Trojaner-Board - Win7: Instant Savings Virus

Moin,

Habe seit ungefähr letzer Woche ein Problem mit der sog. "Instant Savings App". In meinen Browsern kriege ich dadurch immer Werbung und Links zu dubiosen Websiten. Das Programm scheint in meinen Browsern und auf dem PC selber installiert zu sein, zu entfernen ist das ganze jedoch nicht. Habe dann mal Malewarebytes drüberlaufen lassen und die infizierten Datein entfernt. Danach hab ich ein paar Adwarecleaner und das Junkware Removal Tool drüber laufen lassen. Habe dann noch im Temp Ordner den entsprechenden "Instan Savings App" Ordner gelöscht, doch trotzdem tritt das Problem noch auf. Weder Antivir noch Malewarebytes findet infizierte Datein. Ich würde mich nun freuen, wenn ein fachmännisches Auge da mal einen Blick drauf werfen könnte, da ich nicht wirklich viel Ahnung von der ganzen Materie habe. Ich poste nun hier noch die Logs der entsprechenden Suchläufe.

Malwarebytes Log vor Systemreinigung:

Code:

21.10.2013 00:18:55

MBAM-log-2013-10-21 (00-30-13).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 235895

Laufzeit: 10 Minute(n), 27 Sekunde(n)
 

Infizierte Speicherprozesse: 3

C:\Program Files\Common Files\Umbrella\Umbrella.exe (PUP.Optional.Iminent) -> 2052 -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.exe (PUP.Optional.Iminent.A) -> 2496 -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Messengers.exe (PUP.Optional.Iminent.A) -> 2520 -> Keine Aktion durchgeführt.
 

Infizierte Speichermodule: 3

C:\Program Files\Iminent\f_in_box.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\System.Data.SQLite.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.WinCore.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungsschlüssel: 67

HKLM\SYSTEM\CurrentControlSet\Services\SProtection (PUP.Optional.Iminent) -> Keine Aktion durchgeführt.

HKLM\SYSTEM\CurrentControlSet\Services\CltMngSvc (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

HKCR\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.ActiveContentHandle.1 (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.ActiveContentHandler (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.BrowserHelperObject.1 (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.BrowserHelperObject (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0af350d9-3916-454b-ac53-0b0b65f41301} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Business.Tinyfying.DownloadArgs (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Business.Tinyfying.LinkToPromoteArgs (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Business.Tinyfying.RawDataArgs (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Business.Tinyfying.TinyUrlArgs (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Business.Tinyfying.ViralLinkArgs (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.ClientCallback (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.ContractBase (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GameOverCallback (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GetCreditCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GetVariableCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.GetVariableResult (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.InstallationContextResult (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.LoadContentCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.LoginCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.LogoutCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.MyAccountCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.PlayContentCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.PostContentCallback (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.SetVariableCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.TestContentCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.WarmUpCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.DataContracts.WelcomeCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.ServerCommand (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.Communication.ServerResult (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.LightContent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.LightUri (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\Iminent.Mediator.MediatorServiceProxy (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.ScriptExtender (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.ScriptExtender.1 (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.TinyUrlHandler (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\IminentWebBooster.TinyUrlHandler.1 (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCR\AppID\Iminent.WebBooster.InternetExplorer.DLL (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

HKCU\SOFTWARE\IMINENT (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\UMBRELLA (PUP.Optional.Umbrella.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\IMINENT (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungswerte: 6

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|IminentMessenger (PUP.Optional.Iminent.A) -> Daten: C:\Program Files\Iminent\Iminent.Messengers.exe -> Keine Aktion durchgeführt.

HKCU\Software\Iminent|SearchEngineOptin (PUP.Optional.Iminent.A) -> Daten: 0 -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Umbrella|MUpdBlock (PUP.Optional.Umbrella.A) -> Daten: {

   "MASSUPDATE" : {

      "CHROME_MBAR" : {

         "Checked" : 1,

         "RetryIdx" : 0,

         "Version" : 1

      },

      "FIREFOX_MBAR" : {

         "Checked" : 1,

         "RetryIdx" : 0,

         "Version" : 1

      }

   }

}

 -> Keine Aktion durchgeführt.

HKLM\SYSTEM\CurrentControlSet\Services\SProtection|ImagePath (PUP.Optional.Iminent.A) -> Daten: C:\Program Files\Common Files\Umbrella\umbrella.exe -> Keine Aktion durchgeführt.

HKLM\Software\Iminent|RefererId (PUP.Optional.Iminent.A) -> Daten: 404 -> Keine Aktion durchgeführt.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Iminent (PUP.Optional.Iminent.A) -> Daten: C:\Program Files\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C" -> Keine Aktion durchgeführt.
 

Infizierte Dateiobjekte der Registrierung: 3

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.Conduit.A) -> Bösartig: (C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll) Gut: () -> Keine Aktion durchgeführt.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Conduit) -> Bösartig: (hxxp://search.conduit.com?SearchSource=10&CUI=UN77251503717990294&UM=1&ctid=CT2851647&UP=SP0A736D04-DC77-4AF5-A656-4F49864D2EBD) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (hxxp://searchab.com/?aff=7&uid=c7bc8332-6ec4-11e2-b9b9-1c6f652730aa) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
 

Infizierte Verzeichnisse: 30

C:\Program Files\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst\Bootstrapper (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\ro (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\tr (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Iminent\Mediator (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Iminent\Mediator\Datas\Cache (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Iminent\Mediator\Datas\Cache\apix.iminent.com (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\Iminent\Mediator (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\1240D81903114EB7BCFFFA274EA8A6C6 (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\44B45C9D2EEF4601832E20CB5A6A98A2 (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_9D463A6E02BA4B28BE0D6841185C8F01 (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\Iminent\Log (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\xpi (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\plugins (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\xpi (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\xpi\defaults (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
 

Infizierte Dateien: 130

C:\Program Files\Common Files\Umbrella\Umbrella.exe (PUP.Optional.Iminent) -> Keine Aktion durchgeführt.

C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Program Files\SearchProtect\SearchProtect\bin\cltmng.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Program Files\SearchProtect\UI\bin\cltmngui.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Program Files\SearchProtect\SearchProtect\bin\SPVC32Loader.dll (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.WebBooster.InternetExplorer.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_9D463A6E02BA4B28BE0D6841185C8F01\LatestDLMgr.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ToolbarHelper.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\IminentSetup_20130624.exe (PUP.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\utt5383.tmp.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\uttBDC5.tmp.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\OCS\ocs_v7a.exe (PUP.Optional.DownloadSponsor.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Conduit\CT2851647\uTorrentBar_DEAutoUpdateHelper.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Windows\Installer\19506c0.msi (PUP.Optional.Iminent) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\SearchTheWeb.xml (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Mediator.ActivePlayers.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\f_in_box.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.AxImp.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Booster.UI.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Business.Connect.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Business.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Business.tlb (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Entity.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.exe (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.exe.config (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.InstallLog (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.InstallState (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Microsoft.DirectX.AudioVideoPlayback.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Microsoft.Expression.Interactions.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\StartWeb.xml (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\System.Data.SQLite.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\System.Data.SQLite.xml (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\System.Windows.Interactivity.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\System.Windows.Interactivity.xml (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\USearch.xml (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\WPFLocalizeExtension.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\WPFLocalizeExtension.xml (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Mediator.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Mediator.tlb (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Messengers.exe (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Messengers.exe.config (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Services.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.WinCore.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.WinCore.WLM.WinEvents.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.WinCore.WLM15.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.WinCore.Yahoo.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Windows.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\Iminent.Workflow.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\Iminent.Business.Connect.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\Iminent.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\Microsoft.Expression.Interactions.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\de\System.Windows.Interactivity.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\Iminent.Business.Connect.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\Iminent.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\Microsoft.Expression.Interactions.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\en\System.Windows.Interactivity.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\Iminent.Business.Connect.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\Iminent.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\Microsoft.Expression.Interactions.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\es\System.Windows.Interactivity.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\Iminent.Business.Connect.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\Iminent.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\Microsoft.Expression.Interactions.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\fr\System.Windows.Interactivity.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst\main.ico (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst\msacm32.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst\SearchTheWeb.ico (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst\Universely.ico (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\inst\Bootstrapper\Bootstrapper.exe (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\Iminent.Business.Connect.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\Iminent.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\Microsoft.Expression.Interactions.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\it\System.Windows.Interactivity.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\ro\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\ro\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\ro\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\tr\Iminent.Booster.UI.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\tr\Iminent.Business.Connect.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\tr\Iminent.Messengers.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\tr\Iminent.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Iminent\tr\Iminent.Services.resources.dll (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Program Files\Mozilla Firefox\defaults\pref\all-iminent.js (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\SearchTheWeb.lnk (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\Blog.lnk (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\FAQ.lnk (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\Help.lnk (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\Iminent.lnk (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Windows\System32\roboot.exe (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt.

C:\ProgramData\Iminent\Mediator\Datas\Cache\apix.iminent.com\1031.11575f00-7bdc-4181-ba0a-b298aeab228c.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\Iminent\Mediator\Datas\globalcache.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\Iminent\Mediator\Datas\user.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\1240D81903114EB7BCFFFA274EA8A6C6\driverscannerROE.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\44B45C9D2EEF4601832E20CB5A6A98A2\TuneUpUtilities2012_de-DE.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_9D463A6E02BA4B28BE0D6841185C8F01\1273.ico (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_9D463A6E02BA4B28BE0D6841185C8F01\TuneUpInst-2.2.1-cmp218.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\chLogic.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\CT2704262.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\CT2704262.xpi (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\ffLogic.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\ieLogic.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\initData.json (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\manifest.json (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\statisticsStub.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\version.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\ct2704262\xpi\install.rdf (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\conduit.xml (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\conduitStatistics.csf (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\CT2851647.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\CT2851647.xpi (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\initData.json (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\manifest.json (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\version.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\plugins\TBVerifier.dll (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\xpi\install.rdf (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

C:\Users\Jan\AppData\Local\Temp\CT2851647\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

_________________________________________________________________________________________________________________________________

Der FRST + Addition, JRT und AdwCleaner Log entsprechen dem jetzigen Stand des Sytems, dass heißt nach der Entfernung der durch Malewarebytes gefunden infizierten Dateien und nachdem ich JRT und AdwCleaner 2-3 drüber laufen lassen habe.

FRST Log nach Systemreinigung:

Code:

#Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Update\1.3.21.165\GoogleCrashHandler.exe

(Spotify Ltd) C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Spotify Ltd) C:\Users\Jan\AppData\Roaming\Spotify\spotify.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

() C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Microsoft Corporation) C:\Windows\system32\wuauclt.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jucheck.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)

HKLM\...\Run: [Instant Savings App-repairJob] - wscript.exe "C:\Users\Jan\AppData\Local\Instant Savings App\repair.js"

HKCU\...\Run: [AdobeBridge] - [x]

HKCU\...\Run: [Google Update] - C:\Users\Jan\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-03-24] (Google Inc.)

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-10-14] (Spotify Ltd)

HKCU\...\Run: [Spotify] - C:\Users\Jan\AppData\Roaming\Spotify\spotify.exe [4752384 2013-10-14] (Spotify Ltd)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xDF85CD79F078CB01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

URLSearchHook: (No Name) - {32b29df0-2237-4370-9a29-37cebb730e9b} -  No File

SearchScopes: HKLM - DefaultScope value is missing.

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Instant Savings App BHO - {6EB4A4C0-6036-4D2E-B010-20707C4B62E8} - C:\Program Files\Instant Savings App\FrameworkBHO.dll ()

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - No Name - {32B29DF0-2237-4370-9A29-37CEBB730E9B} -  No File

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\5k92taeu.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Jan\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Jan\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Instant Savings App - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\5k92taeu.default\Extensions\{33971AE8-1817-AD51-256D-BCA1D0954E1E}
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Instant Savings App ) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ddjhbkoibibhknfbcfgnlmkbnajfeobo\1.0_0

CHR Extension: (AdBlock) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.10_0

CHR Extension: (iOS, iPad, iPhone & iPod Grey Texture) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\odgbpcbfijafedicgoagncajafompaok\2_0

CHR Extension: (Gmail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM\...\Chrome\Extension: [knkakpihealnpggeceajhaonlmgdkaip] - C:\Users\Jan\AppData\Local\CRE\knkakpihealnpggeceajhaonlmgdkaip.crx

CHR StartMenuInternet: Google Chrome - C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2012-10-23] (Flexera Software, Inc.)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [4176896 2011-10-12] (Native Instruments GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-07] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-07] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R0 SscRdBus; C:\Windows\System32\DRIVERS\SscRdBus.sys [91336 2013-04-01] (SuperSpeed LLC)

R0 SscRdCls; C:\Windows\System32\DRIVERS\SscRdCls.sys [40984 2007-12-19] (SuperSpeed LLC)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-21 01:52 - 2013-10-21 01:52 - 00001367 _____ C:\Users\Jan\Desktop\AdwCleaner[S2].txt

2013-10-21 01:33 - 2013-10-21 01:33 - 00012503 _____ C:\Users\Jan\Desktop\Addition.txt

2013-10-21 01:31 - 2013-10-21 01:31 - 01087515 _____ (Farbar) C:\Users\Jan\Downloads\FRST.exe

2013-10-21 01:31 - 2013-10-21 01:31 - 00000000 ____D C:\FRST

2013-10-21 01:29 - 2013-10-21 01:29 - 00000240 _____ C:\Users\Jan\Downloads\defogger_enable.log

2013-10-21 01:28 - 2013-10-21 01:29 - 00000468 _____ C:\Users\Jan\Downloads\defogger_disable.log

2013-10-21 01:28 - 2013-10-21 01:28 - 00050477 _____ C:\Users\Jan\Downloads\Defogger.exe

2013-10-21 01:24 - 2013-10-21 01:24 - 00614816 _____ C:\Users\Jan\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-21 00:41 - 2013-10-21 00:41 - 00000000 ____D C:\Windows\ERUNT

2013-10-21 00:38 - 2013-10-21 01:40 - 00000000 ____D C:\AdwCleaner

2013-10-21 00:38 - 2013-10-21 00:38 - 01033335 _____ (Thisisu) C:\Users\Jan\Downloads\JRT.exe

2013-10-21 00:38 - 2013-10-21 00:38 - 01033335 _____ (Thisisu) C:\Users\Jan\Desktop\JRT.exe

2013-10-21 00:38 - 2013-10-21 00:37 - 01060070 _____ C:\Users\Jan\Desktop\adwcleaner.exe

2013-10-21 00:37 - 2013-10-21 00:37 - 01060070 _____ C:\Users\Jan\Downloads\adwcleaner.exe

2013-10-19 15:11 - 2013-10-19 15:11 - 00002410 _____ C:\Users\Jan\Desktop\FTX Central.lnk

2013-10-19 15:11 - 2013-10-19 15:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Orbx

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\MSDOS.SYS

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\IO.SYS

2013-10-18 23:55 - 2013-10-21 00:35 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-17 19:49 - 2013-10-17 19:49 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-17 19:49 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-10-17 19:48 - 2013-10-17 19:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Jan\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-14 14:22 - 2013-10-14 14:22 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FSX Scenery ISTANBUL ATATURK AIRPORT (LTBA)

2013-10-14 13:39 - 2013-10-14 13:39 - 00000000 ____D C:\Users\Jan\Desktop\FPS_Limiter_0.2

2013-10-14 13:22 - 2013-10-14 13:23 - 00000000 ____D C:\Program Files\TreeX

2013-10-14 13:18 - 2013-10-14 13:18 - 17640674 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_X3.zip

2013-10-14 13:17 - 2013-10-14 13:18 - 17324105 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_BA.zip

2013-10-14 13:17 - 2013-10-14 13:18 - 14664230 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_OS.zip

2013-10-14 13:17 - 2013-10-14 13:17 - 10734499 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_AB.zip

2013-10-14 13:01 - 2013-10-14 13:14 - 11790103 _____ C:\Users\Jan\Downloads\treex_v2.zip

2013-10-14 01:09 - 2013-10-14 01:09 - 00002418 _____ C:\Users\Jan\Downloads\enbseries.ini

2013-10-13 15:29 - 2013-10-13 15:29 - 00002196 _____ C:\Users\Jan\Desktop\Livery Manager.lnk

2013-10-12 16:34 - 2013-10-12 16:34 - 02105040 _____ (PeerBlock, LLC                                              ) C:\Users\Jan\Downloads\PeerBlock-Setup_v1.1_r518.exe

2013-10-12 16:32 - 2013-10-21 01:35 - 00000328 _____ C:\Windows\Tasks\bench-sys.job

2013-10-12 16:32 - 2013-10-21 00:42 - 00000328 _____ C:\Windows\Tasks\bench-S-1-5-21-2384783165-3255649285-2511093218-1001.job

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Users\Jan\AppData\Local\Instant Savings App

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Users\Jan\AppData\Local\BenchUpdater

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Program Files\Instant Savings App

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Program Files\Bench

2013-10-12 16:31 - 2013-10-12 16:31 - 01141328 _____ (BitTorrent Inc.) C:\Users\Jan\Downloads\utorrent3.3.2.exe

2013-10-12 01:04 - 2013-10-12 01:04 - 00001699 _____ C:\Users\Public\Desktop\REX Essential Plus Overdrive.lnk

2013-10-12 01:04 - 2013-10-12 01:04 - 00000000 ____D C:\ProgramData\Caphyon

2013-10-12 00:55 - 2013-10-20 15:25 - 00000000 ____D C:\REX Essential Plus Overdrive

2013-10-11 20:21 - 2013-10-11 20:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\RAASPRO

2013-10-11 19:51 - 2013-10-11 19:51 - 00031979 _____ C:\Users\Jan\Downloads\AS_AIRBUSX_COMPANY_ROUTE_EDITOR_V1_01.zip

2013-10-11 19:39 - 2013-10-11 19:39 - 00000000 ____D C:\Users\Jan\AppData\Local\Downloaded Installations

2013-10-11 17:00 - 2013-10-11 17:00 - 00000000 ____D C:\Users\Jan\AppData\Roaming\ICE AI Traffic Group

2013-10-11 16:56 - 2013-10-11 17:00 - 308732222 _____ (ICE AI Traffic Group) C:\Users\Jan\Downloads\ICEAITrafficFSX(2.01).exe

2013-10-11 15:51 - 2012-05-15 12:26 - 19607872 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 17551680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 11354944 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2013-10-11 15:51 - 2012-05-15 12:26 - 05982528 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 02524992 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 02445120 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2013-10-09 18:15 - 2013-10-09 18:15 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Frankfurt-Main Airport v7

2013-10-07 19:40 - 2013-10-07 19:47 - 00000000 ____D C:\Users\Jan\Desktop\Abi

2013-10-06 20:59 - 2013-10-06 20:59 - 00000000 __SHD C:\found.001

2013-10-06 18:31 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll

2013-10-06 18:31 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll

2013-10-06 18:31 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll

2013-10-06 18:29 - 2013-10-11 20:10 - 00000000 ____D C:\Users\Jan\Documents\Aerosoft

2013-10-05 15:54 - 2013-10-05 15:54 - 00034064 _____ (Microsoft Corporation) C:\Windows\system32\lhacm.acm

2013-10-05 15:54 - 2013-10-05 15:54 - 00000952 _____ C:\Users\UpdatusUser\Desktop\Teamspeak 2 RC2.lnk

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\teamspeak2

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Program Files\Teamspeak2_RC2

2013-10-05 03:23 - 2013-10-05 16:14 - 00000000 ____D C:\Users\Jan\AppData\Roaming\TS3Client

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Users\Jan\AppData\Roaming\IVAO

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Program Files\IVAO

2013-10-01 16:18 - 2013-10-01 16:18 - 27267072 ____H C:\SsRd0001.cif

2013-10-01 16:13 - 2013-10-01 16:13 - 00000000 ____D C:\Program Files\SuperSpeed

2013-09-30 16:52 - 2013-10-19 15:45 - 00001123 _____ C:\Windows\Roll Target

2013-09-30 16:52 - 2013-10-19 15:45 - 00001123 _____ C:\Windows\Pitch Target

2013-09-30 16:52 - 2013-10-19 15:45 - 00001115 _____ C:\Windows\Roll Error

2013-09-30 16:52 - 2013-10-19 15:45 - 00001114 _____ C:\Windows\Pitch Error

2013-09-30 16:52 - 2013-10-19 15:45 - 00001105 _____ C:\Windows\Gyro Speed

2013-09-30 16:52 - 2013-10-19 15:45 - 00001005 _____ C:\Windows\Mode2ATimer

2013-09-30 16:52 - 2013-10-19 15:45 - 00001005 _____ C:\Windows\Mode2_AltGain_timer

2013-09-30 16:52 - 2013-10-19 15:45 - 00001001 _____ C:\Windows\Mode2BTimer

2013-09-30 16:52 - 2013-10-19 15:45 - 00000657 _____ C:\Windows\CDU.1

2013-09-30 16:52 - 2013-10-19 15:45 - 00000657 _____ C:\Windows\CDU.0

2013-09-26 16:14 - 2013-09-26 16:14 - 97961477 _____ C:\Windows\system32\Ư偘m

2013-09-25 19:19 - 2013-09-25 19:19 - 00000000 ____D C:\Program Files\Lame For Audacity

2013-09-25 18:32 - 2013-09-25 18:32 - 00000969 _____ C:\Users\Public\Desktop\Audacity.lnk

2013-09-25 18:32 - 2013-09-25 18:32 - 00000000 ____D C:\Program Files\Audacity
 

==================== One Month Modified Files and Folders =======
 

2013-10-21 01:52 - 2013-10-21 01:52 - 00001367 _____ C:\Users\Jan\Desktop\AdwCleaner[S2].txt

2013-10-21 01:49 - 2009-07-14 06:34 - 00014800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-21 01:49 - 2009-07-14 06:34 - 00014800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-21 01:46 - 2012-08-10 15:45 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Spotify

2013-10-21 01:46 - 2010-10-31 20:29 - 01850347 _____ C:\Windows\WindowsUpdate.log

2013-10-21 01:41 - 2012-10-18 15:07 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-10-21 01:41 - 2010-10-31 15:36 - 00000000 ____D C:\ProgramData\NVIDIA

2013-10-21 01:41 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-21 01:41 - 2009-07-14 06:39 - 00114533 _____ C:\Windows\setupact.log

2013-10-21 01:40 - 2013-10-21 00:38 - 00000000 ____D C:\AdwCleaner

2013-10-21 01:35 - 2013-10-12 16:32 - 00000328 _____ C:\Windows\Tasks\bench-sys.job

2013-10-21 01:33 - 2013-10-21 01:33 - 00012503 _____ C:\Users\Jan\Desktop\Addition.txt

2013-10-21 01:33 - 2012-10-18 15:08 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-10-21 01:31 - 2013-10-21 01:31 - 01087515 _____ (Farbar) C:\Users\Jan\Downloads\FRST.exe

2013-10-21 01:31 - 2013-10-21 01:31 - 00000000 ____D C:\FRST

2013-10-21 01:29 - 2013-10-21 01:29 - 00000240 _____ C:\Users\Jan\Downloads\defogger_enable.log

2013-10-21 01:29 - 2013-10-21 01:28 - 00000468 _____ C:\Users\Jan\Downloads\defogger_disable.log

2013-10-21 01:29 - 2010-10-31 13:34 - 00000000 ____D C:\Users\Jan

2013-10-21 01:28 - 2013-10-21 01:28 - 00050477 _____ C:\Users\Jan\Downloads\Defogger.exe

2013-10-21 01:27 - 2012-03-24 01:26 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001UA.job

2013-10-21 01:24 - 2013-10-21 01:24 - 00614816 _____ C:\Users\Jan\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-21 01:20 - 2012-05-09 08:23 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-10-21 00:42 - 2013-10-12 16:32 - 00000328 _____ C:\Windows\Tasks\bench-S-1-5-21-2384783165-3255649285-2511093218-1001.job

2013-10-21 00:41 - 2013-10-21 00:41 - 00000000 ____D C:\Windows\ERUNT

2013-10-21 00:40 - 2012-12-30 03:08 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-10-21 00:39 - 2012-12-10 16:09 - 00000000 ____D C:\ProgramData\Uniblue

2013-10-21 00:39 - 2012-12-09 21:47 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft

2013-10-21 00:39 - 2010-10-31 15:42 - 00000000 ____D C:\ProgramData\ICQ

2013-10-21 00:38 - 2013-10-21 00:38 - 01033335 _____ (Thisisu) C:\Users\Jan\Downloads\JRT.exe

2013-10-21 00:38 - 2013-10-21 00:38 - 01033335 _____ (Thisisu) C:\Users\Jan\Desktop\JRT.exe

2013-10-21 00:37 - 2013-10-21 00:38 - 01060070 _____ C:\Users\Jan\Desktop\adwcleaner.exe

2013-10-21 00:37 - 2013-10-21 00:37 - 01060070 _____ C:\Users\Jan\Downloads\adwcleaner.exe

2013-10-21 00:35 - 2013-10-18 23:55 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-21 00:35 - 2010-10-31 14:43 - 00000000 ____D C:\Users\Jan\AppData\Local\Mozilla

2013-10-21 00:33 - 2010-10-31 15:40 - 00081722 _____ C:\Windows\PFRO.log

2013-10-21 00:32 - 2011-10-15 12:28 - 00000000 ____D C:\Windows\CheckSur

2013-10-20 15:25 - 2013-10-12 00:55 - 00000000 ____D C:\REX Essential Plus Overdrive

2013-10-20 01:01 - 2013-04-01 17:59 - 00596016 _____ C:\Windows\IE10_main.log

2013-10-19 17:10 - 2012-10-23 14:07 - 00000000 ____D C:\Users\Jan\AppData\Roaming\uTorrent

2013-10-19 16:06 - 2013-04-11 16:25 - 00000000 ____D C:\Users\Jan\Desktop\Stuff

2013-10-19 15:45 - 2013-09-30 16:52 - 00001123 _____ C:\Windows\Roll Target

2013-10-19 15:45 - 2013-09-30 16:52 - 00001123 _____ C:\Windows\Pitch Target

2013-10-19 15:45 - 2013-09-30 16:52 - 00001115 _____ C:\Windows\Roll Error

2013-10-19 15:45 - 2013-09-30 16:52 - 00001114 _____ C:\Windows\Pitch Error

2013-10-19 15:45 - 2013-09-30 16:52 - 00001105 _____ C:\Windows\Gyro Speed

2013-10-19 15:45 - 2013-09-30 16:52 - 00001005 _____ C:\Windows\Mode2ATimer

2013-10-19 15:45 - 2013-09-30 16:52 - 00001005 _____ C:\Windows\Mode2_AltGain_timer

2013-10-19 15:45 - 2013-09-30 16:52 - 00001001 _____ C:\Windows\Mode2BTimer

2013-10-19 15:45 - 2013-09-30 16:52 - 00000657 _____ C:\Windows\CDU.1

2013-10-19 15:45 - 2013-09-30 16:52 - 00000657 _____ C:\Windows\CDU.0

2013-10-19 15:40 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-10-19 15:11 - 2013-10-19 15:11 - 00002410 _____ C:\Users\Jan\Desktop\FTX Central.lnk

2013-10-19 15:11 - 2013-10-19 15:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Orbx

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\MSDOS.SYS

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\IO.SYS

2013-10-19 14:50 - 2010-10-31 15:24 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2013-10-19 14:27 - 2012-03-24 01:26 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001Core.job

2013-10-17 19:49 - 2013-10-17 19:49 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-17 19:48 - 2013-10-17 19:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Jan\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-17 17:30 - 2012-03-24 01:26 - 00002356 _____ C:\Users\Jan\Desktop\Google Chrome.lnk

2013-10-16 16:09 - 2012-08-10 15:45 - 00000000 ____D C:\Users\Jan\AppData\Local\Spotify

2013-10-14 14:22 - 2013-10-14 14:22 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FSX Scenery ISTANBUL ATATURK AIRPORT (LTBA)

2013-10-14 13:39 - 2013-10-14 13:39 - 00000000 ____D C:\Users\Jan\Desktop\FPS_Limiter_0.2

2013-10-14 13:23 - 2013-10-14 13:22 - 00000000 ____D C:\Program Files\TreeX

2013-10-14 13:18 - 2013-10-14 13:18 - 17640674 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_X3.zip

2013-10-14 13:18 - 2013-10-14 13:17 - 17324105 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_BA.zip

2013-10-14 13:18 - 2013-10-14 13:17 - 14664230 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_OS.zip

2013-10-14 13:17 - 2013-10-14 13:17 - 10734499 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_AB.zip

2013-10-14 13:14 - 2013-10-14 13:01 - 11790103 _____ C:\Users\Jan\Downloads\treex_v2.zip

2013-10-14 13:00 - 2010-10-31 20:30 - 00389860 _____ C:\Windows\system32\PerfStringBackup.INI

2013-10-14 01:09 - 2013-10-14 01:09 - 00002418 _____ C:\Users\Jan\Downloads\enbseries.ini

2013-10-13 15:29 - 2013-10-13 15:29 - 00002196 _____ C:\Users\Jan\Desktop\Livery Manager.lnk

2013-10-12 16:34 - 2013-10-12 16:34 - 02105040 _____ (PeerBlock, LLC                                              ) C:\Users\Jan\Downloads\PeerBlock-Setup_v1.1_r518.exe

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Users\Jan\AppData\Local\Instant Savings App

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Users\Jan\AppData\Local\BenchUpdater

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Program Files\Instant Savings App

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Program Files\Bench

2013-10-12 16:31 - 2013-10-12 16:31 - 01141328 _____ (BitTorrent Inc.) C:\Users\Jan\Downloads\utorrent3.3.2.exe

2013-10-12 01:04 - 2013-10-12 01:04 - 00001699 _____ C:\Users\Public\Desktop\REX Essential Plus Overdrive.lnk

2013-10-12 01:04 - 2013-10-12 01:04 - 00000000 ____D C:\ProgramData\Caphyon

2013-10-11 20:21 - 2013-10-11 20:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\RAASPRO

2013-10-11 20:10 - 2013-10-06 18:29 - 00000000 ____D C:\Users\Jan\Documents\Aerosoft

2013-10-11 19:51 - 2013-10-11 19:51 - 00031979 _____ C:\Users\Jan\Downloads\AS_AIRBUSX_COMPANY_ROUTE_EDITOR_V1_01.zip

2013-10-11 19:39 - 2013-10-11 19:39 - 00000000 ____D C:\Users\Jan\AppData\Local\Downloaded Installations

2013-10-11 17:00 - 2013-10-11 17:00 - 00000000 ____D C:\Users\Jan\AppData\Roaming\ICE AI Traffic Group

2013-10-11 17:00 - 2013-10-11 16:56 - 308732222 _____ (ICE AI Traffic Group) C:\Users\Jan\Downloads\ICEAITrafficFSX(2.01).exe

2013-10-11 15:53 - 2010-10-31 15:35 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2013-10-10 16:31 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-09 18:20 - 2012-05-09 08:23 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-10-09 18:20 - 2011-11-23 21:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-10-09 18:15 - 2013-10-09 18:15 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Frankfurt-Main Airport v7

2013-10-07 19:47 - 2013-10-07 19:40 - 00000000 ____D C:\Users\Jan\Desktop\Abi

2013-10-07 19:41 - 2013-05-15 18:54 - 00000000 ____D C:\Users\Jan\Desktop\Wichtig

2013-10-07 12:53 - 2013-05-06 13:12 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-10-07 12:53 - 2012-10-25 11:59 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-10-07 12:53 - 2012-10-25 11:59 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-10-07 12:53 - 2012-10-25 11:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-10-06 20:59 - 2013-10-06 20:59 - 00000000 __SHD C:\found.001

2013-10-06 19:10 - 2010-10-31 15:49 - 00068984 _____ C:\Users\Jan\AppData\Local\GDIPFONTCACHEV1.DAT

2013-10-06 19:10 - 2009-07-14 06:33 - 03664032 _____ C:\Windows\system32\FNTCACHE.DAT

2013-10-05 16:14 - 2013-10-05 03:23 - 00000000 ____D C:\Users\Jan\AppData\Roaming\TS3Client

2013-10-05 15:54 - 2013-10-05 15:54 - 00034064 _____ (Microsoft Corporation) C:\Windows\system32\lhacm.acm

2013-10-05 15:54 - 2013-10-05 15:54 - 00000952 _____ C:\Users\UpdatusUser\Desktop\Teamspeak 2 RC2.lnk

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\teamspeak2

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Program Files\Teamspeak2_RC2

2013-10-05 02:04 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Users\Jan\AppData\Roaming\IVAO

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Program Files\IVAO

2013-10-01 16:18 - 2013-10-01 16:18 - 27267072 ____H C:\SsRd0001.cif

2013-10-01 16:13 - 2013-10-01 16:13 - 00000000 ____D C:\Program Files\SuperSpeed

2013-09-29 14:42 - 2012-11-04 15:08 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Aerosoft

2013-09-26 16:14 - 2013-09-26 16:14 - 97961477 _____ C:\Windows\system32\Ư偘m

2013-09-25 22:57 - 2010-11-15 21:32 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Audacity

2013-09-25 19:19 - 2013-09-25 19:19 - 00000000 ____D C:\Program Files\Lame For Audacity

2013-09-25 18:32 - 2013-09-25 18:32 - 00000969 _____ C:\Users\Public\Desktop\Audacity.lnk

2013-09-25 18:32 - 2013-09-25 18:32 - 00000000 ____D C:\Program Files\Audacity

2013-09-25 16:55 - 2013-06-30 00:26 - 00000000 ____D C:\Users\Jan\AppData\Roaming\vlc

2013-09-25 16:30 - 2012-11-02 23:27 - 00000000 ____D C:\Users\Jan\AppData\Local\Windows Live
 

Files to move or delete:

====================

C:\Users\Jan\jagex_cl_runescape_LIVE.dat

C:\Users\Jan\Photoshop_12_LS4.exe

C:\Users\Jan\random.dat
 
 

Some content of TEMP:

====================

C:\Users\Jan\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\Users\Jan\AppData\Local\Temp\AskSLib.dll

C:\Users\Jan\AppData\Local\Temp\AutoRun.exe

C:\Users\Jan\AppData\Local\Temp\AutoRunGUI.dll

C:\Users\Jan\AppData\Local\Temp\avgnt.exe

C:\Users\Jan\AppData\Local\Temp\BingBarSetup-Partner.exe

C:\Users\Jan\AppData\Local\Temp\bpuninstall.exe

C:\Users\Jan\AppData\Local\Temp\BrowserPlus.exe

C:\Users\Jan\AppData\Local\Temp\contentDATs.exe

C:\Users\Jan\AppData\Local\Temp\eauninstall.exe

C:\Users\Jan\AppData\Local\Temp\firefoxjre_exe.exe

C:\Users\Jan\AppData\Local\Temp\i4jdel0.exe

C:\Users\Jan\AppData\Local\Temp\IcqUpdater.exe

C:\Users\Jan\AppData\Local\Temp\InstallManager_GEN_GEN.exe

C:\Users\Jan\AppData\Local\Temp\instmsia.exe

C:\Users\Jan\AppData\Local\Temp\instmsiw.exe

C:\Users\Jan\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe

C:\Users\Jan\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe

C:\Users\Jan\AppData\Local\Temp\nse88E9.exe

C:\Users\Jan\AppData\Local\Temp\nseAB0B.exe

C:\Users\Jan\AppData\Local\Temp\nsfE8C0.exe

C:\Users\Jan\AppData\Local\Temp\nso8668.exe

C:\Users\Jan\AppData\Local\Temp\nsoACD0.exe

C:\Users\Jan\AppData\Local\Temp\nspE506.exe

C:\Users\Jan\AppData\Local\Temp\nspE6DB.exe

C:\Users\Jan\AppData\Local\Temp\nspEECA.exe

C:\Users\Jan\AppData\Local\Temp\nst837A.exe

C:\Users\Jan\AppData\Local\Temp\nsuF0BE.exe

C:\Users\Jan\AppData\Local\Temp\nszA965.exe

C:\Users\Jan\AppData\Local\Temp\nszECE5.exe

C:\Users\Jan\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Jan\AppData\Local\Temp\nvSCPAPISvr.exe

C:\Users\Jan\AppData\Local\Temp\nvStInst.exe

C:\Users\Jan\AppData\Local\Temp\Quarantine.exe

C:\Users\Jan\AppData\Local\Temp\RegAsm.exe

C:\Users\Jan\AppData\Local\Temp\SecurityScan_Release.exe

C:\Users\Jan\AppData\Local\Temp\setup.exe

C:\Users\Jan\AppData\Local\Temp\SpotifyUpgrader.exe

C:\Users\Jan\AppData\Local\Temp\tbedrs.dll

C:\Users\Jan\AppData\Local\Temp\tbFre0.dll

C:\Users\Jan\AppData\Local\Temp\tbuTor.dll

C:\Users\Jan\AppData\Local\Temp\UEFA Champions League 2004 - 2005_uninst.exe

C:\Users\Jan\AppData\Local\Temp\UpdaterCopy.exe

C:\Users\Jan\AppData\Local\Temp\utt376E.tmp.exe

C:\Users\Jan\AppData\Local\Temp\uttB3EE.tmp.exe

C:\Users\Jan\AppData\Local\Temp\_is369C.exe

C:\Users\Jan\AppData\Local\Temp\_is475.exe

C:\Users\Jan\AppData\Local\Temp\_is4DA2.exe

C:\Users\Jan\AppData\Local\Temp\_is4ED6.exe

C:\Users\Jan\AppData\Local\Temp\_is62B8.exe

C:\Users\Jan\AppData\Local\Temp\_is9789.exe

C:\Users\Jan\AppData\Local\Temp\_isC4E4.exe

C:\Users\Jan\AppData\Local\Temp\_isC763.exe

C:\Users\Jan\AppData\Local\Temp\_isDD9.exe

C:\Users\Jan\AppData\Local\Temp\_isDE8B.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-11 14:50

FRST Addition nach Sytemreinigung:

Code:

#==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)

Adobe Flash Player 11 Plugin (Version: 11.9.900.117)

Adobe Photoshop CS5 (Version: 12.0)

Adobe Reader X (10.0.1) - Deutsch (Version: 10.0.1)

Aerosoft's - Airbus X Extended - FSX (Version: 1.15)

aerosoft's - German Airports 2 - 2012 (FSX) (Version: 1.01)

aerosoft's - German Airports 3 - 2012 (FSX) (Version: 1.04)

Aerosoft's - Herakilon X

Aerosoft's - Mega Airport Duesseldorf - FSX

aerosoft's - Mega Airport London Heathrow X (Version: 1.10)

Aerosoft's - VFR Germany 1 (Version: 1.00)

Apple Application Support (Version: 2.3.4)

Apple Mobile Device Support (Version: 6.1.0.13)

Apple Software Update (Version: 2.1.3.127)

Audacity 2.0.4 (Version: 2.0.4)

Avira Free Antivirus (Version: 14.0.0.383)

Bonjour (Version: 3.0.0.10)

D3DX10 (Version: 15.4.2368.0902)

Fotogalerie (Version: 16.4.3505.0912)

Free YouTube to MP3 Converter version 3.11.36.1201 (Version: 3.11.36.1201)

FSX Config editor

FSX Scenery ISTANBUL ATATURK AIRPORT (LTBA)

Google Chrome (HKCU Version: 30.0.1599.101)

Google Earth Plug-in (Version: 7.1.1.1888)

Google Update Helper (Version: 1.3.21.165)

ICE AI Traffic Para FSX (Version: 2.01.0003)

Iminent (Version: 6.35.31.0)

Instant Savings App (Version: 1.0)

iTunes (Version: 11.0.4.4)

IvAp v2.0.2 (build 2773)

Java 7 Update 17 (Version: 7.0.170)

Java Auto Updater (Version: 2.1.9.0)

Java(TM) 6 Update 22 (Version: 6.0.220)

Java(TM) 6 Update 30 (Version: 6.0.300)

LAME v3.99.3 (for Windows)

Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft Flight Simulator X (Version: 10.0.61355.0)

Microsoft Flight Simulator X Service Pack 1 (Version: 10.0.61355.0)

Microsoft Flight Simulator X Service Pack 2 (Version: 10.0.61472.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)

Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)

Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)

Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)

Microsoft_VC90_ATL_x86 (Version: 1.00.0000)

Microsoft_VC90_CRT_x86 (Version: 1.00.0000)

Microsoft_VC90_MFC_x86 (Version: 1.00.0000)

Movie Maker (Version: 16.4.3505.0912)

Mozilla Firefox 24.0 (x86 de) (Version: 24.0)

Mozilla Maintenance Service (Version: 24.0)

MSVCRT (Version: 15.4.2862.0708)

MSVCRT110 (Version: 16.4.1108.0727)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

MSXML 4.0 SP2 Parser und SDK (Version: 4.20.9818.0)

Napster Burn Engine (Version: 3.5.0000)

Native Instruments Controller Editor

Native Instruments Controller Editor (Version: 1.4.2.848)

Native Instruments Service Center

Native Instruments Service Center (Version: 2.2.6.676)

Native Instruments Traktor 2

Native Instruments Traktor 2 (Version: 2.1.3.12972)

NVIDIA 3D Vision Controller-Treiber 301.42 (Version: 301.42)

NVIDIA 3D Vision Treiber 301.42 (Version: 301.42)

NVIDIA Display Control Panel (Version: 6.14.11.9713)

NVIDIA Grafiktreiber 301.42 (Version: 301.42)

NVIDIA HD-Audiotreiber 1.3.16.0 (Version: 1.3.16.0)

NVIDIA Install Application (Version: 2.1002.108.688)

NVIDIA PhysX (Version: 9.12.0213)

NVIDIA PhysX-Systemsoftware 9.12.0213 (Version: 9.12.0213)

NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.0142)

NVIDIA Systemsteuerung 301.42 (Version: 301.42)

NVIDIA Update 1.8.15 (Version: 1.8.15)

NVIDIA Update Components (Version: 1.8.15)

OpenOffice.org 3.3 (Version: 3.3.9567)

PDF Settings CS5 (Version: 10.0)

PeerBlock 1.1 (r518) (Version: 1.1.0.518)

Photo Gallery (Version: 16.4.3505.0912)

PMDG 737 8900 NGX (Version: 1.00.2888)

PMDG 747-400/400F for FSX (Version: 2.00.0031)

PMDG744X_GE_LH (Version: 1.00.0000)

PMDG744XF_RR_CVF3 (Version: 1.00.0000)

PSD Viewer

QuickTime (Version: 7.71.80.42)

RAAS Professional by FS2Crew (LOCKED)

RamDisk Plus 11.8 (Version: 11.8.1186)

REX Essential Plus Overdrive (Version: 3.7.2013.0715)

Spotify (HKCU Version: 0.9.4.185.g7545a404)

TeamSpeak 2 RC2 (Version: 2.0.32.60)

TreeX V2

Uninstall 1.0.0.1

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3)

VLC media player 2.0.7 (Version: 2.0.7)

Windows Live Communications Platform (Version: 16.4.3505.0912)

Windows Live Essentials (Version: 16.4.3505.0912)

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)

Windows Live Installer (Version: 16.4.3505.0912)

Windows Live Photo Common (Version: 16.4.3505.0912)

Windows Live PIMT Platform (Version: 16.4.3505.0912)

Windows Live SOXE (Version: 16.4.3505.0912)

Windows Live SOXE Definitions (Version: 16.4.3505.0912)

Windows Live UX Platform (Version: 16.4.3505.0912)

Windows Live UX Platform Language Pack (Version: 16.4.3505.0912)

WinRAR

Yahoo! Detect
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {2297F2AF-3F6F-45F7-8771-6E4630DE30ED} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001UA => C:\Users\Jan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-24] (Google Inc.)

Task: {584EC0E0-49F9-488E-B7F5-7CD16188829F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)

Task: {89F69F25-55C1-4BEC-8D75-BD8065B7B5C6} - System32\Tasks\bench-S-1-5-21-2384783165-3255649285-2511093218-1001 => C:\Program Files\Bench\Updater\Updater.exe [2013-10-08] ()

Task: {9152BB4C-A983-42C2-ABCB-7D02F931B205} - System32\Tasks\AdobeAAMUpdater-1.0-Jan-PC-Jan => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)

Task: {AE118B50-D7FE-442D-A294-A9A1375C1F6B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)

Task: {B00E3E50-E216-4BA2-B778-95BF1F240BBA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {B09C1838-29C0-4004-9445-8D30F0BAE203} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)

Task: {C0EE6078-2CB5-457F-9B0F-B212CD648D7E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001Core => C:\Users\Jan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-24] (Google Inc.)

Task: {DD31DA76-77A2-4D0E-AB10-3491567EECB5} - System32\Tasks\bench-sys => C:\Program Files\Bench\Updater\Updater.exe [2013-10-08] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\bench-S-1-5-21-2384783165-3255649285-2511093218-1001.job => C:\Program Files\Bench\Updater\Updater.exe

Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files\Bench\Updater\Updater.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001Core.job => C:\Users\Jan\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001UA.job => C:\Users\Jan\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2012-08-10 15:45 - 2013-10-14 00:19 - 34604032 _____ () C:\Users\Jan\AppData\Roaming\Spotify\Data\libcef.dll

2013-09-24 22:25 - 2013-10-14 00:19 - 00747008 _____ () C:\Users\Jan\AppData\Roaming\Spotify\Data\libglesv2.dll

2013-09-24 22:25 - 2013-10-14 00:19 - 00137216 _____ () C:\Users\Jan\AppData\Roaming\Spotify\Data\libegl.dll

2013-10-17 17:30 - 2013-10-09 02:01 - 00698832 _____ () C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\libglesv2.dll

2013-10-17 17:30 - 2013-10-09 02:01 - 00099792 _____ () C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\libegl.dll

2013-10-17 17:30 - 2013-10-09 02:02 - 04055504 _____ () C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\pdf.dll

2013-10-17 17:30 - 2013-10-09 02:02 - 00415184 _____ () C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll

2013-10-17 17:30 - 2013-10-09 02:01 - 01604560 _____ () C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll

2013-10-17 17:30 - 2013-10-09 02:02 - 13584336 _____ () C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 

Name: PCI-Kommunikationscontroller (einfach)

Description: PCI-Kommunikationscontroller (einfach)

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============

Error: (10/21/2013 01:32:19 AM) (Source: volsnap) (User: )

Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 48%

Total physical RAM: 3323.49 MB

Available physical RAM: 1701 MB

Total Pagefile: 6645.27 MB

Available Pagefile: 4243.11 MB

Total Virtual: 3071.88 MB

Available Virtual: 2912.39 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:146.48 GB) (Free:10.26 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 26C583DF)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=146 GB) - (Type=07 NTFS)

AdwareCleaner Log nach der Sytemreinigung:

Code:

Ordner Gelöscht : C:\Users\Jan\AppData\Local\Temp\OCS
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [ Browser ] *****
 

-\\ Internet Explorer v9.0.8112.16470
 
 

-\\ Mozilla Firefox v24.0 (de)
 

[ Datei : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\5k92taeu.default\prefs.js ]
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht : search_url

Gelöscht : suggest_url

Gelöscht : keyword

Junkware Removaltool Log nach Systemreinigung:

Code:

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
 

\Browser Helper Objects\{6EB4A4C0-6036-4D2E-B010-20707C4B62E8}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{6EB4A4C0-6036-4D2E-B010-20707C4B62E8}
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles
 

\5k92taeu.default\prefs.js
 

user_pref("iminent.versioning", "{\"CurrentVersion\":\"7.35.1.1\",\"InstallEventCTime\":1378330441355,
 

\"InstallEvent\":\"True\"}");
 
 
 

~~~ Event Viewer Logs were cleared

Über Hilfe würde ich mich wirklich sehr freuen ! :party:

So hier erstmal die Logs:

Eset Online Scanner Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=e902f59ee0bc3c44963136531cb21a71

# engine=15581

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-10-22 01:47:58

# local_time=2013-10-22 03:47:58 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 97 8252 247872968 1004 0

# compatibility_mode=5893 16776573 100 94 7950 134080869 0 0

# scanned=355578

# found=2

# cleaned=0

# scan_time=5066

sh=9E45FCF5D0B5D43A568AA2D8B7FB40F460E5BCB6 ft=1 fh=afbd1276314826e6 vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Program Files\Microsoft Games\Microsoft Flight Simulator X\MyTraffic\FSLive\ANFS.exe"

sh=2BEC3A89EB5BF0BED90AD0923C7D12D44AEB3111 ft=1 fh=169012abcb12da52 vn="Win32/SuspLibLoad.B trojan" ac=I fn="C:\Windows\System32\flt1chk4.dll"

Security Check Log:

Code:

y Results of screen317's Security Check version 0.99.74  

 Windows 7 Service Pack 1 x86 (UAC is disabled!)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java(TM) 6 Update 22  

 Java(TM) 6 Update 30  

 Java 7 Update 17  

 Java version out of Date! 

 Adobe Flash Player         11.9.900.117  

 Adobe Reader 10.0.1 Adobe Reader out of Date!  

 Mozilla Firefox (24.0) 

 Google Chrome 30.0.1599.101  

 Google Chrome 30.0.1599.69  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Neuer FRST Log:

Code:

Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Spotify Ltd) C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Update\1.3.21.165\GoogleCrashHandler.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jucheck.exe

(Microsoft Corporation) C:\Windows\system32\wuauclt.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)

HKCU\...\Run: [AdobeBridge] - [x]

HKCU\...\Run: [Google Update] - C:\Users\Jan\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-03-24] (Google Inc.)

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-10-14] (Spotify Ltd)

HKCU\...\Run: [Spotify] - C:\Users\Jan\AppData\Roaming\Spotify\spotify.exe [4752384 2013-10-14] (Spotify Ltd)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xDF85CD79F078CB01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

URLSearchHook: (No Name) - {32b29df0-2237-4370-9a29-37cebb730e9b} -  No File

SearchScopes: HKLM - DefaultScope value is missing.

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - No Name - {32B29DF0-2237-4370-9A29-37CEBB730E9B} -  No File

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\5k92taeu.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Jan\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Jan\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Instant Savings App - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\5k92taeu.default\Extensions\{33971AE8-1817-AD51-256D-BCA1D0954E1E}
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Conduit Search) - hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP0A736D04-DC77-4AF5-A656-4F49864D2EBD&q={searchTerms}

CHR DefaultSuggestURL: (Conduit Search) - hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\Jan\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)

CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (NapsterLink) - C:\Program Files\Mozilla Firefox\plugins\npstrlnk.dll No File

CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Google Update) - C:\Users\Jan\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Jan\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll No File

CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (AdBlock) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.10_0

CHR Extension: (iOS, iPad, iPhone & iPod Grey Texture) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\odgbpcbfijafedicgoagncajafompaok\2_0

CHR Extension: (Gmail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM\...\Chrome\Extension: [knkakpihealnpggeceajhaonlmgdkaip] - C:\Users\Jan\AppData\Local\CRE\knkakpihealnpggeceajhaonlmgdkaip.crx

CHR StartMenuInternet: Google Chrome - C:\Users\Jan\AppData\Local\Google\Chrome\Application\chrome.exe
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2012-10-23] (Flexera Software, Inc.)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [4176896 2011-10-12] (Native Instruments GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-07] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-07] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R0 SscRdBus; C:\Windows\System32\DRIVERS\SscRdBus.sys [91336 2013-04-01] (SuperSpeed LLC)

R0 SscRdCls; C:\Windows\System32\DRIVERS\SscRdCls.sys [40984 2007-12-19] (SuperSpeed LLC)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-22 16:03 - 2013-10-22 16:03 - 00001202 _____ C:\Users\Jan\Desktop\checkup.txt

2013-10-22 14:21 - 2013-10-22 14:21 - 00000000 ____D C:\Program Files\ESET

2013-10-22 14:18 - 2013-10-22 14:18 - 02347384 _____ (ESET) C:\Users\Jan\Downloads\esetsmartinstaller_enu.exe

2013-10-22 14:18 - 2013-10-22 14:18 - 02347384 _____ (ESET) C:\Users\Jan\Desktop\esetsmartinstaller_enu.exe

2013-10-22 14:18 - 2013-10-22 14:18 - 00891167 _____ C:\Users\Jan\Desktop\SecurityCheck.exe

2013-10-22 14:17 - 2013-10-22 14:18 - 00891167 _____ C:\Users\Jan\Downloads\SecurityCheck.exe

2013-10-21 23:11 - 2013-10-21 23:11 - 00002828 _____ C:\Users\UpdatusUser\Desktop\Genova Sestri Ponenta (Italian only).lnk

2013-10-21 23:11 - 2013-10-21 23:11 - 00002723 _____ C:\Users\UpdatusUser\Desktop\Liguria Manual 110.lnk

2013-10-21 23:11 - 2013-10-21 23:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OZx

2013-10-21 22:55 - 2013-10-21 23:08 - 980665629 _____ C:\Users\Jan\Downloads\OZx_Liguria_1.1.zip

2013-10-21 14:43 - 2013-10-21 14:44 - 00000000 ____D C:\Users\Jan\Desktop\FPS_Limiter_0.2

2013-10-21 14:42 - 2013-10-21 14:42 - 00336123 _____ C:\Users\Jan\Downloads\FPS_Limiter_0.2.zip

2013-10-21 14:34 - 2013-10-21 14:34 - 00013718 _____ C:\Users\Jan\Downloads\fsx.cfg

2013-10-21 14:19 - 2013-10-21 14:19 - 00000000 ____D C:\Users\Jan\Desktop\Malware

2013-10-21 01:31 - 2013-10-21 01:31 - 00000000 ____D C:\FRST

2013-10-21 01:29 - 2013-10-21 01:29 - 00000240 _____ C:\Users\Jan\Downloads\defogger_enable.log

2013-10-21 01:28 - 2013-10-21 01:29 - 00000468 _____ C:\Users\Jan\Downloads\defogger_disable.log

2013-10-21 01:28 - 2013-10-21 01:28 - 00050477 _____ C:\Users\Jan\Downloads\Defogger.exe

2013-10-21 01:24 - 2013-10-21 01:24 - 00614816 _____ C:\Users\Jan\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-21 00:41 - 2013-10-21 00:41 - 00000000 ____D C:\Windows\ERUNT

2013-10-21 00:38 - 2013-10-21 01:40 - 00000000 ____D C:\AdwCleaner

2013-10-21 00:38 - 2013-10-21 00:38 - 01033335 _____ (Thisisu) C:\Users\Jan\Downloads\JRT.exe

2013-10-21 00:37 - 2013-10-21 00:37 - 01060070 _____ C:\Users\Jan\Downloads\adwcleaner.exe

2013-10-19 15:11 - 2013-10-19 15:11 - 00002410 _____ C:\Users\Jan\Desktop\FTX Central.lnk

2013-10-19 15:11 - 2013-10-19 15:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Orbx

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\MSDOS.SYS

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\IO.SYS

2013-10-18 23:55 - 2013-10-21 00:35 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-17 19:49 - 2013-10-17 19:49 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-17 19:49 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-10-17 19:48 - 2013-10-17 19:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Jan\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-14 14:22 - 2013-10-14 14:22 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FSX Scenery ISTANBUL ATATURK AIRPORT (LTBA)

2013-10-14 13:22 - 2013-10-14 13:23 - 00000000 ____D C:\Program Files\TreeX

2013-10-14 13:18 - 2013-10-14 13:18 - 17640674 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_X3.zip

2013-10-14 13:17 - 2013-10-14 13:18 - 17324105 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_BA.zip

2013-10-14 13:17 - 2013-10-14 13:18 - 14664230 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_OS.zip

2013-10-14 13:17 - 2013-10-14 13:17 - 10734499 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_AB.zip

2013-10-14 13:01 - 2013-10-14 13:14 - 11790103 _____ C:\Users\Jan\Downloads\treex_v2.zip

2013-10-14 01:09 - 2013-10-14 01:09 - 00002418 _____ C:\Users\Jan\Downloads\enbseries.ini

2013-10-13 15:29 - 2013-10-13 15:29 - 00002196 _____ C:\Users\Jan\Desktop\Livery Manager.lnk

2013-10-12 16:34 - 2013-10-12 16:34 - 02105040 _____ (PeerBlock, LLC                                              ) C:\Users\Jan\Downloads\PeerBlock-Setup_v1.1_r518.exe

2013-10-12 16:32 - 2013-10-22 13:35 - 00000328 _____ C:\Windows\Tasks\bench-sys.job

2013-10-12 16:32 - 2013-10-22 00:42 - 00000328 _____ C:\Windows\Tasks\bench-S-1-5-21-2384783165-3255649285-2511093218-1001.job

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Users\Jan\AppData\Local\BenchUpdater

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Program Files\Bench

2013-10-12 16:31 - 2013-10-12 16:31 - 01141328 _____ (BitTorrent Inc.) C:\Users\Jan\Downloads\utorrent3.3.2.exe

2013-10-12 01:04 - 2013-10-12 01:04 - 00001699 _____ C:\Users\Public\Desktop\REX Essential Plus Overdrive.lnk

2013-10-12 01:04 - 2013-10-12 01:04 - 00000000 ____D C:\ProgramData\Caphyon

2013-10-12 00:55 - 2013-10-22 14:21 - 00000000 ____D C:\REX Essential Plus Overdrive

2013-10-11 20:21 - 2013-10-11 20:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\RAASPRO

2013-10-11 19:51 - 2013-10-11 19:51 - 00031979 _____ C:\Users\Jan\Downloads\AS_AIRBUSX_COMPANY_ROUTE_EDITOR_V1_01.zip

2013-10-11 19:39 - 2013-10-11 19:39 - 00000000 ____D C:\Users\Jan\AppData\Local\Downloaded Installations

2013-10-11 17:00 - 2013-10-11 17:00 - 00000000 ____D C:\Users\Jan\AppData\Roaming\ICE AI Traffic Group

2013-10-11 16:56 - 2013-10-11 17:00 - 308732222 _____ (ICE AI Traffic Group) C:\Users\Jan\Downloads\ICEAITrafficFSX(2.01).exe

2013-10-11 15:51 - 2012-05-15 12:26 - 19607872 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 17551680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 11354944 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2013-10-11 15:51 - 2012-05-15 12:26 - 05982528 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 02524992 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2013-10-11 15:51 - 2012-05-15 12:26 - 02445120 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2013-10-09 18:15 - 2013-10-09 18:15 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Frankfurt-Main Airport v7

2013-10-07 19:40 - 2013-10-07 19:47 - 00000000 ____D C:\Users\Jan\Desktop\Abi

2013-10-06 20:59 - 2013-10-06 20:59 - 00000000 __SHD C:\found.001

2013-10-06 18:31 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll

2013-10-06 18:31 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll

2013-10-06 18:31 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll

2013-10-06 18:29 - 2013-10-11 20:10 - 00000000 ____D C:\Users\Jan\Documents\Aerosoft

2013-10-05 15:54 - 2013-10-05 15:54 - 00034064 _____ (Microsoft Corporation) C:\Windows\system32\lhacm.acm

2013-10-05 15:54 - 2013-10-05 15:54 - 00000952 _____ C:\Users\UpdatusUser\Desktop\Teamspeak 2 RC2.lnk

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\teamspeak2

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Program Files\Teamspeak2_RC2

2013-10-05 03:23 - 2013-10-05 16:14 - 00000000 ____D C:\Users\Jan\AppData\Roaming\TS3Client

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Users\Jan\AppData\Roaming\IVAO

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Program Files\IVAO

2013-10-01 16:18 - 2013-10-01 16:18 - 27267072 ____H C:\SsRd0001.cif

2013-10-01 16:13 - 2013-10-01 16:13 - 00000000 ____D C:\Program Files\SuperSpeed

2013-09-30 16:52 - 2013-10-19 15:45 - 00001123 _____ C:\Windows\Roll Target

2013-09-30 16:52 - 2013-10-19 15:45 - 00001123 _____ C:\Windows\Pitch Target

2013-09-30 16:52 - 2013-10-19 15:45 - 00001115 _____ C:\Windows\Roll Error

2013-09-30 16:52 - 2013-10-19 15:45 - 00001114 _____ C:\Windows\Pitch Error

2013-09-30 16:52 - 2013-10-19 15:45 - 00001105 _____ C:\Windows\Gyro Speed

2013-09-30 16:52 - 2013-10-19 15:45 - 00001005 _____ C:\Windows\Mode2ATimer

2013-09-30 16:52 - 2013-10-19 15:45 - 00001005 _____ C:\Windows\Mode2_AltGain_timer

2013-09-30 16:52 - 2013-10-19 15:45 - 00001001 _____ C:\Windows\Mode2BTimer

2013-09-30 16:52 - 2013-10-19 15:45 - 00000657 _____ C:\Windows\CDU.1

2013-09-30 16:52 - 2013-10-19 15:45 - 00000657 _____ C:\Windows\CDU.0

2013-09-26 16:14 - 2013-09-26 16:14 - 97961477 _____ C:\Windows\system32\Ư偘m

2013-09-25 19:19 - 2013-09-25 19:19 - 00000000 ____D C:\Program Files\Lame For Audacity

2013-09-25 18:32 - 2013-09-25 18:32 - 00000969 _____ C:\Users\Public\Desktop\Audacity.lnk

2013-09-25 18:32 - 2013-09-25 18:32 - 00000000 ____D C:\Program Files\Audacity
 

==================== One Month Modified Files and Folders =======
 

2013-10-22 16:03 - 2013-10-22 16:03 - 00001202 _____ C:\Users\Jan\Desktop\checkup.txt

2013-10-22 16:02 - 2010-10-31 20:29 - 01161073 _____ C:\Windows\WindowsUpdate.log

2013-10-22 15:33 - 2012-10-18 15:08 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-10-22 15:27 - 2012-03-24 01:26 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001UA.job

2013-10-22 15:20 - 2012-05-09 08:23 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-10-22 14:27 - 2012-03-24 01:26 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2384783165-3255649285-2511093218-1001Core.job

2013-10-22 14:21 - 2013-10-22 14:21 - 00000000 ____D C:\Program Files\ESET

2013-10-22 14:21 - 2013-10-12 00:55 - 00000000 ____D C:\REX Essential Plus Overdrive

2013-10-22 14:18 - 2013-10-22 14:18 - 02347384 _____ (ESET) C:\Users\Jan\Downloads\esetsmartinstaller_enu.exe

2013-10-22 14:18 - 2013-10-22 14:18 - 02347384 _____ (ESET) C:\Users\Jan\Desktop\esetsmartinstaller_enu.exe

2013-10-22 14:18 - 2013-10-22 14:18 - 00891167 _____ C:\Users\Jan\Desktop\SecurityCheck.exe

2013-10-22 14:18 - 2013-10-22 14:17 - 00891167 _____ C:\Users\Jan\Downloads\SecurityCheck.exe

2013-10-22 13:44 - 2012-08-10 15:45 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Spotify

2013-10-22 13:37 - 2009-07-14 06:34 - 00014800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-22 13:37 - 2009-07-14 06:34 - 00014800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-22 13:35 - 2013-10-12 16:32 - 00000328 _____ C:\Windows\Tasks\bench-sys.job

2013-10-22 13:30 - 2012-08-10 15:45 - 00000000 ____D C:\Users\Jan\AppData\Local\Spotify

2013-10-22 13:29 - 2012-10-18 15:07 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-10-22 13:29 - 2010-10-31 15:36 - 00000000 ____D C:\ProgramData\NVIDIA

2013-10-22 13:29 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-22 13:29 - 2009-07-14 06:39 - 00114645 _____ C:\Windows\setupact.log

2013-10-22 02:46 - 2013-04-01 17:59 - 00618459 _____ C:\Windows\IE10_main.log

2013-10-22 02:15 - 2013-04-11 16:25 - 00000000 ____D C:\Users\Jan\Desktop\Stuff

2013-10-22 00:42 - 2013-10-12 16:32 - 00000328 _____ C:\Windows\Tasks\bench-S-1-5-21-2384783165-3255649285-2511093218-1001.job

2013-10-21 23:11 - 2013-10-21 23:11 - 00002828 _____ C:\Users\UpdatusUser\Desktop\Genova Sestri Ponenta (Italian only).lnk

2013-10-21 23:11 - 2013-10-21 23:11 - 00002723 _____ C:\Users\UpdatusUser\Desktop\Liguria Manual 110.lnk

2013-10-21 23:11 - 2013-10-21 23:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OZx

2013-10-21 23:08 - 2013-10-21 22:55 - 980665629 _____ C:\Users\Jan\Downloads\OZx_Liguria_1.1.zip

2013-10-21 14:44 - 2013-10-21 14:43 - 00000000 ____D C:\Users\Jan\Desktop\FPS_Limiter_0.2

2013-10-21 14:42 - 2013-10-21 14:42 - 00336123 _____ C:\Users\Jan\Downloads\FPS_Limiter_0.2.zip

2013-10-21 14:34 - 2013-10-21 14:34 - 00013718 _____ C:\Users\Jan\Downloads\fsx.cfg

2013-10-21 14:19 - 2013-10-21 14:19 - 00000000 ____D C:\Users\Jan\Desktop\Malware

2013-10-21 01:40 - 2013-10-21 00:38 - 00000000 ____D C:\AdwCleaner

2013-10-21 01:31 - 2013-10-21 01:31 - 00000000 ____D C:\FRST

2013-10-21 01:29 - 2013-10-21 01:29 - 00000240 _____ C:\Users\Jan\Downloads\defogger_enable.log

2013-10-21 01:29 - 2013-10-21 01:28 - 00000468 _____ C:\Users\Jan\Downloads\defogger_disable.log

2013-10-21 01:29 - 2010-10-31 13:34 - 00000000 ____D C:\Users\Jan

2013-10-21 01:28 - 2013-10-21 01:28 - 00050477 _____ C:\Users\Jan\Downloads\Defogger.exe

2013-10-21 01:24 - 2013-10-21 01:24 - 00614816 _____ C:\Users\Jan\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-21 00:41 - 2013-10-21 00:41 - 00000000 ____D C:\Windows\ERUNT

2013-10-21 00:40 - 2012-12-30 03:08 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-10-21 00:39 - 2012-12-10 16:09 - 00000000 ____D C:\ProgramData\Uniblue

2013-10-21 00:39 - 2012-12-09 21:47 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft

2013-10-21 00:39 - 2010-10-31 15:42 - 00000000 ____D C:\ProgramData\ICQ

2013-10-21 00:38 - 2013-10-21 00:38 - 01033335 _____ (Thisisu) C:\Users\Jan\Downloads\JRT.exe

2013-10-21 00:37 - 2013-10-21 00:37 - 01060070 _____ C:\Users\Jan\Downloads\adwcleaner.exe

2013-10-21 00:35 - 2013-10-18 23:55 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-21 00:35 - 2010-10-31 14:43 - 00000000 ____D C:\Users\Jan\AppData\Local\Mozilla

2013-10-21 00:33 - 2011-10-15 12:28 - 00000000 ____D C:\Windows\CheckSur

2013-10-21 00:33 - 2010-10-31 15:40 - 00081722 _____ C:\Windows\PFRO.log

2013-10-19 17:10 - 2012-10-23 14:07 - 00000000 ____D C:\Users\Jan\AppData\Roaming\uTorrent

2013-10-19 15:45 - 2013-09-30 16:52 - 00001123 _____ C:\Windows\Roll Target

2013-10-19 15:45 - 2013-09-30 16:52 - 00001123 _____ C:\Windows\Pitch Target

2013-10-19 15:45 - 2013-09-30 16:52 - 00001115 _____ C:\Windows\Roll Error

2013-10-19 15:45 - 2013-09-30 16:52 - 00001114 _____ C:\Windows\Pitch Error

2013-10-19 15:45 - 2013-09-30 16:52 - 00001105 _____ C:\Windows\Gyro Speed

2013-10-19 15:45 - 2013-09-30 16:52 - 00001005 _____ C:\Windows\Mode2ATimer

2013-10-19 15:45 - 2013-09-30 16:52 - 00001005 _____ C:\Windows\Mode2_AltGain_timer

2013-10-19 15:45 - 2013-09-30 16:52 - 00001001 _____ C:\Windows\Mode2BTimer

2013-10-19 15:45 - 2013-09-30 16:52 - 00000657 _____ C:\Windows\CDU.1

2013-10-19 15:45 - 2013-09-30 16:52 - 00000657 _____ C:\Windows\CDU.0

2013-10-19 15:40 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-10-19 15:11 - 2013-10-19 15:11 - 00002410 _____ C:\Users\Jan\Desktop\FTX Central.lnk

2013-10-19 15:11 - 2013-10-19 15:11 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Orbx

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\MSDOS.SYS

2013-10-19 14:52 - 2013-10-19 14:52 - 00000000 __RSH C:\IO.SYS

2013-10-19 14:50 - 2010-10-31 15:24 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2013-10-17 19:49 - 2013-10-17 19:49 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-17 19:49 - 2013-10-17 19:49 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-17 19:48 - 2013-10-17 19:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Jan\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-17 17:30 - 2012-03-24 01:26 - 00002356 _____ C:\Users\Jan\Desktop\Google Chrome.lnk

2013-10-14 14:22 - 2013-10-14 14:22 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FSX Scenery ISTANBUL ATATURK AIRPORT (LTBA)

2013-10-14 13:23 - 2013-10-14 13:22 - 00000000 ____D C:\Program Files\TreeX

2013-10-14 13:18 - 2013-10-14 13:18 - 17640674 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_X3.zip

2013-10-14 13:18 - 2013-10-14 13:17 - 17324105 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_BA.zip

2013-10-14 13:18 - 2013-10-14 13:17 - 14664230 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_OS.zip

2013-10-14 13:17 - 2013-10-14 13:17 - 10734499 _____ C:\Users\Jan\Downloads\PMDG_737NGX_800WL_AB.zip

2013-10-14 13:14 - 2013-10-14 13:01 - 11790103 _____ C:\Users\Jan\Downloads\treex_v2.zip

2013-10-14 13:00 - 2010-10-31 20:30 - 00389860 _____ C:\Windows\system32\PerfStringBackup.INI

2013-10-14 01:09 - 2013-10-14 01:09 - 00002418 _____ C:\Users\Jan\Downloads\enbseries.ini

2013-10-13 15:29 - 2013-10-13 15:29 - 00002196 _____ C:\Users\Jan\Desktop\Livery Manager.lnk

2013-10-12 16:34 - 2013-10-12 16:34 - 02105040 _____ (PeerBlock, LLC                                              ) C:\Users\Jan\Downloads\PeerBlock-Setup_v1.1_r518.exe

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Users\Jan\AppData\Local\BenchUpdater

2013-10-12 16:32 - 2013-10-12 16:32 - 00000000 ____D C:\Program Files\Bench

2013-10-12 16:31 - 2013-10-12 16:31 - 01141328 _____ (BitTorrent Inc.) C:\Users\Jan\Downloads\utorrent3.3.2.exe

2013-10-12 01:04 - 2013-10-12 01:04 - 00001699 _____ C:\Users\Public\Desktop\REX Essential Plus Overdrive.lnk

2013-10-12 01:04 - 2013-10-12 01:04 - 00000000 ____D C:\ProgramData\Caphyon

2013-10-11 20:21 - 2013-10-11 20:21 - 00000000 ____D C:\Users\Jan\AppData\Roaming\RAASPRO

2013-10-11 20:10 - 2013-10-06 18:29 - 00000000 ____D C:\Users\Jan\Documents\Aerosoft

2013-10-11 19:51 - 2013-10-11 19:51 - 00031979 _____ C:\Users\Jan\Downloads\AS_AIRBUSX_COMPANY_ROUTE_EDITOR_V1_01.zip

2013-10-11 19:39 - 2013-10-11 19:39 - 00000000 ____D C:\Users\Jan\AppData\Local\Downloaded Installations

2013-10-11 17:00 - 2013-10-11 17:00 - 00000000 ____D C:\Users\Jan\AppData\Roaming\ICE AI Traffic Group

2013-10-11 17:00 - 2013-10-11 16:56 - 308732222 _____ (ICE AI Traffic Group) C:\Users\Jan\Downloads\ICEAITrafficFSX(2.01).exe

2013-10-11 15:53 - 2010-10-31 15:35 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2013-10-10 16:31 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-09 18:20 - 2012-05-09 08:23 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-10-09 18:20 - 2011-11-23 21:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-10-09 18:15 - 2013-10-09 18:15 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Frankfurt-Main Airport v7

2013-10-07 19:47 - 2013-10-07 19:40 - 00000000 ____D C:\Users\Jan\Desktop\Abi

2013-10-07 19:41 - 2013-05-15 18:54 - 00000000 ____D C:\Users\Jan\Desktop\Wichtig

2013-10-07 12:53 - 2013-05-06 13:12 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-10-07 12:53 - 2012-10-25 11:59 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-10-07 12:53 - 2012-10-25 11:59 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-10-07 12:53 - 2012-10-25 11:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-10-06 20:59 - 2013-10-06 20:59 - 00000000 __SHD C:\found.001

2013-10-06 19:10 - 2010-10-31 15:49 - 00068984 _____ C:\Users\Jan\AppData\Local\GDIPFONTCACHEV1.DAT

2013-10-06 19:10 - 2009-07-14 06:33 - 03664032 _____ C:\Windows\system32\FNTCACHE.DAT

2013-10-05 16:14 - 2013-10-05 03:23 - 00000000 ____D C:\Users\Jan\AppData\Roaming\TS3Client

2013-10-05 15:54 - 2013-10-05 15:54 - 00034064 _____ (Microsoft Corporation) C:\Windows\system32\lhacm.acm

2013-10-05 15:54 - 2013-10-05 15:54 - 00000952 _____ C:\Users\UpdatusUser\Desktop\Teamspeak 2 RC2.lnk

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\teamspeak2

2013-10-05 15:54 - 2013-10-05 15:54 - 00000000 ____D C:\Program Files\Teamspeak2_RC2

2013-10-05 02:04 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Users\Jan\AppData\Roaming\IVAO

2013-10-05 02:03 - 2013-10-05 02:03 - 00000000 ____D C:\Program Files\IVAO

2013-10-01 16:18 - 2013-10-01 16:18 - 27267072 ____H C:\SsRd0001.cif

2013-10-01 16:13 - 2013-10-01 16:13 - 00000000 ____D C:\Program Files\SuperSpeed

2013-09-29 14:42 - 2012-11-04 15:08 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Aerosoft

2013-09-26 16:14 - 2013-09-26 16:14 - 97961477 _____ C:\Windows\system32\Ư偘m

2013-09-25 22:57 - 2010-11-15 21:32 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Audacity

2013-09-25 19:19 - 2013-09-25 19:19 - 00000000 ____D C:\Program Files\Lame For Audacity

2013-09-25 18:32 - 2013-09-25 18:32 - 00000969 _____ C:\Users\Public\Desktop\Audacity.lnk

2013-09-25 18:32 - 2013-09-25 18:32 - 00000000 ____D C:\Program Files\Audacity

2013-09-25 16:55 - 2013-06-30 00:26 - 00000000 ____D C:\Users\Jan\AppData\Roaming\vlc

2013-09-25 16:30 - 2012-11-02 23:27 - 00000000 ____D C:\Users\Jan\AppData\Local\Windows Live
 

Files to move or delete:

====================

C:\Users\Jan\jagex_cl_runescape_LIVE.dat

C:\Users\Jan\Photoshop_12_LS4.exe

C:\Users\Jan\random.dat
 
 

Some content of TEMP:

====================

C:\Users\Jan\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\Users\Jan\AppData\Local\Temp\AskSLib.dll

C:\Users\Jan\AppData\Local\Temp\AutoRun.exe

C:\Users\Jan\AppData\Local\Temp\AutoRunGUI.dll

C:\Users\Jan\AppData\Local\Temp\avgnt.exe

C:\Users\Jan\AppData\Local\Temp\BingBarSetup-Partner.exe

C:\Users\Jan\AppData\Local\Temp\bpuninstall.exe

C:\Users\Jan\AppData\Local\Temp\BrowserPlus.exe

C:\Users\Jan\AppData\Local\Temp\contentDATs.exe

C:\Users\Jan\AppData\Local\Temp\eauninstall.exe

C:\Users\Jan\AppData\Local\Temp\firefoxjre_exe.exe

C:\Users\Jan\AppData\Local\Temp\i4jdel0.exe

C:\Users\Jan\AppData\Local\Temp\IcqUpdater.exe

C:\Users\Jan\AppData\Local\Temp\InstallManager_GEN_GEN.exe

C:\Users\Jan\AppData\Local\Temp\instmsia.exe

C:\Users\Jan\AppData\Local\Temp\instmsiw.exe

C:\Users\Jan\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe

C:\Users\Jan\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe

C:\Users\Jan\AppData\Local\Temp\nse88E9.exe

C:\Users\Jan\AppData\Local\Temp\nseAB0B.exe

C:\Users\Jan\AppData\Local\Temp\nsfE8C0.exe

C:\Users\Jan\AppData\Local\Temp\nso8668.exe

C:\Users\Jan\AppData\Local\Temp\nsoACD0.exe

C:\Users\Jan\AppData\Local\Temp\nspE506.exe

C:\Users\Jan\AppData\Local\Temp\nspE6DB.exe

C:\Users\Jan\AppData\Local\Temp\nspEECA.exe

C:\Users\Jan\AppData\Local\Temp\nst837A.exe

C:\Users\Jan\AppData\Local\Temp\nsuF0BE.exe

C:\Users\Jan\AppData\Local\Temp\nszA965.exe

C:\Users\Jan\AppData\Local\Temp\nszECE5.exe

C:\Users\Jan\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Jan\AppData\Local\Temp\nvSCPAPISvr.exe

C:\Users\Jan\AppData\Local\Temp\nvStInst.exe

C:\Users\Jan\AppData\Local\Temp\Quarantine.exe

C:\Users\Jan\AppData\Local\Temp\RegAsm.exe

C:\Users\Jan\AppData\Local\Temp\SecurityScan_Release.exe

C:\Users\Jan\AppData\Local\Temp\setup.exe

C:\Users\Jan\AppData\Local\Temp\SpotifyUpgrader.exe

C:\Users\Jan\AppData\Local\Temp\tbedrs.dll

C:\Users\Jan\AppData\Local\Temp\tbFre0.dll

C:\Users\Jan\AppData\Local\Temp\tbuTor.dll

C:\Users\Jan\AppData\Local\Temp\UEFA Champions League 2004 - 2005_uninst.exe

C:\Users\Jan\AppData\Local\Temp\UpdaterCopy.exe

C:\Users\Jan\AppData\Local\Temp\utt376E.tmp.exe

C:\Users\Jan\AppData\Local\Temp\uttB3EE.tmp.exe

C:\Users\Jan\AppData\Local\Temp\_is369C.exe

C:\Users\Jan\AppData\Local\Temp\_is475.exe

C:\Users\Jan\AppData\Local\Temp\_is4DA2.exe

C:\Users\Jan\AppData\Local\Temp\_is4ED6.exe

C:\Users\Jan\AppData\Local\Temp\_is62B8.exe

C:\Users\Jan\AppData\Local\Temp\_is9789.exe

C:\Users\Jan\AppData\Local\Temp\_isC4E4.exe

C:\Users\Jan\AppData\Local\Temp\_isC763.exe

C:\Users\Jan\AppData\Local\Temp\_isDD9.exe

C:\Users\Jan\AppData\Local\Temp\_isDE8B.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-21 16:24
 

==================== End Of Log ============================

Es ist bisher nichts mehr aufgetreten, vielen Dank für die bisherige Hilfe :)