP Auto (Version: 1.0.12494.3472)

HP Client Services (Version: 1.0.12656.3472)

HP CloudDrive (x32)

HP Customer Experience Enhancements (x32 Version: 6.0.1.7)

HP Documentation (x32 Version: 1.4.0.0)

HP Games (x32 Version: 1.0.2.5)

HP Power Manager (x32 Version: 1.1.2)

HP Quick Launch (x32 Version: 2.2.7)

HP Setup (x32 Version: 8.4.4400.3525)

HP Setup Manager (x32 Version: 1.0.12844.3519)

HP Software Framework (x32 Version: 4.0.70.1)

HP Support Assistant (x32 Version: 7.0.39.15)

HP Wireless Assistant (Version: 4.0.10.0)

HUAWEI DataCard Driver 4.20.12.00 (x32 Version: 4.20.12.00)

Insaniquarium Deluxe (x32 Version: 2.2.0.95)

Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)

Intel(R) Rapid Storage Technology (x32 Version: 9.6.2.1001)

Java Auto Updater (x32 Version: 2.0.2.4)

Java(TM) 6 Update 21 (64-bit) (Version: 6.0.210)

Java(TM) 6 Update 21 (x32 Version: 6.0.210)

Jewel Quest 3 (x32 Version: 2.2.0.95)

Jewel Quest II (x32 Version: 2.2.0.95)

Jewel Quest Solitaire (x32 Version: 2.2.0.95)

John Deere Drive Green (x32 Version: 2.2.0.95)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

LabelPrint (x32 Version: 2.5.3220)

Lexmark Fax-Lösungen

LightScribe System Software (x32 Version: 1.18.18.1)

Magic Desktop (x32 Version: 3.0)

mark 3500-4500 Series

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Default Manager (x32 Version: 2.2.114.0)

Microsoft Office 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)

Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000)

Microsoft PowerPoint Viewer (x32 Version: 14.0.6029.1000)

Microsoft Search Enhancement Pack (x32 Version: 3.0.131.0)

Microsoft Silverlight (Version: 5.1.20513.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft SQL Server Compact 3.5 SP1 English (x32 Version: 3.5.5692.0)

Microsoft SQL Server Compact 3.5 SP1 x64 English (Version: 3.5.5692.0)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mobile Connection Manager (x32 Version: 8.7.6.756)

Mobile Partner (x32 Version: 16.002.03.01.40)

Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)

Mozilla Maintenance Service (x32 Version: 22.0)

Mozilla Thunderbird 17.0.7 (x86 de) (x32 Version: 17.0.7)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MusicStation (x32 Version: 2.0.5.71)

Norton Internet Security (x32 Version: 18.7.2.3)

Penguins! (x32 Version: 2.2.0.95)

PhotoNow! (x32 Version: 1.1.7717)

PictureMover (x32 Version: 3.5.0.33)

Plants vs. Zombies (x32 Version: 2.2.0.95)

Polar Bowler (x32 Version: 2.2.0.95)

Power2Go (x32 Version: 6.1.4419)

PowerDirector (x32 Version: 8.0.3320)

QuickTime (x32 Version: 7.72.80.56)

Ralink RT5390 802.11b/g/n WiFi Adapter (x32 Version: 3.1.11.0)

Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.18.322.2010)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6206)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30120)

Recovery Manager (x32 Version: 5.5.3223)

RtVOsd (Version: 1.0.6)

Skype™ 6.5 (x32 Version: 6.5.158)

Slingo Deluxe (x32 Version: 2.2.0.95)

Synaptics Pointing Device Driver (Version: 15.1.6.64)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)

Update Installer for WildTangent Games App (x32)

Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)

Wedding Dash (x32 Version: 2.2.0.95)

WildTangent Games App (HP Games) (x32 Version: 4.0.5.14)

Winamp (x32 Version: 5.601 )

Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3555.0308)

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3555.0308)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Messenger (x32 Version: 15.4.3538.0513)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

Windows Mobile-Gerätecenter (Version: 6.1.6965.0)

WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)

Zuma Deluxe (x32 Version: 2.2.0.95)
 

==================== Restore Points  =========================
 

19-06-2013 04:57:32 Windows Update

26-06-2013 03:27:40 Windows Update

29-06-2013 04:28:07 Windows Update

03-07-2013 08:16:56 Windows Update

11-07-2013 04:34:00 Windows Update

11-07-2013 04:44:15 Windows Update

17-07-2013 06:07:03 Windows Update

26-07-2013 16:45:15 Windows Update

30-07-2013 05:50:56 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00D0673A-366B-46CA-8108-83D53B890D2F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-09-29] (CyberLink)

Task: {066B9485-EDAF-4420-B521-0ED5352B9284} - System32\Tasks\DealPlyUpdate => C:\Program No File

Task: {1D61D78E-3C16-4546-ABFA-687E727137F1} - System32\Tasks\HPCeeScheduleForLeonie => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)

Task: {3ECA5C86-8309-4276-B836-281C4C7D105F} - System32\Tasks\{02F336DA-EB4F-4287-B642-030745E79AC0} => c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03] (Mozilla Corporation)

Task: {4ADBAECC-604A-452A-AFDF-A9AE72329F03} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: {6D1D4867-13C6-458D-B0EE-9F3A13E9607D} - System32\Tasks\{811E42CE-BEA6-4280-80B9-F5B507E4103B} => c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03] (Mozilla Corporation)

Task: {7B141363-A360-4829-A4A0-AE471E897284} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {962092CC-E27C-4205-ABBB-8379B7C4E570} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{AD5C4D10-4FA6-4B3E-AD66-B44996E250BF}.exe No File

Task: {9CCFD9B2-DB1F-4B60-98A5-237BEC62678C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)

Task: {9F325E12-B9A2-4770-83A8-D54C5EB95E2D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {9F54A611-B89E-4949-A974-0AF4FBCA4767} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)

Task: {9FC9352D-F369-4599-96B8-22F4A3897F75} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)

Task: {A0A5AB35-C216-4DB3-921A-660C7AAF8871} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001Core => C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-13] (Facebook Inc.)

Task: {A32CCA5B-1298-49C5-A51E-D29C220E7CE6} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{421F2D7F-5CD3-4BF9-8479-AB40C3AEFBB1}.exe No File

Task: {AA914BE8-44F7-4A64-8F50-F40B5B22670A} - System32\Tasks\{782D4C8D-59F8-4AC6-B4C5-0CB432EBDF0A} => C:\Users\Leonie\Winamp\winamp.exe No File

Task: {AC07F314-A0FD-45DB-A35E-36F40DE4C566} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-07-23] (Microsoft)

Task: {B1401A63-3A9A-4DE4-8AD8-76AC5B14A892} - System32\Tasks\{623D7CA4-F49D-4F13-AED1-7E9B92B30FC6} => C:\Users\Leonie\Winamp\winamp.exe No File

Task: {B88279D0-D023-4893-AB69-BEA0069BA4DA} - System32\Tasks\User_Feed_Synchronization-{42BF9262-E7A9-407C-911C-24AC5E56FE86} => C:\Windows\system32\msfeedssync.exe [2013-05-29] (Microsoft Corporation)

Task: {BAC0ED27-19DA-4EDD-A156-46A077501356} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001UA => C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-13] (Facebook Inc.)

Task: {CBD99457-8C6F-42AF-A815-03C32B593A33} - System32\Tasks\{14ECA4DE-BA60-46F2-98D8-8E3BB9569D15} => C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)

Task: {D012763D-27E3-4E35-92A5-21A90DB42973} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)

Task: {D0B2622A-C4FD-4FE0-B4AB-B4C84291C9E9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-07-16] (Hewlett-Packard)

Task: {DBBA136B-A394-4395-94E1-77FAA4A6CD8D} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {E0DDF889-9363-4959-95BA-D7C53E11835E} - System32\Tasks\HPCeeScheduleForLEONIE-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)

Task: {F2DC074B-AFC0-4371-A354-044A3BC6985A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{AD5C4D10-4FA6-4B3E-AD66-B44996E250BF}.exe

Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{421F2D7F-5CD3-4BF9-8479-AB40C3AEFBB1}.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001Core.job => C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001UA.job => C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\HPCeeScheduleForLEONIE-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\Windows\Tasks\HPCeeScheduleForLeonie.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/31/2013 11:21:20 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b

Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00173668

ID des fehlerhaften Prozesses: 0x298

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3
 

Error: (07/28/2013 01:49:14 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Name des fehlerhaften Moduls: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000218a

ID des fehlerhaften Prozesses: 0xd74

Startzeit der fehlerhaften Anwendung: 0xgmer_2.1.19163.exe0

Pfad der fehlerhaften Anwendung: gmer_2.1.19163.exe1

Pfad des fehlerhaften Moduls: gmer_2.1.19163.exe2

Berichtskennung: gmer_2.1.19163.exe3
 

Error: (07/28/2013 01:41:08 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Name des fehlerhaften Moduls: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000218a

ID des fehlerhaften Prozesses: 0x26c

Startzeit der fehlerhaften Anwendung: 0xgmer_2.1.19163.exe0

Pfad der fehlerhaften Anwendung: gmer_2.1.19163.exe1

Pfad des fehlerhaften Moduls: gmer_2.1.19163.exe2

Berichtskennung: gmer_2.1.19163.exe3
 

Error: (07/28/2013 01:22:58 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b

Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00173668

ID des fehlerhaften Prozesses: 0x19e8

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3
 

Error: (07/19/2013 09:02:05 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b

Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00173668

ID des fehlerhaften Prozesses: 0x2e8

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3
 

Error: (07/16/2013 01:53:44 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b

Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00173668

ID des fehlerhaften Prozesses: 0x11d0

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3
 

Error: (07/14/2013 09:27:10 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: HPMSGSVC.exe, Version: 2.2.6.0, Zeitstempel: 0x4ca1bd0f

Name des fehlerhaften Moduls: HPMSGSVC.exe, Version: 2.2.6.0, Zeitstempel: 0x4ca1bd0f

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00003b5f

ID des fehlerhaften Prozesses: 0xc74

Startzeit der fehlerhaften Anwendung: 0xHPMSGSVC.exe0

Pfad der fehlerhaften Anwendung: HPMSGSVC.exe1

Pfad des fehlerhaften Moduls: HPMSGSVC.exe2

Berichtskennung: HPMSGSVC.exe3
 

Error: (07/12/2013 11:49:43 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b

Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00173668

ID des fehlerhaften Prozesses: 0x618

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3
 

Error: (07/10/2013 08:16:50 PM) (Source: CVHSVC) (User: )

Description: Nur zur Information.

(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.
 

Error: (07/08/2013 08:31:32 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b

Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00173668

ID des fehlerhaften Prozesses: 0xb6c

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3
 
 

System errors:

=============

Error: (08/01/2013 07:38:46 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎01.‎08.‎2013 um 00:32:46 unerwartet heruntergefahren.
 

Error: (08/01/2013 00:19:51 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎01.‎08.‎2013 um 00:13:25 unerwartet heruntergefahren.
 

Error: (07/31/2013 08:43:39 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎31.‎07.‎2013 um 17:10:26 unerwartet heruntergefahren.
 

Error: (07/31/2013 11:16:15 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎31.‎07.‎2013 um 11:02:06 unerwartet heruntergefahren.
 

Error: (07/31/2013 08:14:33 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎31.‎07.‎2013 um 00:39:08 unerwartet heruntergefahren.
 

Error: (07/30/2013 11:33:08 PM) (Source: Microsoft-Windows-Kernel-Power) (User: NT-AUTORITÄT)

Description: Das System ist aufgrund eines kritischen thermischen Ereignisses in den Ruhezustand gewechselt.

Zeit für den Ruhezustand = 2013-07-30T21:33:08.053117200Z

            

ACPI-Thermozone = ACPI\ThermalZone\TZ01

            

_HOT = 383K
 

Error: (07/30/2013 11:33:08 PM) (Source: Microsoft-Windows-Kernel-Power) (User: NT-AUTORITÄT)

Description: Das System ist aufgrund eines kritischen thermischen Ereignisses in den Ruhezustand gewechselt.

Zeit für den Ruhezustand = 2013-07-30T21:33:08.029115900Z

            

ACPI-Thermozone = ACPI\ThermalZone\TZ01

            

_HOT = 383K
 

Error: (07/30/2013 11:19:30 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎30.‎07.‎2013 um 23:18:27 unerwartet heruntergefahren.
 

Error: (07/30/2013 10:59:34 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎30.‎07.‎2013 um 22:43:31 unerwartet heruntergefahren.
 

Error: (07/29/2013 11:17:14 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎29.‎07.‎2013 um 22:50:57 unerwartet heruntergefahren.
 
 

Microsoft Office Sessions:

=========================

Error: (07/31/2013 11:21:20 AM) (Source: Application Error)(User: )

Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc00000050017366829801ce8dceee86d734C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll8ef4668a-f9c2-11e2-a85b-984be18dc335
 

Error: (07/28/2013 01:49:14 PM) (Source: Application Error)(User: )

Description: gmer_2.1.19163.exe2.1.19163.0515d31f0gmer_2.1.19163.exe2.1.19163.0515d31f0c00000050000218ad7401ce8b87cb733d70C:\Users\Leonie\Downloads\gmer_2.1.19163.exeC:\Users\Leonie\Downloads\gmer_2.1.19163.exeb938dafb-f77b-11e2-af71-984be18dc335
 

Error: (07/28/2013 01:41:08 PM) (Source: Application Error)(User: )

Description: gmer_2.1.19163.exe2.1.19163.0515d31f0gmer_2.1.19163.exe2.1.19163.0515d31f0c00000050000218a26c01ce8b85ee561861C:\Users\Leonie\Downloads\gmer_2.1.19163.exeC:\Users\Leonie\Downloads\gmer_2.1.19163.exe9786bcdc-f77a-11e2-af71-984be18dc335
 

Error: (07/28/2013 01:22:58 PM) (Source: Application Error)(User: )

Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc00000050017366819e801ce8b84bedf0c22C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll0dad187a-f778-11e2-af71-984be18dc335
 

Error: (07/19/2013 09:02:05 AM) (Source: Application Error)(User: )

Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc0000005001736682e801ce844828265f36C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll1df19c4e-f041-11e2-9d7a-984be18dc335
 

Error: (07/16/2013 01:53:44 PM) (Source: Application Error)(User: )

Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc00000050017366811d001ce821a9b5ab892C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll5d58f1c2-ee0e-11e2-b730-984be18dc335
 

Error: (07/14/2013 09:27:10 AM) (Source: Application Error)(User: )

Description: HPMSGSVC.exe2.2.6.04ca1bd0fHPMSGSVC.exe2.2.6.04ca1bd0fc000000500003b5fc7401ce80637e154860C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exeC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.execb3f39ab-ec56-11e2-9a33-984be18dc335
 

Error: (07/12/2013 11:49:43 AM) (Source: Application Error)(User: )

Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc00000050017366861801ce7ed53ad03fadC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll603b759e-ead8-11e2-8693-984be18dc335
 

Error: (07/10/2013 08:16:50 PM) (Source: CVHSVC)(User: )

Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.
 

Error: (07/08/2013 08:31:32 AM) (Source: Application Error)(User: )

Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668b6c01ce7ba45837d329C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll07488bba-e798-11e2-a497-984be18dc335
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 41%

Total physical RAM: 3957.86 MB

Available physical RAM: 2306.46 MB

Total Pagefile: 7913.9 MB

Available Pagefile: 5763.57 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:447.09 GB) (Free:378.43 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

Drive d: (RECOVERY) (Fixed) (Total:18.38 GB) (Free:2.66 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: F01D32BD)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=447 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
 

==================== End Of Log ============================

LG
sk_muecke

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo,

Code:

ComboFix 13-07-31.02 - Leonie 01.08.2013  17:11:45.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3958.2296 [GMT 2:00]

ausgeführt von:: c:\users\Leonie\Downloads\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\DealPly

c:\program files (x86)\DealPly\DealPly.crx

c:\program files (x86)\DealPly\DealPly.xpi

c:\program files (x86)\DealPly\DealPlyIE64.dll

c:\program files (x86)\DealPly\DealPlyUpdate.exe

c:\program files (x86)\DealPly\DealPlyUpdateRun.exe

c:\program files (x86)\DealPly\DealPlyUpdateVer.exe

c:\program files (x86)\DealPly\icon.ico

c:\program files (x86)\DealPly\uninst.exe

c:\programdata\SPL9ED1.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-01 bis 2013-08-01  ))))))))))))))))))))))))))))))

.

.

2013-08-01 15:44 . 2013-08-01 15:44        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-01 15:13 . 2013-08-01 15:13        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{73D802AD-906F-4830-86D9-0C72DD42337C}\offreg.dll

2013-08-01 07:34 . 2013-08-01 07:34        --------        d-----w-        C:\FRST

2013-07-31 21:24 . 2013-07-31 21:24        --------        d-----w-        c:\program files (x86)\7-Zip

2013-07-30 05:51 . 2013-07-02 08:34        9460976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{73D802AD-906F-4830-86D9-0C72DD42337C}\mpengine.dll

2013-07-11 04:41 . 2013-05-27 05:50        1011712        ----a-w-        c:\program files\Windows Defender\MpSvc.dll

2013-07-11 04:40 . 2013-04-09 23:34        1247744        ----a-w-        c:\windows\SysWow64\DWrite.dll

2013-07-11 04:40 . 2013-04-02 22:51        1643520        ----a-w-        c:\windows\system32\DWrite.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-30 05:46 . 2012-09-04 10:32        45856        ----a-w-        c:\windows\system32\drivers\avgtpx64.sys

2013-07-11 04:54 . 2011-05-09 05:41        78185248        ----a-w-        c:\windows\system32\MRT.exe

2013-06-12 18:39 . 2012-10-27 23:24        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-06-12 18:39 . 2012-10-27 23:22        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-29 19:24 . 2013-05-29 19:24        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-05-29 19:24 . 2013-05-29 19:24        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-05-29 19:24 . 2013-05-29 19:24        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-05-29 19:24 . 2013-05-29 19:24        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-05-29 19:24 . 2013-05-29 19:24        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-05-29 19:24 . 2013-05-29 19:24        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-05-29 19:24 . 2013-05-29 19:24        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-05-29 19:24 . 2013-05-29 19:24        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-05-29 19:24 . 2013-05-29 19:24        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-05-29 19:24 . 2013-05-29 19:24        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-05-29 19:24 . 2013-05-29 19:24        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-05-29 19:24 . 2013-05-29 19:24        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-05-29 19:24 . 2013-05-29 19:24        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-05-29 19:24 . 2013-05-29 19:24        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-05-29 19:24 . 2013-05-29 19:24        441856        ----a-w-        c:\windows\system32\html.iec

2013-05-29 19:24 . 2013-05-29 19:24        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-05-29 19:24 . 2013-05-29 19:24        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-05-29 19:24 . 2013-05-29 19:24        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-05-29 19:24 . 2013-05-29 19:24        235008        ----a-w-        c:\windows\system32\url.dll

2013-05-29 19:24 . 2013-05-29 19:24        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-05-29 19:24 . 2013-05-29 19:24        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-05-29 19:24 . 2013-05-29 19:24        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-05-29 19:24 . 2013-05-29 19:24        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-05-29 19:24 . 2013-05-29 19:24        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-05-29 19:24 . 2013-05-29 19:24        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-05-29 19:24 . 2013-05-29 19:24        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-05-29 19:24 . 2013-05-29 19:24        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-05-29 19:24 . 2013-05-29 19:24        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-05-29 19:24 . 2013-05-29 19:24        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-05-29 19:24 . 2013-05-29 19:24        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-05-29 19:24 . 2013-05-29 19:24        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-05-29 19:24 . 2013-05-29 19:24        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-05-29 19:24 . 2013-05-29 19:24        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-05-29 19:24 . 2013-05-29 19:24        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-05-29 19:24 . 2013-05-29 19:24        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-05-29 19:24 . 2013-05-29 19:24        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-05-29 19:24 . 2013-05-29 19:24        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-05-29 19:24 . 2013-05-29 19:24        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-05-29 19:24 . 2013-05-29 19:24        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-05-29 19:24 . 2013-05-29 19:24        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-05-29 19:24 . 2013-05-29 19:24        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-05-29 19:24 . 2013-05-29 19:24        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-05-29 19:24 . 2013-05-29 19:24        149504        ----a-w-        c:\windows\system32\occache.dll

2013-05-29 19:24 . 2013-05-29 19:24        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-05-29 19:24 . 2013-05-29 19:24        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-05-29 19:24 . 2013-05-29 19:24        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-05-29 19:24 . 2013-05-29 19:24        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-05-29 19:24 . 2013-05-29 19:24        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-05-29 19:24 . 2013-05-29 19:24        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-05-13 05:51 . 2013-06-12 05:03        184320        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-05-13 05:51 . 2013-06-12 05:03        1464320        ----a-w-        c:\windows\system32\crypt32.dll

2013-05-13 05:51 . 2013-06-12 05:03        139776        ----a-w-        c:\windows\system32\cryptnet.dll

2013-05-13 05:50 . 2013-06-12 05:03        52224        ----a-w-        c:\windows\system32\certenc.dll

2013-05-13 04:45 . 2013-06-12 05:03        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2013-05-13 04:45 . 2013-06-12 05:03        1160192        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-05-13 04:45 . 2013-06-12 05:03        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

2013-05-13 03:43 . 2013-06-12 05:03        1192448        ----a-w-        c:\windows\system32\certutil.exe

2013-05-13 03:08 . 2013-06-12 05:03        903168        ----a-w-        c:\windows\SysWow64\certutil.exe

2013-05-13 03:08 . 2013-06-12 05:03        43008        ----a-w-        c:\windows\SysWow64\certenc.dll

2013-05-10 05:49 . 2013-06-12 05:04        30720        ----a-w-        c:\windows\system32\cryptdlg.dll

2013-05-10 03:20 . 2013-06-12 05:04        24576        ----a-w-        c:\windows\SysWow64\cryptdlg.dll

2013-05-08 06:39 . 2013-06-12 05:04        1910632        ----a-w-        c:\windows\system32\drivers\tcpip.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2013-07-30 05:46        3086512        ----a-w-        c:\program files (x86)\AVG Secure Search\15.4.0.5\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\15.4.0.5\AVG Secure Search_toolbar.dll" [2013-07-30 3086512]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]

"Facebook Update"="c:\users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2013-01-13 138096]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-28 584760]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-08-30 61112]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"FaxCenterServer"="c:\program files (x86)\Lexmark Fax Solutions\fm3032.exe" [2007-03-06 312240]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2013-07-30 2285232]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]

"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2010-12-06 74752]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe -det [2010-9-28 1040952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1207020.003\SYMDS64.SYS [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1207020.003\SYMEFA64.SYS [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [x]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [x]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1207020.003\Ironx64.SYS [x]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1207020.003\SYMNETS.SYS [x]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]

S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]

S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]

S2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe;c:\windows\SYSNATIVE\lxdicoms.exe [x]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [x]

S2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

S2 TGCM_ImportWiFiSvc;TGCM_ImportWiFiSvc;c:\program files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe;c:\program files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe [x]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [x]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]

S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2010-08-16 12:43        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-08-01 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-27 18:39]

.

2013-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001Core.job

- c:\users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-13 16:23]

.

2013-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001UA.job

- c:\users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-13 16:23]

.

2013-07-31 c:\windows\Tasks\HPCeeScheduleForLEONIE-HP$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]

.

2013-07-03 c:\windows\Tasks\HPCeeScheduleForLeonie.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]

@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"

[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]

2010-09-23 04:53        2210304        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]

@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"

[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]

2010-09-23 04:53        2210304        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]

@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"

[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]

2010-09-23 04:53        2210304        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]

@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"

[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]

2010-09-23 04:53        2210304        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]

@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"

[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]

2010-09-23 04:53        2210304        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-09-22 6489704]

"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]

"lxdimon.exe"="c:\program files (x86)\Lexmark 3500-4500 Series\lxdimon.exe" [2007-03-06 435120]

"lxdiamon"="c:\program files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-03-05 20480]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"LXDICATS"="c:\windows\system32\spool\DRIVERS\x64\3\LXDItime.dll" [2007-02-26 31232]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.delta-search.com/?affID=119747&tt=gc_&babsrc=HP_ss&mntrId=088090004E29D055

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.1.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.4.0\ViProtocol.dll

FF - ProfilePath - c:\users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\

FF - user.js: extensions.autoDisableScopes - 0 

FF - user.js: extensions.shownSelectionUI - true

FF - user.js: extensions.delta.tlbrSrchUrl - 

FF - user.js: extensions.delta.id - 08807b4700000000000090004e29d055

FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

FF - user.js: extensions.delta.instlDay - 15855

FF - user.js: extensions.delta.vrsn - 1.8.21.5

FF - user.js: extensions.delta.vrsni - 1.8.21.5

FF - user.js: extensions.delta.vrsnTs - 1.8.21.516:53

FF - user.js: extensions.delta.prtnrId - delta

FF - user.js: extensions.delta.prdct - delta

FF - user.js: extensions.delta.aflt - babsst

FF - user.js: extensions.delta.smplGrp - none

FF - user.js: extensions.delta.tlbrId - base

FF - user.js: extensions.delta.instlRef - sst

FF - user.js: extensions.delta.dfltLng - en

FF - user.js: extensions.delta.excTlbr - false

FF - user.js: extensions.delta.ffxUnstlRst - true

FF - user.js: extensions.delta.admin - false

FF - user.js: extensions.delta_i.babTrack - affID=119747&tt=gc_

FF - user.js: extensions.delta_i.babExt - 

FF - user.js: extensions.delta_i.srcExt - ss

FF - user.js: extensions.delta.autoRvrt - false

FF - user.js: extensions.delta.rvrt - false

FF - user.js: extensions.delta.newTab - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe

AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\diMaster.dll\" /prefetch:1"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-08-01  18:55:13

ComboFix-quarantined-files.txt  2013-08-01 16:54

.

Vor Suchlauf: 9 Verzeichnis(se), 406.000.828.416 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 408.337.108.992 Bytes frei

.

- - End Of File - - 054A080A68097B78E20F3162928DFFE9

D41D8CD98F00B204E9800998ECF8427E

Viele Grüße
sk_muecke

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

und ein frisches FRST log bitte.

hallo schrauber,

möchte zwischendurch mal danke sagen, das du dich so schnell und intensiv um unser Problem kümmerst.

Habe das Programm Malwarebytes Anti-Malware, da du nichts weiter dazugeschrieben hast, mit einem Quick-Scan durchgeführt. Ich hoffe das war richtig so?

Code:

# AdwCleaner v2.306 - Datei am 02/08/2013 um 17:03:40 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Leonie - LEONIE-HP

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Leonie\Downloads\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

Datei Gelöscht : C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\searchplugins\Babylon.xml

Datei Gelöscht : C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\searchplugins\delta.xml

Gelöscht mit Neustart : C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gelöscht : C:\Program Files (x86)\AVG Secure Search

Ordner Gelöscht : C:\Program Files (x86)\Common Files\Software Update Utility

Ordner Gelöscht : C:\Program Files (x86)\optimizer pro

Ordner Gelöscht : C:\Program Files\DomaIQ Uninstaller

Ordner Gelöscht : C:\ProgramData\AVG Secure Search

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\Users\Leonie\AppData\Local\AVG Secure Search

Ordner Gelöscht : C:\Users\Leonie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn

Ordner Gelöscht : C:\Users\Leonie\AppData\LocalLow\AVG Secure Search

Ordner Gelöscht : C:\Users\Leonie\AppData\LocalLow\delta

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\DealPly

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\extensions\addon@dealplyshopping.com

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\WinampToolbarData

Ordner Gelöscht : C:\Users\Leonie\AppData\Roaming\OpenCandy
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AutoLyrics

Schlüssel Gelöscht : HKCU\Software\AVG Secure Search

Schlüssel Gelöscht : HKCU\Software\BabSolution

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\DealPly

Schlüssel Gelöscht : HKCU\Software\delta LTD

Schlüssel Gelöscht : HKCU\Software\IGearSettings

Schlüssel Gelöscht : HKCU\Software\Iminent

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}

Schlüssel Gelöscht : HKLM\Software\AVG Secure Search

Schlüssel Gelöscht : HKLM\Software\AVG Security Toolbar

Schlüssel Gelöscht : HKLM\Software\Babylon

Schlüssel Gelöscht : HKLM\Software\BabylonToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKLM\Software\DealPly

Schlüssel Gelöscht : HKLM\Software\Iminent

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5bed6d9b36ee846

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DomaIQ Uninstaller

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16635
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.delta-search.com/?affID=119747&tt=gc_&babsrc=HP_ss&mntrId=088090004E29D055 --> hxxp://www.google.com

Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://www1.delta-search.com/?affID=120519&tt=220413_d9116&babsrc=NT_ss&mntrId=088090004E29D055 --> hxxp://www.google.com
 

-\\ Mozilla Firefox v22.0 (de)
 

Datei : C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\prefs.js
 

C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default-1358094571255\user.js ... Gelöscht !
 

Gelöscht : user_pref("extensions.delta.admin", false);

Gelöscht : user_pref("extensions.delta.aflt", "babsst");

Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

Gelöscht : user_pref("extensions.delta.autoRvrt", "false");

Gelöscht : user_pref("extensions.delta.bbDpng", "30");

Gelöscht : user_pref("extensions.delta.cntry", "DE");

Gelöscht : user_pref("extensions.delta.dfltLng", "en");

Gelöscht : user_pref("extensions.delta.excTlbr", false);

Gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);

Gelöscht : user_pref("extensions.delta.hdrMd5", "9B8ED9F4D0160D88EF6D108FB228D3A1");

Gelöscht : user_pref("extensions.delta.id", "08807b4700000000000090004e29d055");

Gelöscht : user_pref("extensions.delta.instlDay", "15855");

Gelöscht : user_pref("extensions.delta.instlRef", "sst");

Gelöscht : user_pref("extensions.delta.lastVrsnTs", "1.8.21.516:53:22");

Gelöscht : user_pref("extensions.delta.newTab", false);

Gelöscht : user_pref("extensions.delta.prdct", "delta");

Gelöscht : user_pref("extensions.delta.prtnrId", "delta");

Gelöscht : user_pref("extensions.delta.rvrt", "false");

Gelöscht : user_pref("extensions.delta.sg", "azb");

Gelöscht : user_pref("extensions.delta.smplGrp", "none");

Gelöscht : user_pref("extensions.delta.tlbrId", "base");

Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");

Gelöscht : user_pref("extensions.delta.vrsn", "1.8.21.5");

Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.21.516:53:22");

Gelöscht : user_pref("extensions.delta.vrsni", "1.8.21.5");

Gelöscht : user_pref("extensions.delta_i.babExt", "");

Gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119747&tt=gc_");

Gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
 

*************************
 

AdwCleaner[S1].txt - [24913 octets] - [02/08/2013 17:03:40]
 

########## EOF - C:\AdwCleaner[S1].txt - [24974 octets] ##########

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.08.02.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16635

Leonie :: LEONIE-HP [Administrator]
 

Schutz: Aktiviert
 

02.08.2013 17:26:15

mbam-log-2013-08-02 (17-26-15).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 219262

Laufzeit: 5 Minute(n), 10 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03

Ran by Leonie (administrator) on 02-08-2013 17:35:06

Running from C:\Users\Leonie\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

( ) C:\Windows\system32\lxdicoms.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

() C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe

(Lexmark) C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Telefónica) C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2010-09-13] (Synaptics Incorporated)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2010-09-22] (Realtek Semiconductor)

HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)

HKLM\...\Run: [lxdimon.exe] - C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe [435120 2007-03-06] ()

HKLM\...\Run: [lxdiamon] - C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe [20480 2007-03-05] (Lexmark)

HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)

HKLM\...\Run: [LXDICATS] - rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXDItime.dll,RunDLLEntry [x]

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!

HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-08-16] (Hewlett-Packard Company)

HKCU\...\Run: [Facebook Update] - C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-01-13] (Facebook Inc.)

HKCU\...\Policies\system: [DisableLockWorkstation] 0

HKCU\...\Policies\system: [DisableChangePassword] 0

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [584760 2010-09-28] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2010-08-30] (EasyBits Software AS)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [FaxCenterServer] - C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe [312240 2007-03-06] ()

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)

HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-12-07] (Nullsoft, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk

ShortcutTarget: Snapfish PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)

BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2010-10-22] (EasyBits Software Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()

FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Leonie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Extension: No Name - C:\Users\Leonie\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\

FF Extension: Symantec IPS - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2

FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox

FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox

FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\

FF Extension: No Name - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\

FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\

FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)

R2 lxdi_device; C:\Windows\system32\lxdicoms.exe [876976 2007-03-06] ( )

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)

R2 TGCM_ImportWiFiSvc; C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201080 2011-06-14] (Telefónica)

S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-07-30] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-13] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-13] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [132656 2010-08-13] (Symantec Corporation)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [463408 2010-06-27] (Symantec Corporation)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [463408 2010-06-27] (Symantec Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS [117808 2010-08-13] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS [117808 2010-08-13] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS [1791536 2010-08-13] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS [1791536 2010-08-13] (Symantec Corporation)

S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-05-12] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-02 17:21 - 2013-08-02 17:21 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-02 17:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-02 17:13 - 2013-08-02 17:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Leonie\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-02 17:03 - 2013-08-02 17:04 - 00024908 _____ C:\AdwCleaner[S1].txt

2013-08-02 17:01 - 2013-08-02 17:01 - 00666633 _____ C:\Users\Leonie\Downloads\adwcleaner.exe

2013-08-01 19:23 - 2013-08-01 19:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-01 18:56 - 2013-08-01 18:56 - 00031869 _____ C:\ComboFix.txt

2013-08-01 17:09 - 2013-08-01 18:59 - 00000000 ____D C:\Qoobox

2013-08-01 17:09 - 2013-08-01 18:59 - 00000000 ____D C:\ComboFix

2013-08-01 17:09 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-01 17:09 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-01 17:09 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-01 17:08 - 2013-08-01 18:37 - 00000000 ____D C:\Windows\erdnt

2013-08-01 17:05 - 2013-08-01 17:05 - 05096636 ____R (Swearware) C:\Users\Leonie\Downloads\ComboFix.exe

2013-08-01 09:34 - 2013-08-01 09:35 - 00028100 _____ C:\Users\Leonie\Downloads\Addition.txt

2013-08-01 09:34 - 2013-08-01 09:34 - 00000000 ____D C:\FRST

2013-08-01 09:33 - 2013-08-01 09:33 - 01781589 _____ (Farbar) C:\Users\Leonie\Downloads\FRST64.exe

2013-07-31 23:29 - 2013-07-31 23:36 - 00011826 _____ C:\Users\Leonie\Downloads\OTL.7z

2013-07-31 23:24 - 2013-07-31 23:24 - 01110476 _____ C:\Users\Leonie\Downloads\7z920.exe

2013-07-31 23:24 - 2013-07-31 23:24 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-07-31 23:14 - 2013-07-31 23:14 - 00001448 _____ C:\Users\Leonie\Downloads\Ereignisse.txt

2013-07-28 13:25 - 2013-07-28 13:25 - 00377856 _____ C:\Users\Leonie\Downloads\gmer_2.1.19163.exe

2013-07-28 13:15 - 2013-07-28 13:15 - 00097358 _____ C:\Users\Leonie\Downloads\Extras.Txt

2013-07-28 13:12 - 2013-07-28 13:12 - 00108072 _____ C:\Users\Leonie\Downloads\OTL.Txt

2013-07-28 12:47 - 2013-07-28 12:47 - 00602112 _____ (OldTimer Tools) C:\Users\Leonie\Downloads\OTL.exe

2013-07-28 12:45 - 2013-07-28 12:46 - 00000474 _____ C:\Users\Leonie\Downloads\defogger_disable.log

2013-07-28 12:45 - 2013-07-28 12:45 - 00050477 _____ C:\Users\Leonie\Downloads\Defogger.exe

2013-07-28 12:45 - 2013-07-28 12:45 - 00000000 _____ C:\Users\Leonie\defogger_reenable

2013-07-23 05:19 - 2013-07-23 05:19 - 00000000 ____D C:\Users\Leonie\AppData\Local\{3ABD061A-80D6-40C3-9F2E-887EBAE3D34E}

2013-07-11 06:53 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-11 06:53 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-11 06:53 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-11 06:53 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-11 06:53 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-11 06:53 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 06:41 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 06:41 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 06:41 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 06:41 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 06:41 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 06:40 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 06:40 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-03 11:01 - 2013-07-03 14:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
 

==================== One Month Modified Files and Folders =======
 

2013-08-02 17:28 - 2013-01-13 18:20 - 00000932 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001UA.job

2013-08-02 17:28 - 2013-01-13 18:20 - 00000910 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001Core.job

2013-08-02 17:21 - 2013-08-02 17:21 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-02 17:16 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-02 17:16 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-02 17:13 - 2013-08-02 17:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Leonie\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-02 17:12 - 2011-02-10 01:44 - 01349594 _____ C:\Windows\WindowsUpdate.log

2013-08-02 17:08 - 2013-04-03 01:35 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-08-02 17:08 - 2011-05-08 10:41 - 00000000 ____D C:\ProgramData\Lx_cats

2013-08-02 17:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-02 17:08 - 2009-07-14 06:51 - 00311184 _____ C:\Windows\setupact.log

2013-08-02 17:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing

2013-08-02 17:05 - 2011-05-14 20:20 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForLeonie

2013-08-02 17:05 - 2011-05-14 20:20 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForLeonie.job

2013-08-02 17:04 - 2013-08-02 17:03 - 00024908 _____ C:\AdwCleaner[S1].txt

2013-08-02 17:03 - 2011-04-29 17:11 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\SoftGrid Client

2013-08-02 17:01 - 2013-08-02 17:01 - 00666633 _____ C:\Users\Leonie\Downloads\adwcleaner.exe

2013-08-02 16:39 - 2012-10-28 01:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-02 00:26 - 2011-05-11 08:35 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{42BF9262-E7A9-407C-911C-24AC5E56FE86}

2013-08-01 19:25 - 2013-08-01 19:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-01 19:22 - 2011-04-29 17:11 - 01592858 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-08-01 19:22 - 2010-10-23 00:00 - 00697550 _____ C:\Windows\system32\perfh007.dat

2013-08-01 19:22 - 2010-10-23 00:00 - 00148556 _____ C:\Windows\system32\perfc007.dat

2013-08-01 19:22 - 2009-07-14 07:13 - 01592858 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-01 19:07 - 2011-04-28 18:22 - 00036928 _____ C:\Windows\PFRO.log

2013-08-01 18:59 - 2013-08-01 17:09 - 00000000 ____D C:\Qoobox

2013-08-01 18:59 - 2013-08-01 17:09 - 00000000 ____D C:\ComboFix

2013-08-01 18:56 - 2013-08-01 18:56 - 00031869 _____ C:\ComboFix.txt

2013-08-01 18:37 - 2013-08-01 17:08 - 00000000 ____D C:\Windows\erdnt

2013-08-01 17:48 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2013-08-01 17:05 - 2013-08-01 17:05 - 05096636 ____R (Swearware) C:\Users\Leonie\Downloads\ComboFix.exe

2013-08-01 09:35 - 2013-08-01 09:34 - 00028100 _____ C:\Users\Leonie\Downloads\Addition.txt

2013-08-01 09:34 - 2013-08-01 09:34 - 00000000 ____D C:\FRST

2013-08-01 09:33 - 2013-08-01 09:33 - 01781589 _____ (Farbar) C:\Users\Leonie\Downloads\FRST64.exe

2013-07-31 23:36 - 2013-07-31 23:29 - 00011826 _____ C:\Users\Leonie\Downloads\OTL.7z

2013-07-31 23:24 - 2013-07-31 23:24 - 01110476 _____ C:\Users\Leonie\Downloads\7z920.exe

2013-07-31 23:24 - 2013-07-31 23:24 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-07-31 23:14 - 2013-07-31 23:14 - 00001448 _____ C:\Users\Leonie\Downloads\Ereignisse.txt

2013-07-31 09:23 - 2011-04-28 20:22 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForLEONIE-HP$

2013-07-31 09:23 - 2011-04-28 20:22 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForLEONIE-HP$.job

2013-07-30 07:46 - 2012-09-04 12:32 - 00045856 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys

2013-07-28 13:51 - 2011-05-08 10:42 - 00000000 ____D C:\Users\Leonie\AppData\Local\CrashDumps

2013-07-28 13:25 - 2013-07-28 13:25 - 00377856 _____ C:\Users\Leonie\Downloads\gmer_2.1.19163.exe

2013-07-28 13:15 - 2013-07-28 13:15 - 00097358 _____ C:\Users\Leonie\Downloads\Extras.Txt

2013-07-28 13:12 - 2013-07-28 13:12 - 00108072 _____ C:\Users\Leonie\Downloads\OTL.Txt

2013-07-28 12:47 - 2013-07-28 12:47 - 00602112 _____ (OldTimer Tools) C:\Users\Leonie\Downloads\OTL.exe

2013-07-28 12:46 - 2013-07-28 12:45 - 00000474 _____ C:\Users\Leonie\Downloads\defogger_disable.log

2013-07-28 12:45 - 2013-07-28 12:45 - 00050477 _____ C:\Users\Leonie\Downloads\Defogger.exe

2013-07-28 12:45 - 2013-07-28 12:45 - 00000000 _____ C:\Users\Leonie\defogger_reenable

2013-07-28 12:45 - 2011-04-28 19:28 - 00000000 ____D C:\Users\Leonie

2013-07-27 11:48 - 2012-03-31 11:50 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-07-27 11:48 - 2011-05-07 22:36 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-07-23 05:19 - 2013-07-23 05:19 - 00000000 ____D C:\Users\Leonie\AppData\Local\{3ABD061A-80D6-40C3-9F2E-887EBAE3D34E}

2013-07-21 03:46 - 2010-10-23 01:20 - 00000000 ____D C:\ProgramData\Recovery

2013-07-19 18:27 - 2013-03-07 15:18 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Winamp

2013-07-19 17:28 - 2011-04-29 17:41 - 00000000 ___RD C:\Users\Leonie\Desktop\Sabine

2013-07-16 14:33 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-12 09:54 - 2012-12-30 17:08 - 00000000 ___RD C:\Users\Leonie\Desktop\Leonie 1

2013-07-11 08:34 - 2009-07-14 06:45 - 00286280 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-11 08:32 - 2013-03-13 09:32 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 08:32 - 2013-03-13 09:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 08:32 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 08:32 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-03 16:23 - 2012-04-27 07:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-03 14:36 - 2013-07-03 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-29 10:02
 

==================== End Of Log ============================

--- --- ---

gruß und schonmal schönes wochenende

sk_muecke

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. noch Probleme?

Hallo schrauber,

ich habe nochmal ein Zwischenfrage. Ich habe 2 Externe Festplatten und 2 USB-Sticks, aber nur 3 Anschlüße an meinem Laptop. Kann ich den ESET online scanner auch 2 Mal durchlaufen lassen? Und was ist mit Digitalkamera und MP2 Player müssen die auch mit gescannt werden?

Viele Grüße

sk_muecke

Klar kannste auch zweimal machen, die Cam und der Player müssen nit ran :)

Hallo schrauber,

hier der erste logfile. Zweiten schicke ich später. beim 2. scan hat er mir die erste Datei überschrieben. hatte sie zwar hier schon vorsorglich gepostet aber ESET muß mich aus dem Programm geschmissen haben und nun ist der andere logfile weg. Wußte auch nicht ob ich die Datei umbenennen kann.

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=dd453a6626f0124697e2d740d65dcc38

# engine=14644

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-08-04 02:06:49

# local_time=2013-08-04 04:06:49 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 98 52680 241048499 45455 0

# compatibility_mode=3588 16777214 85 79 25905219 79518015 0 0

# compatibility_mode=5893 16776573 100 94 118264 127255059 0 0

# scanned=342939

# found=0

# cleaned=0

# scan_time=10673

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=dd453a6626f0124697e2d740d65dcc38

# engine=14653

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-08-05 07:42:41

# local_time=2013-08-05 09:42:41 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 98 7922 241111851 698 0

# compatibility_mode=3588 16777214 85 79 25968571 79581367 0 0

# compatibility_mode=5893 16776573 100 94 181616 127318411 0 0

# scanned=334034

# found=0

# cleaned=0

# scan_time=7664

Gruß
sk_muecke

dann weiter im Text :)

Hallo schrauber,

so hier nun der Rest.

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=dd453a6626f0124697e2d740d65dcc38

# engine=14644

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-08-04 02:06:49

# local_time=2013-08-04 04:06:49 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 98 52680 241048499 45455 0

# compatibility_mode=3588 16777214 85 79 25905219 79518015 0 0

# compatibility_mode=5893 16776573 100 94 118264 127255059 0 0

# scanned=342939

# found=0

# cleaned=0

# scan_time=10673

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=dd453a6626f0124697e2d740d65dcc38

# engine=14653

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-08-05 07:42:41

# local_time=2013-08-05 09:42:41 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 98 7922 241111851 698 0

# compatibility_mode=3588 16777214 85 79 25968571 79581367 0 0

# compatibility_mode=5893 16776573 100 94 181616 127318411 0 0

# scanned=334034

# found=0

# cleaned=0

# scan_time=7664

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=dd453a6626f0124697e2d740d65dcc38

# engine=14653

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-08-05 12:21:41

# local_time=2013-08-05 02:21:41 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 98 24662 241128591 17438 0

# compatibility_mode=3588 16777214 85 79 25985311 79598107 0 0

# compatibility_mode=5893 16776573 100 94 198356 127335151 0 0

# scanned=342843

# found=0

# cleaned=0

# scan_time=15848

Code:

 Results of screen317's Security Check version 0.99.71  

 Windows 7 Service Pack 1 x64 (UAC is disabled!)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

Norton Internet Security   

Avira Desktop              

 Antivirus out of date!  
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java(TM) 6 Update 21  

 Java version out of Date! 

 Adobe Flash Player 11.7.700.224  

 Adobe Reader XI  

 Mozilla Firefox (22.0) 

 Mozilla Thunderbird (17.0.7) 
 ````````Process Check: objlist.exe by Laurent````````  

 Norton ccSvcHst.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 (ATTENTION: ====> FRST version is 6 days old and could be outdated)

Ran by Leonie (administrator) on 05-08-2013 15:23:22

Running from C:\Users\Leonie\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

( ) C:\Windows\system32\lxdicoms.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Telefónica) C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe

(Lexmark) C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2010-09-13] (Synaptics Incorporated)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2010-09-22] (Realtek Semiconductor)

HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)

HKLM\...\Run: [lxdimon.exe] - C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe [435120 2007-03-06] ()

HKLM\...\Run: [lxdiamon] - C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe [20480 2007-03-05] (Lexmark)

HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)

HKLM\...\Run: [LXDICATS] - rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXDItime.dll,RunDLLEntry [x]

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!

HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-08-16] (Hewlett-Packard Company)

HKCU\...\Run: [Facebook Update] - C:\Users\Leonie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-01-13] (Facebook Inc.)

HKCU\...\Policies\system: [DisableLockWorkstation] 0

HKCU\...\Policies\system: [DisableChangePassword] 0

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [584760 2010-09-28] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2010-08-30] (EasyBits Software AS)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [FaxCenterServer] - C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe [312240 2007-03-06] ()

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)

HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-12-07] (Nullsoft, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk

ShortcutTarget: Snapfish PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Notebooks

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)

BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2010-10-22] (EasyBits Software Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Leonie\AppData\Roaming\Mozilla\Firefox\Profiles\nyziz5dd.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()

FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Leonie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Extension: No Name - C:\Users\Leonie\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\

FF Extension: Symantec IPS - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2

FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox

FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox

FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\

FF Extension: No Name - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\

FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\

FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)

R2 lxdi_device; C:\Windows\system32\lxdicoms.exe [876976 2007-03-06] ( )

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)

R2 TGCM_ImportWiFiSvc; C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201080 2011-06-14] (Telefónica)

S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-07-30] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-13] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-13] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [132656 2010-08-13] (Symantec Corporation)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [463408 2010-06-27] (Symantec Corporation)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [463408 2010-06-27] (Symantec Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS [117808 2010-08-13] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS [117808 2010-08-13] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS [1791536 2010-08-13] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS [1791536 2010-08-13] (Symantec Corporation)

S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-05-12] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-05 15:15 - 2013-08-05 15:15 - 00891098 _____ C:\Users\Leonie\Downloads\SecurityCheck.exe

2013-08-04 13:06 - 2013-08-04 13:06 - 02347384 _____ (ESET) C:\Users\Leonie\Downloads\esetsmartinstaller_enu.exe

2013-08-04 13:06 - 2013-08-04 13:06 - 00000000 ____D C:\Program Files (x86)\ESET

2013-08-02 17:21 - 2013-08-02 17:21 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-02 17:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-02 17:13 - 2013-08-02 17:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Leonie\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-02 17:03 - 2013-08-02 17:04 - 00024908 _____ C:\AdwCleaner[S1].txt

2013-08-02 17:01 - 2013-08-02 17:01 - 00666633 _____ C:\Users\Leonie\Downloads\adwcleaner.exe

2013-08-01 19:23 - 2013-08-01 19:25 - 00000000 ____D C:\Windows\system32\MRT

2013-08-01 18:56 - 2013-08-01 18:56 - 00031869 _____ C:\ComboFix.txt

2013-08-01 17:09 - 2013-08-01 18:59 - 00000000 ____D C:\Qoobox

2013-08-01 17:09 - 2013-08-01 18:59 - 00000000 ____D C:\ComboFix

2013-08-01 17:09 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-01 17:09 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-01 17:09 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-01 17:09 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-01 17:08 - 2013-08-01 18:37 - 00000000 ____D C:\Windows\erdnt

2013-08-01 17:05 - 2013-08-01 17:05 - 05096636 ____R (Swearware) C:\Users\Leonie\Downloads\ComboFix.exe

2013-08-01 09:34 - 2013-08-01 09:35 - 00028100 _____ C:\Users\Leonie\Downloads\Addition.txt

2013-08-01 09:34 - 2013-08-01 09:34 - 00000000 ____D C:\FRST

2013-08-01 09:33 - 2013-08-01 09:33 - 01781589 _____ (Farbar) C:\Users\Leonie\Downloads\FRST64.exe

2013-07-31 23:29 - 2013-07-31 23:36 - 00011826 _____ C:\Users\Leonie\Downloads\OTL.7z

2013-07-31 23:24 - 2013-07-31 23:24 - 01110476 _____ C:\Users\Leonie\Downloads\7z920.exe

2013-07-31 23:24 - 2013-07-31 23:24 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-07-31 23:14 - 2013-07-31 23:14 - 00001448 _____ C:\Users\Leonie\Downloads\Ereignisse.txt

2013-07-28 13:25 - 2013-07-28 13:25 - 00377856 _____ C:\Users\Leonie\Downloads\gmer_2.1.19163.exe

2013-07-28 13:15 - 2013-07-28 13:15 - 00097358 _____ C:\Users\Leonie\Downloads\Extras.Txt

2013-07-28 13:12 - 2013-07-28 13:12 - 00108072 _____ C:\Users\Leonie\Downloads\OTL.Txt

2013-07-28 12:47 - 2013-07-28 12:47 - 00602112 _____ (OldTimer Tools) C:\Users\Leonie\Downloads\OTL.exe

2013-07-28 12:45 - 2013-07-28 12:46 - 00000474 _____ C:\Users\Leonie\Downloads\defogger_disable.log

2013-07-28 12:45 - 2013-07-28 12:45 - 00050477 _____ C:\Users\Leonie\Downloads\Defogger.exe

2013-07-28 12:45 - 2013-07-28 12:45 - 00000000 _____ C:\Users\Leonie\defogger_reenable

2013-07-23 05:19 - 2013-07-23 05:19 - 00000000 ____D C:\Users\Leonie\AppData\Local\{3ABD061A-80D6-40C3-9F2E-887EBAE3D34E}

2013-07-11 06:53 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-11 06:53 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-11 06:53 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-11 06:53 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-11 06:53 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-11 06:53 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-11 06:53 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-11 06:53 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-11 06:53 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-11 06:53 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 06:41 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-11 06:41 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-11 06:41 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 06:41 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-11 06:41 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 06:40 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 06:40 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
 

==================== One Month Modified Files and Folders =======
 

2013-08-05 15:15 - 2013-08-05 15:15 - 00891098 _____ C:\Users\Leonie\Downloads\SecurityCheck.exe

2013-08-05 14:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing

2013-08-05 14:39 - 2012-10-28 01:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-05 14:28 - 2013-01-13 18:20 - 00000932 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001UA.job

2013-08-05 14:16 - 2011-02-10 01:44 - 01527773 _____ C:\Windows\WindowsUpdate.log

2013-08-05 12:18 - 2011-05-11 08:35 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{42BF9262-E7A9-407C-911C-24AC5E56FE86}

2013-08-05 10:03 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-05 10:03 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-05 09:58 - 2010-10-23 00:00 - 00697550 _____ C:\Windows\system32\perfh007.dat

2013-08-05 09:58 - 2010-10-23 00:00 - 00148556 _____ C:\Windows\system32\perfc007.dat

2013-08-05 09:58 - 2009-07-14 07:13 - 01614964 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-05 09:54 - 2013-04-03 01:35 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-08-05 09:54 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-05 09:54 - 2009-07-14 06:51 - 00312136 _____ C:\Windows\setupact.log

2013-08-04 16:16 - 2011-04-29 17:11 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\SoftGrid Client

2013-08-04 13:06 - 2013-08-04 13:06 - 02347384 _____ (ESET) C:\Users\Leonie\Downloads\esetsmartinstaller_enu.exe

2013-08-04 13:06 - 2013-08-04 13:06 - 00000000 ____D C:\Program Files (x86)\ESET

2013-08-03 17:28 - 2013-01-13 18:20 - 00000910 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335335537-3451033126-153766335-1001Core.job

2013-08-03 16:59 - 2011-05-08 10:41 - 00000000 ____D C:\ProgramData\Lx_cats

2013-08-03 16:39 - 2011-05-14 20:20 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForLeonie.job

2013-08-03 16:07 - 2011-05-14 20:20 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForLeonie

2013-08-03 16:06 - 2012-03-31 11:50 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-08-03 16:06 - 2011-05-07 22:36 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-08-02 17:21 - 2013-08-02 17:21 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-02 17:20 - 2013-08-02 17:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-02 17:13 - 2013-08-02 17:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Leonie\Downloads\mbam-setup-1.75.0.1300.exe

2013-08-02 17:04 - 2013-08-02 17:03 - 00024908 _____ C:\AdwCleaner[S1].txt

2013-08-02 17:01 - 2013-08-02 17:01 - 00666633 _____ C:\Users\Leonie\Downloads\adwcleaner.exe

2013-08-01 19:25 - 2013-08-01 19:23 - 00000000 ____D C:\Windows\system32\MRT

2013-08-01 19:22 - 2011-04-29 17:11 - 01592858 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-08-01 19:07 - 2011-04-28 18:22 - 00036928 _____ C:\Windows\PFRO.log

2013-08-01 18:59 - 2013-08-01 17:09 - 00000000 ____D C:\Qoobox

2013-08-01 18:59 - 2013-08-01 17:09 - 00000000 ____D C:\ComboFix

2013-08-01 18:56 - 2013-08-01 18:56 - 00031869 _____ C:\ComboFix.txt

2013-08-01 18:37 - 2013-08-01 17:08 - 00000000 ____D C:\Windows\erdnt

2013-08-01 17:48 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2013-08-01 17:05 - 2013-08-01 17:05 - 05096636 ____R (Swearware) C:\Users\Leonie\Downloads\ComboFix.exe

2013-08-01 09:35 - 2013-08-01 09:34 - 00028100 _____ C:\Users\Leonie\Downloads\Addition.txt

2013-08-01 09:34 - 2013-08-01 09:34 - 00000000 ____D C:\FRST

2013-08-01 09:33 - 2013-08-01 09:33 - 01781589 _____ (Farbar) C:\Users\Leonie\Downloads\FRST64.exe

2013-07-31 23:36 - 2013-07-31 23:29 - 00011826 _____ C:\Users\Leonie\Downloads\OTL.7z

2013-07-31 23:24 - 2013-07-31 23:24 - 01110476 _____ C:\Users\Leonie\Downloads\7z920.exe

2013-07-31 23:24 - 2013-07-31 23:24 - 00000000 ____D C:\Program Files (x86)\7-Zip

2013-07-31 23:14 - 2013-07-31 23:14 - 00001448 _____ C:\Users\Leonie\Downloads\Ereignisse.txt

2013-07-31 09:23 - 2011-04-28 20:22 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForLEONIE-HP$

2013-07-31 09:23 - 2011-04-28 20:22 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForLEONIE-HP$.job

2013-07-30 07:46 - 2012-09-04 12:32 - 00045856 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys

2013-07-28 13:51 - 2011-05-08 10:42 - 00000000 ____D C:\Users\Leonie\AppData\Local\CrashDumps

2013-07-28 13:25 - 2013-07-28 13:25 - 00377856 _____ C:\Users\Leonie\Downloads\gmer_2.1.19163.exe

2013-07-28 13:15 - 2013-07-28 13:15 - 00097358 _____ C:\Users\Leonie\Downloads\Extras.Txt

2013-07-28 13:12 - 2013-07-28 13:12 - 00108072 _____ C:\Users\Leonie\Downloads\OTL.Txt

2013-07-28 12:47 - 2013-07-28 12:47 - 00602112 _____ (OldTimer Tools) C:\Users\Leonie\Downloads\OTL.exe

2013-07-28 12:46 - 2013-07-28 12:45 - 00000474 _____ C:\Users\Leonie\Downloads\defogger_disable.log

2013-07-28 12:45 - 2013-07-28 12:45 - 00050477 _____ C:\Users\Leonie\Downloads\Defogger.exe

2013-07-28 12:45 - 2013-07-28 12:45 - 00000000 _____ C:\Users\Leonie\defogger_reenable

2013-07-28 12:45 - 2011-04-28 19:28 - 00000000 ____D C:\Users\Leonie

2013-07-23 05:19 - 2013-07-23 05:19 - 00000000 ____D C:\Users\Leonie\AppData\Local\{3ABD061A-80D6-40C3-9F2E-887EBAE3D34E}

2013-07-21 03:46 - 2010-10-23 01:20 - 00000000 ____D C:\ProgramData\Recovery

2013-07-19 18:27 - 2013-03-07 15:18 - 00000000 ____D C:\Users\Leonie\AppData\Roaming\Winamp

2013-07-19 17:28 - 2011-04-29 17:41 - 00000000 ___RD C:\Users\Leonie\Desktop\Sabine

2013-07-16 14:33 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-12 09:54 - 2012-12-30 17:08 - 00000000 ___RD C:\Users\Leonie\Desktop\Leonie 1

2013-07-11 08:34 - 2009-07-14 06:45 - 00286280 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-11 08:32 - 2013-03-13 09:32 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 08:32 - 2013-03-13 09:32 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 08:32 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 08:32 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-02 18:03
 

==================== End Of Log ============================

--- --- ---

Gruß

sk_muecke

Java updaten.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo schrauber,

wenn ich Defogger nochmal starte bekomme ich eine Fehlermeldung. Ich klicke auf re-enable und dann erscheint ein fenster "Defooger error" "Unable to open file"

Ist das in Ordnung so?

Gruß

sk_muecke