Trojaner-Board - Windows 7: Habe mir einen GVU-Trojaner eingefangen und keinen Erfolg mit der Kaspersky boot cd

Als erste, vielen Dank für die schnelle Antwort.
Hab soweit alles gemacht. Beim Start von Combofix kam die Meldung, dass ein Real-Time-Scanner noch aktiv ist (Avira Desktop), hab dies überprüft, war aber meiner Meinung nach abgeschalten und so bin ich fortgefahren.

Hier das Logfile:

Code:

ComboFix 14-01-08.02 - Flo 08.01.2014  16:17:48.1.2 - x64 NETWORK

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6124.5208 [GMT 1:00]

ausgeführt von:: c:\users\Flo\Desktop\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AV: Trend Micro Titanium Internet Security *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Trend Micro Titanium Internet Security *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\2433f433

c:\programdata\eerdz6ioc.pad

c:\programdata\ez6ddioc.pad

c:\programdata\ez6ioc.bat

c:\programdata\ez6ioc.pad

c:\programdata\ez6ioc;l.pad

c:\programdata\windows

c:\programdata\windows\ccdxmmde.dat

c:\programdata\windows\drss.dat

c:\users\Flo\AppData\Local\KB1161263\KB1161263.exe

c:\users\Flo\AppData\Roaming\2433f433

c:\users\Flo\AppData\Roaming\337

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\ebase.dll

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\image\default\app_close.png

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\image\default\app_max.png

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\image\default\app_min.png

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\image\default\app_restore.png

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\image\default\wallpaper_resource.xml

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\image\default\window.png

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\language\en_us\wallpaper_lang.ini

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\language\es_es\wallpaper_lang.ini

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\language\pt_br\wallpaper_lang.ini

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\language\tr_tr\wallpaper_lang.ini

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\language\zh_tw\wallpaper_lang.ini

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\layout\default\dp_appwnd.xml

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\layout\default\msgbox.xml

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\libpng.dll

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\main

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\msvcp100.dll

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\msvcr100.dll

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\ouilibnl.dll

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\plusapp.exe

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\style\wallpaper_style.xml

c:\users\Flo\AppData\Roaming\337\337 Wallpaper\TrayDownloader.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-12-08 bis 2014-01-08  ))))))))))))))))))))))))))))))

.

.

2014-01-08 21:58 . 2014-01-08 21:58        --------        d-----w-        C:\FRST

2014-01-08 15:28 . 2014-01-08 15:28        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-01-07 19:36 . 2014-01-07 20:10        --------        d-----w-        c:\programdata\HitmanPro

2014-01-07 19:29 . 2014-01-07 19:29        --------        d-----w-        C:\found.000

2014-01-06 17:24 . 2014-01-08 15:27        --------        d-----w-        c:\users\Flo\AppData\Local\KB1161263

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-12-12 12:08 . 2013-05-17 14:54        84720        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-12-12 12:08 . 2013-05-13 17:33        131576        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-12-12 12:08 . 2013-05-13 17:33        108440        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-12-11 14:46 . 2012-05-24 19:27        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-12-11 14:46 . 2012-05-24 19:27        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-11-14 11:44 . 2013-05-13 17:33        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-01 1521800]

"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll" [2012-09-20 508744]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

2012-09-20 09:34        508744        ----a-w-        c:\users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2013-04-01 10:59        1521800        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll" [2012-09-20 508744]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-01 1521800]

.

[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-10-19 3331312]

"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 737104]

"SonicMasterTray"="c:\program files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]

"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-09-13 2317312]

"UIExec"="c:\program files (x86)\Join Air\UIExec.exe" [2010-04-27 138072]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-04-01 1646216]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-12 684600]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-10-01 152392]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

R2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

R2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

R2 JuniperAccessService;Juniper Unified Network Service;c:\program files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe;c:\program files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe [x]

R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

R2 TiMiniService;TiMiniService;c:\program files\Trend Micro\Titanium\TiMiniService.exe;c:\program files\Trend Micro\Titanium\TiMiniService.exe [x]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys;c:\windows\SYSNATIVE\DRIVERS\tmevtmgr.sys [x]

R2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\Join Air\AssistantServices.exe;c:\program files (x86)\Join Air\AssistantServices.exe [x]

R3 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

R3 DxVGrb;DxVGrb;c:\windows\system32\drivers\DxVGrb.sys;c:\windows\SYSNATIVE\drivers\DxVGrb.sys [x]

R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]

R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - PWLDYPOW

*Deregistered* - pwldypow

.

Inhalt des "geplante Tasks" Ordners

.

2014-01-06 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-24 14:46]

.

2013-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-12 13:38]

.

2013-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-12 13:38]

.

2014-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001Core.job

- c:\users\Flo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-30 10:23]

.

2014-01-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001UA.job

- c:\users\Flo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-30 10:23]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2011-05-25 07:09        227840        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2011-05-25 07:09        227840        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VizorHtmlDialog.exe"="c:\program files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe" [2010-10-08 1123664]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-10-12 192520]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\VizorShortCut.exe" [2010-09-17 322384]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://search.conduit.com?SearchSource=10&CUI=UN41410400116459006&UM=2&ctid=CT3312331

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Free YouTube to MP3 Converter - c:\users\Flo\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312331&CUI=UN20007500442234242&UM=2&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - appbarioDE Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3312331&octid=CT3312331&SearchSource=61&CUI=UN20007500442234242&UM=2&UP=SP0E9A2754-9745-4AD6-A50C-DEBFE6E14370&SSPV=

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312331&SearchSource=2&CUI=UN20007500442234242&UM=2&q=

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-KB1161263 - c:\users\Flo\AppData\Local\KB1161263\KB1161263.exe

Wow6432Node-HKLM-Run-ArcSoft Connection Service - c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)

HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe

AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr

AddRemove-Everest Casino - c:\program files (x86)\Everest Casino\cstart.exe

AddRemove-Everest Poker - c:\program files (x86)\Everest Poker\cstart.exe

AddRemove-zulagames - c:\program files (x86)\Zula Games\uninst.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-01-08  16:37:07

ComboFix-quarantined-files.txt  2014-01-08 15:37

.

Vor Suchlauf: 11 Verzeichnis(se), 71.137.284.096 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 72.908.128.256 Bytes frei

.

- - End Of File - - 7AA8D530CCBA45BB37586401E8E1EDC1

A36C5E4F47E84449FF07ED3517B43A31

und hier FRST.txt

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014

Ran by Flo (administrator) on FLO-PC on 08-01-2014 16:48:28

Running from C:\Users\Flo\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Google Inc.) C:\Users\Flo\AppData\Local\Google\Chrome\Application\chrome.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [VizorHtmlDialog.exe] - C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe [1123664 2010-10-08] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe [192520 2010-10-12] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe [322384 2010-09-17] (Trend Micro Inc.)

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)

HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini [357 2014-01-07] ()

HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\aprp.exe [3331312 2011-10-19] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)

HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)

HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS)

HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Join Air\UIExec.exe [138072 2010-04-27] ()

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1646216 2013-04-01] (Ask)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&CUI=UN41410400116459006&UM=2&ctid=CT3312331

URLSearchHook: HKLM-x32 - DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

URLSearchHook: HKCU - DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope {667584AE-2645-4258-ACF6-BDFA7EBF7B43} URL = 

SearchScopes: HKCU - DefaultScope {667584AE-2645-4258-ACF6-BDFA7EBF7B43} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3312331&CUI=UN41410400116459006&UM=2

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=645900FF9001B806&affID=120524&tt=02102013_mx10rsb&tsp=5034

SearchScopes: HKCU - {667584AE-2645-4258-ACF6-BDFA7EBF7B43} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3312331&CUI=UN41410400116459006&UM=2

SearchScopes: HKCU - {8FCF34B3-42BB-4821-9580-9FEDB84C034C} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=1126e60a-a697-40c9-99ac-449a68e09e93&apn_sauid=1EAA19BC-9C61-47AB-8770-89B10FEFFE51

BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

BHO-x32: DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} -  No File

DPF: HKLM-x32 {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://juniper.net/dana-cached/setup/JuniperSetupSP1.cab

DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default

FF user.js: detected! => C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\user.js

FF NewTab: hxxp://www.delta-search.com/?babsrc=NT_ss&mntrId=645900FF9001B806&affID=120524&tt=02102013_mx10rsb&tsp=5034

FF DefaultSearchEngine: appbarioDE Customized Web Search

FF SearchEngineOrder.1: Ask.com

FF SelectedSearchEngine: appbarioDE Customized Web Search

FF Homepage: hxxp://search.conduit.com/?ctid=CT3312331&octid=CT3312331&SearchSource=61&CUI=UN20007500442234242&UM=2&UP=SP0E9A2754-9745-4AD6-A50C-DEBFE6E14370&SSPV=

FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312331&SearchSource=2&CUI=UN20007500442234242&UM=2&q=

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Flo\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Flo\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\searchplugins\askcom.xml

FF SearchPlugin: C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\searchplugins\conduit.xml

FF Extension: No Name - C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\staged

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\toolbar@ask.com

FF Extension: Zula Games - C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\zulagames@ZulaGames.com

FF Extension: appbarioDE  - C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\{525ba996-1ce4-4677-91c5-9fc4ead2d245}

FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\

FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
 

Chrome: 

=======

CHR HomePage: hxxp://search.conduit.com/?ctid=CT3312331&SearchSource=48&CUI=UN11175801721634966&UM=2

CHR RestoreOnStartup: "hxxp://search.conduit.com/?ctid=CT3312331&SearchSource=48&CUI=UN11175801721634966&UM=2"

CHR DefaultSearchKeyword: search.conduit.com

CHR DefaultSearchProvider: Conduit

CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN11175801721634966&ctid=CT3312331&UM=2

CHR DefaultNewTabURL: 

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Flo\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Flo\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\Flo\AppData\Local\Google\Chrome\Application\31.0.1650.63\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Extension: (YouTube) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0

CHR Extension: (Gmail) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\Flo\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.24.0.crx

CHR HKLM-x32\...\Chrome\Extension: [bhphemoobgnikcoofkgackkaimpfmenm] - C:\Users\Flo\AppData\Local\CRE\bhphemoobgnikcoofkgackkaimpfmenm.crx

CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Flo\AppData\Roaming\BabSolution\CR\Delta.crx

CHR HKLM-x32\...\Chrome\Extension: [gflandjopdloblmlcoiidmncpinmmacn] - C:\Users\Flo\AppData\Roaming\zulagames\zulagames.crx

CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Flo\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx
 

==================== Services (Whitelisted) =================
 

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-07-14] (Advanced Micro Devices, Inc.)

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)

S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)

S2 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [241488 2010-09-17] (Trend Micro Inc.)

S2 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()

S2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [x]

S3 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [x]
 

==================== Drivers (Whitelisted) ====================
 

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)

S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)

S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)

S3 DxVGrb; C:\Windows\System32\drivers\DxVGrb.sys [222464 2012-01-10] (Dexetek )

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

S2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90704 2010-09-17] (Trend Micro Inc.)

S2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [144464 2010-09-17] (Trend Micro Inc.)

S2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [67664 2010-09-17] (Trend Micro Inc.)

S1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2010-09-17] (Trend Micro Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

U3 catchme; \??\C:\ComboFix\catchme.sys [x]

U3 pwldypow; \??\C:\Users\Flo\AppData\Local\Temp\pwldypow.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-08 22:58 - 2014-01-08 22:58 - 00000000 ____D C:\FRST

2014-01-08 16:37 - 2014-01-08 16:37 - 00022542 _____ C:\ComboFix.txt

2014-01-08 16:14 - 2014-01-08 16:37 - 00000000 ____D C:\ComboFix

2014-01-08 16:14 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2014-01-08 16:14 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2014-01-08 16:14 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2014-01-08 16:09 - 2014-01-08 16:37 - 00000000 ____D C:\Qoobox

2014-01-08 16:09 - 2014-01-08 16:33 - 00000000 ____D C:\Windows\erdnt

2014-01-08 16:09 - 2014-01-08 16:09 - 00000000 ___RD C:\Users\Flo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-01-08 16:08 - 2014-01-08 16:08 - 05162308 ____R (Swearware) C:\Users\Flo\Desktop\ComboFix.exe

2014-01-08 14:49 - 2014-01-08 14:49 - 00000638 _____ C:\Users\Flo\Desktop\Gmer.txt

2014-01-08 14:31 - 2014-01-08 14:31 - 00377856 _____ C:\Users\Flo\Downloads\gmer_2.1.19163.exe

2014-01-08 14:28 - 2014-01-08 14:29 - 00039076 _____ C:\Users\Flo\Downloads\Addition.txt

2014-01-08 14:27 - 2014-01-08 16:48 - 00000712 _____ C:\Users\Flo\Downloads\FRST.txt

2014-01-08 14:26 - 2014-01-08 14:26 - 01932624 _____ (Farbar) C:\Users\Flo\Downloads\FRST64.exe

2014-01-08 14:24 - 2014-01-08 14:24 - 00000468 _____ C:\Users\Flo\Downloads\defogger_disable.log

2014-01-08 14:24 - 2014-01-08 14:24 - 00000000 _____ C:\Users\Flo\defogger_reenable

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger.exe

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger (1).exe

2014-01-07 21:19 - 2014-01-07 21:19 - 00270976 _____ C:\Windows\Minidump\010714-26800-01.dmp

2014-01-07 21:16 - 2014-01-07 21:16 - 00275216 _____ C:\Windows\Minidump\010714-74365-01.dmp

2014-01-07 21:12 - 2014-01-07 21:12 - 00275216 _____ C:\Windows\Minidump\010714-26582-01.dmp

2014-01-07 20:36 - 2014-01-07 21:10 - 00000000 ____D C:\ProgramData\HitmanPro

2014-01-07 20:33 - 2014-01-07 20:33 - 00003416 ____N C:\bootsqm.dat

2014-01-07 20:29 - 2014-01-07 20:29 - 00000000 ____D C:\found.000

2014-01-06 18:24 - 2014-01-08 16:27 - 00000000 ____D C:\Users\Flo\AppData\Local\KB1161263

2014-01-05 14:42 - 2013-12-31 15:07 - 17237132 ____N C:\Users\Flo\Desktop\IMG_1083.MOV

2013-12-10 20:40 - 2013-12-10 20:46 - 00000000 ____D C:\Users\Flo\Desktop\Glühweinabend
 

==================== One Month Modified Files and Folders =======
 

2014-01-08 22:58 - 2014-01-08 22:58 - 00000000 ____D C:\FRST

2014-01-08 16:48 - 2014-01-08 14:27 - 00000712 _____ C:\Users\Flo\Downloads\FRST.txt

2014-01-08 16:44 - 2013-10-13 18:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-08 16:37 - 2014-01-08 16:37 - 00022542 _____ C:\ComboFix.txt

2014-01-08 16:37 - 2014-01-08 16:14 - 00000000 ____D C:\ComboFix

2014-01-08 16:37 - 2014-01-08 16:09 - 00000000 ____D C:\Qoobox

2014-01-08 16:37 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default

2014-01-08 16:33 - 2014-01-08 16:09 - 00000000 ____D C:\Windows\erdnt

2014-01-08 16:32 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2014-01-08 16:27 - 2014-01-06 18:24 - 00000000 ____D C:\Users\Flo\AppData\Local\KB1161263

2014-01-08 16:09 - 2014-01-08 16:09 - 00000000 ___RD C:\Users\Flo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-01-08 16:08 - 2014-01-08 16:08 - 05162308 ____R (Swearware) C:\Users\Flo\Desktop\ComboFix.exe

2014-01-08 14:49 - 2014-01-08 14:49 - 00000638 _____ C:\Users\Flo\Desktop\Gmer.txt

2014-01-08 14:31 - 2014-01-08 14:31 - 00377856 _____ C:\Users\Flo\Downloads\gmer_2.1.19163.exe

2014-01-08 14:29 - 2014-01-08 14:28 - 00039076 _____ C:\Users\Flo\Downloads\Addition.txt

2014-01-08 14:26 - 2014-01-08 14:26 - 01932624 _____ (Farbar) C:\Users\Flo\Downloads\FRST64.exe

2014-01-08 14:24 - 2014-01-08 14:24 - 00000468 _____ C:\Users\Flo\Downloads\defogger_disable.log

2014-01-08 14:24 - 2014-01-08 14:24 - 00000000 _____ C:\Users\Flo\defogger_reenable

2014-01-08 14:24 - 2012-04-26 21:27 - 00000000 ____D C:\Users\Flo

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger.exe

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger (1).exe

2014-01-08 13:02 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-08 13:01 - 2009-07-14 05:51 - 00090520 _____ C:\Windows\setupact.log

2014-01-07 21:23 - 2011-02-19 05:24 - 00708484 _____ C:\Windows\system32\perfh007.dat

2014-01-07 21:23 - 2011-02-19 05:24 - 00151862 _____ C:\Windows\system32\perfc007.dat

2014-01-07 21:23 - 2009-07-14 06:13 - 01645000 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-07 21:19 - 2014-01-07 21:19 - 00270976 _____ C:\Windows\Minidump\010714-26800-01.dmp

2014-01-07 21:19 - 2012-09-21 21:55 - 00000000 ____D C:\Windows\Minidump

2014-01-07 21:18 - 2013-08-25 18:52 - 360555130 _____ C:\Windows\MEMORY.DMP

2014-01-07 21:16 - 2014-01-07 21:16 - 00275216 _____ C:\Windows\Minidump\010714-74365-01.dmp

2014-01-07 21:12 - 2014-01-07 21:12 - 00275216 _____ C:\Windows\Minidump\010714-26582-01.dmp

2014-01-07 21:10 - 2014-01-07 20:36 - 00000000 ____D C:\ProgramData\HitmanPro

2014-01-07 20:41 - 2012-11-30 11:23 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001UA.job

2014-01-07 20:33 - 2014-01-07 20:33 - 00003416 ____N C:\bootsqm.dat

2014-01-07 20:29 - 2014-01-07 20:29 - 00000000 ____D C:\found.000

2014-01-06 18:27 - 2012-02-26 20:08 - 01158951 _____ C:\Windows\WindowsUpdate.log

2014-01-06 17:46 - 2012-05-24 20:27 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-06 16:09 - 2012-11-30 11:23 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001Core.job

2014-01-06 16:04 - 2013-10-05 14:54 - 00000000 ____D C:\Users\Flo\Documents\888poker

2013-12-31 15:07 - 2014-01-05 14:42 - 17237132 ____N C:\Users\Flo\Desktop\IMG_1083.MOV

2013-12-26 19:38 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-26 19:38 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-12-24 15:29 - 2012-05-21 12:10 - 00000000 ____D C:\Users\Flo\AppData\Roaming\EndNote

2013-12-12 13:08 - 2013-05-17 15:54 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-12-12 13:08 - 2013-05-13 18:33 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-12-12 13:08 - 2013-05-13 18:33 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-12-11 15:46 - 2012-05-24 20:27 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-12-11 15:46 - 2012-05-24 20:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-11 15:46 - 2012-05-24 20:27 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-12-10 20:46 - 2013-12-10 20:40 - 00000000 ____D C:\Users\Flo\Desktop\Glühweinabend

2013-12-10 19:36 - 2012-11-30 11:23 - 00004078 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001UA

2013-12-10 19:36 - 2012-11-30 11:23 - 00003682 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001Core
 

Files to move or delete:

====================

C:\ProgramData\ez6ioc.reg

C:\ProgramData\rundll32.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-04 14:17
 

==================== End Of Log ============================

--- --- ---

Ja, Rechner startet im normalen Modus wieder ganz normal.
Hier die Logdatei:

Code:

# AdwCleaner v3.016 - Bericht erstellt am 08/01/2014 um 17:37:33

# Aktualisiert 23/12/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Flo - FLO-PC

# Gestartet von : C:\Users\Flo\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\Conduit

Ordner Gelöscht : C:\ProgramData\DSearchLink

Ordner Gelöscht : C:\ProgramData\IBUpdaterService

Ordner Gelöscht : C:\Program Files (x86)\Ask.com

Ordner Gelöscht : C:\Program Files (x86)\Conduit

Ordner Gelöscht : C:\Program Files (x86)\Desk 365

Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup

Ordner Gelöscht : C:\Program Files (x86)\Omiga Plus

Ordner Gelöscht : C:\Program Files (x86)\Common Files\337

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

Ordner Gelöscht : C:\Users\Flo\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Flo\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\Users\Flo\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\BabSolution

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\DealPly

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\Desk 365

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\file scout

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\Omiga Plus

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\PerformerSoft

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\SpeedAnalysis3

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\zulagames

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\CT3312331

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\toolbar@ask.com

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\zulagames@ZulaGames.com

Ordner Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\{525ba996-1ce4-4677-91c5-9fc4ead2d245}

Datei Gelöscht : C:\END

Datei Gelöscht : C:\Windows\System32\roboot64.exe

Datei Gelöscht : C:\Users\Flo\AppData\Roaming\speedanalysis.ico

Datei Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\searchplugins\Askcom.xml

Datei Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\searchplugins\Conduit.xml

Datei Gelöscht : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\user.js

Datei Gelöscht : C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ojcgaoafcmbadjkfdippkdddgkeaipbn_0.localstorage-journal

Datei Gelöscht : C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage

Datei Gelöscht : C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal

Datei Gelöscht : C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage

Datei Gelöscht : C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage-journal

Datei Gelöscht : C:\Windows\System32\Tasks\Dealply

Datei Gelöscht : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser

Datei Gelöscht : C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser

Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\Users\Flo\Desktop\Search.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaabfjnbeinlpljodiajipidiompfl

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\gflandjopdloblmlcoiidmncpinmmacn

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shell\filescout

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\omigaplussvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASUS_Screensaver

Schlüssel Gelöscht : HKLM\SOFTWARE\5d2dbd0e135bd47

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3312331

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5555CC4C-FA2B-4D69-8296-B6AE5E95C0B7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{63BEF061-5EFC-4753-9806-ED0573BC7C4B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0E44BB13-2523-468B-BF51-58D5F52A84F6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKCU\Software\Ask.com

Schlüssel Gelöscht : HKCU\Software\Conduit

[#] Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\FLEXnet

Schlüssel Gelöscht : HKCU\Software\Grand Virtual

Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\performersoft llc

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar

Schlüssel Gelöscht : HKLM\Software\AskToolbar

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKLM\Software\Desksvc

Schlüssel Gelöscht : HKLM\Software\hdcode

Schlüssel Gelöscht : HKLM\Software\omigaplusSvc

Schlüssel Gelöscht : HKLM\Software\Uniblue

Schlüssel Gelöscht : HKLM\Software\V9

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\zulagames

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16537
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
 

-\\ Mozilla Firefox v24.0 (en-US)
 

[ Datei : C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\prefs.js ]
 

Zeile gelöscht : user_pref("CT3312331.FF19Solved", "true");

Zeile gelöscht : user_pref("CT3312331.UserID", "UN20007500442234242");

Zeile gelöscht : user_pref("CT3312331.browser.search.defaultthis.engineName", "true");

Zeile gelöscht : user_pref("CT3312331.fullUserID", "UN20007500442234242.IN.20131020173918");

Zeile gelöscht : user_pref("CT3312331.installDate", "20/10/2013 17:39:35");

Zeile gelöscht : user_pref("CT3312331.installSessionId", "{6895102D-C3D9-44D0-9263-7E7FF0204428}");

Zeile gelöscht : user_pref("CT3312331.installSp", "TRUE");

Zeile gelöscht : user_pref("CT3312331.installerVersion", "1.7.1.7");

Zeile gelöscht : user_pref("CT3312331.keyword", "true");

Zeile gelöscht : user_pref("CT3312331.originalHomepage", "hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=645900FF9001B806&affID=120524&tt=02102013_mx10rsb&tsp=5034");

Zeile gelöscht : user_pref("CT3312331.originalSearchAddressUrl", "");

Zeile gelöscht : user_pref("CT3312331.originalSearchEngine", "Ask.com");

Zeile gelöscht : user_pref("CT3312331.originalSearchEngineName", "Ask.com");

Zeile gelöscht : user_pref("CT3312331.searchRevert", "false");

Zeile gelöscht : user_pref("CT3312331.searchUserMode", "2");

Zeile gelöscht : user_pref("CT3312331.smartbar.homepage", "true");

Zeile gelöscht : user_pref("CT3312331.versionFromInstaller", "10.20.3.20");

Zeile gelöscht : user_pref("CT3312331.xpeMode", "0");

Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.delta-search.com/?babsrc=NT_ss&mntrId=645900FF9001B806&affID=120524&tt=02102013_mx10rsb&tsp=5034");

Zeile gelöscht : user_pref("browser.search.defaultenginename", "appbarioDE Customized Web Search");

Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "appbarioDE Customized Web Search");

Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312331&CUI=UN20007500442234242&UM=2&SearchSource=3&q={searchTerms}");

Zeile gelöscht : user_pref("browser.search.selectedEngine", "appbarioDE Customized Web Search");

Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3312331&octid=CT3312331&SearchSource=61&CUI=UN20007500442234242&UM=2&UP=SP0E9A2754-9745-4AD6-A50C-DEBFE6E14370&SSPV=");

Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");

Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312331&SearchSource=2&CUI=UN20007500442234242&UM=2&q=");

Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3312331");

Zeile gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3312331&CUI=UN20007500442234242&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3312331&octid=CT3312331&SearchSource[...]

Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3312331&SearchSource=2&CUI=UN20007500442234242&UM=2&q=");

Zeile gelöscht : user_pref("smartbar.defaultSearchOwnerCTID", "CT3312331");

Zeile gelöscht : user_pref("smartbar.homePageOwnerCTID", "CT3312331");

Zeile gelöscht : user_pref("smartbar.machineId", "LGOGA4LIYW4KFF9PUWTA8+PWZO1FCX3Q9XPURVDCQXHQ1ICPHTVCNDFHPXBN98BBDYKEFCX9LKFWBPYIHZDFPG");

Zeile gelöscht : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3312331&CUI=UN20007500442234242&UM=2&SearchSource=13");
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht : homepage

Gelöscht : icon_url

Gelöscht : search_url

Gelöscht : suggest_url

Gelöscht : keyword

Gelöscht : urls_to_restore_on_startup
 

*************************
 

AdwCleaner[R0].txt - [17224 octets] - [08/01/2014 17:32:44]

AdwCleaner[S0].txt - [16187 octets] - [08/01/2014 17:37:33]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [16248 octets] ##########

Und hier die FRST.txt Datei:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014

Ran by Flo (administrator) on FLO-PC on 08-01-2014 17:45:56

Running from C:\Users\Flo\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe

(Juniper Networks, Inc.) C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiMiniService.exe

() C:\Program Files (x86)\Join Air\AssistantServices.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

() C:\Program Files (x86)\Join Air\UIExec.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

() C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE

(Google Inc.) C:\Users\Flo\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Flo\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Flo\AppData\Local\Google\Chrome\Application\chrome.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Google Inc.) C:\Users\Flo\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Flo\AppData\Local\Google\Chrome\Application\chrome.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [VizorHtmlDialog.exe] - C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe [1123664 2010-10-08] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe [192520 2010-10-12] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe [322384 2010-09-17] (Trend Micro Inc.)

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)

HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini [357 2014-01-08] ()

HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\aprp.exe [3331312 2011-10-19] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)

HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)

HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS)

HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Join Air\UIExec.exe [138072 2010-04-27] ()

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

URLSearchHook: HKLM-x32 - DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File

URLSearchHook: HKCU - DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {667584AE-2645-4258-ACF6-BDFA7EBF7B43} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3312331&CUI=UN41410400116459006&UM=2

SearchScopes: HKCU - {8FCF34B3-42BB-4821-9580-9FEDB84C034C} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=1126e60a-a697-40c9-99ac-449a68e09e93&apn_sauid=1EAA19BC-9C61-47AB-8770-89B10FEFFE51

BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

BHO-x32: DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - DVDVideoSoftTB_DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Flo\AppData\LocalLow\CT2625848\ldrtbDVDV.dll ()

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} -  No File

DPF: HKLM-x32 {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://juniper.net/dana-cached/setup/JuniperSetupSP1.cab

DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default

FF SearchEngineOrder.1: Ask.com

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Flo\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Flo\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Extension: No Name - C:\Users\Flo\AppData\Roaming\Mozilla\Firefox\Profiles\5gi8ercz.default\Extensions\staged

FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\

FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchKeyword: search.conduit.com

CHR DefaultSearchProvider: Conduit

CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN11175801721634966&ctid=CT3312331&UM=2

CHR DefaultNewTabURL: 

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Flo\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Flo\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\Flo\AppData\Local\Google\Chrome\Application\31.0.1650.63\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Extension: (YouTube) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0

CHR Extension: (Gmail) - C:\Users\Flo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Flo\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-07-14] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)

R2 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [241488 2010-09-17] (Trend Micro Inc.)

R2 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [247152 2010-04-27] ()

S2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [x]

S3 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)

S3 DxVGrb; C:\Windows\System32\drivers\DxVGrb.sys [222464 2012-01-10] (Dexetek )

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90704 2010-09-17] (Trend Micro Inc.)

R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [144464 2010-09-17] (Trend Micro Inc.)

R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [67664 2010-09-17] (Trend Micro Inc.)

R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2010-09-17] (Trend Micro Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-08 22:58 - 2014-01-08 22:58 - 00000000 ____D C:\FRST

2014-01-08 17:32 - 2014-01-08 17:39 - 00000000 ____D C:\AdwCleaner

2014-01-08 17:31 - 2014-01-08 17:31 - 01233962 _____ C:\Users\Flo\Desktop\adwcleaner.exe

2014-01-08 17:21 - 2014-01-08 17:21 - 00000000 __SHD C:\found.001

2014-01-08 16:37 - 2014-01-08 16:37 - 00022542 _____ C:\ComboFix.txt

2014-01-08 16:14 - 2014-01-08 16:37 - 00000000 ____D C:\ComboFix

2014-01-08 16:14 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2014-01-08 16:14 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2014-01-08 16:14 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2014-01-08 16:14 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2014-01-08 16:09 - 2014-01-08 16:37 - 00000000 ____D C:\Qoobox

2014-01-08 16:09 - 2014-01-08 16:33 - 00000000 ____D C:\Windows\erdnt

2014-01-08 16:09 - 2014-01-08 16:09 - 00000000 ___RD C:\Users\Flo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-01-08 16:08 - 2014-01-08 16:08 - 05162308 ____R (Swearware) C:\Users\Flo\Desktop\ComboFix.exe

2014-01-08 14:49 - 2014-01-08 14:49 - 00000638 _____ C:\Users\Flo\Desktop\Gmer.txt

2014-01-08 14:31 - 2014-01-08 14:31 - 00377856 _____ C:\Users\Flo\Downloads\gmer_2.1.19163.exe

2014-01-08 14:28 - 2014-01-08 14:29 - 00039076 _____ C:\Users\Flo\Downloads\Addition.txt

2014-01-08 14:27 - 2014-01-08 17:45 - 00016770 _____ C:\Users\Flo\Downloads\FRST.txt

2014-01-08 14:26 - 2014-01-08 14:26 - 01932624 _____ (Farbar) C:\Users\Flo\Downloads\FRST64.exe

2014-01-08 14:24 - 2014-01-08 14:24 - 00000468 _____ C:\Users\Flo\Downloads\defogger_disable.log

2014-01-08 14:24 - 2014-01-08 14:24 - 00000000 _____ C:\Users\Flo\defogger_reenable

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger.exe

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger (1).exe

2014-01-07 21:19 - 2014-01-07 21:19 - 00270976 _____ C:\Windows\Minidump\010714-26800-01.dmp

2014-01-07 21:16 - 2014-01-07 21:16 - 00275216 _____ C:\Windows\Minidump\010714-74365-01.dmp

2014-01-07 21:12 - 2014-01-07 21:12 - 00275216 _____ C:\Windows\Minidump\010714-26582-01.dmp

2014-01-07 20:36 - 2014-01-07 21:10 - 00000000 ____D C:\ProgramData\HitmanPro

2014-01-07 20:33 - 2014-01-07 20:33 - 00006896 ____N C:\bootsqm.dat

2014-01-07 20:29 - 2014-01-07 20:29 - 00000000 ____D C:\found.000

2014-01-06 18:24 - 2014-01-08 16:27 - 00000000 ____D C:\Users\Flo\AppData\Local\KB1161263

2014-01-05 14:42 - 2013-12-31 15:07 - 17237132 ____N C:\Users\Flo\Desktop\IMG_1083.MOV

2013-12-10 20:40 - 2013-12-10 20:46 - 00000000 ____D C:\Users\Flo\Desktop\Glühweinabend
 

==================== One Month Modified Files and Folders =======
 

2014-01-08 22:58 - 2014-01-08 22:58 - 00000000 ____D C:\FRST

2014-01-08 17:47 - 2014-01-08 14:27 - 00016770 _____ C:\Users\Flo\Downloads\FRST.txt

2014-01-08 17:47 - 2011-02-19 05:24 - 00708734 _____ C:\Windows\system32\perfh007.dat

2014-01-08 17:47 - 2011-02-19 05:24 - 00152080 _____ C:\Windows\system32\perfc007.dat

2014-01-08 17:47 - 2009-07-14 06:13 - 01645000 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-08 17:46 - 2012-05-24 20:27 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-08 17:41 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-08 17:41 - 2009-07-14 05:51 - 00090632 _____ C:\Windows\setupact.log

2014-01-08 17:40 - 2012-02-26 20:08 - 01285698 _____ C:\Windows\WindowsUpdate.log

2014-01-08 17:40 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-01-08 17:40 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-01-08 17:39 - 2014-01-08 17:32 - 00000000 ____D C:\AdwCleaner

2014-01-08 17:38 - 2013-10-13 16:06 - 00000601 _____ C:\Users\Flo\Desktop\Search.lnk

2014-01-08 17:31 - 2014-01-08 17:31 - 01233962 _____ C:\Users\Flo\Desktop\adwcleaner.exe

2014-01-08 17:26 - 2011-10-19 04:20 - 00262296 _____ C:\Windows\PFRO.log

2014-01-08 17:21 - 2014-01-08 17:21 - 00000000 __SHD C:\found.001

2014-01-08 16:44 - 2013-10-13 18:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-08 16:37 - 2014-01-08 16:37 - 00022542 _____ C:\ComboFix.txt

2014-01-08 16:37 - 2014-01-08 16:14 - 00000000 ____D C:\ComboFix

2014-01-08 16:37 - 2014-01-08 16:09 - 00000000 ____D C:\Qoobox

2014-01-08 16:37 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default

2014-01-08 16:33 - 2014-01-08 16:09 - 00000000 ____D C:\Windows\erdnt

2014-01-08 16:32 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2014-01-08 16:27 - 2014-01-06 18:24 - 00000000 ____D C:\Users\Flo\AppData\Local\KB1161263

2014-01-08 16:09 - 2014-01-08 16:09 - 00000000 ___RD C:\Users\Flo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-01-08 16:08 - 2014-01-08 16:08 - 05162308 ____R (Swearware) C:\Users\Flo\Desktop\ComboFix.exe

2014-01-08 14:49 - 2014-01-08 14:49 - 00000638 _____ C:\Users\Flo\Desktop\Gmer.txt

2014-01-08 14:31 - 2014-01-08 14:31 - 00377856 _____ C:\Users\Flo\Downloads\gmer_2.1.19163.exe

2014-01-08 14:29 - 2014-01-08 14:28 - 00039076 _____ C:\Users\Flo\Downloads\Addition.txt

2014-01-08 14:26 - 2014-01-08 14:26 - 01932624 _____ (Farbar) C:\Users\Flo\Downloads\FRST64.exe

2014-01-08 14:24 - 2014-01-08 14:24 - 00000468 _____ C:\Users\Flo\Downloads\defogger_disable.log

2014-01-08 14:24 - 2014-01-08 14:24 - 00000000 _____ C:\Users\Flo\defogger_reenable

2014-01-08 14:24 - 2012-04-26 21:27 - 00000000 ____D C:\Users\Flo

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger.exe

2014-01-08 14:23 - 2014-01-08 14:23 - 00050477 _____ C:\Users\Flo\Downloads\Defogger (1).exe

2014-01-07 21:19 - 2014-01-07 21:19 - 00270976 _____ C:\Windows\Minidump\010714-26800-01.dmp

2014-01-07 21:19 - 2012-09-21 21:55 - 00000000 ____D C:\Windows\Minidump

2014-01-07 21:18 - 2013-08-25 18:52 - 360555130 _____ C:\Windows\MEMORY.DMP

2014-01-07 21:16 - 2014-01-07 21:16 - 00275216 _____ C:\Windows\Minidump\010714-74365-01.dmp

2014-01-07 21:12 - 2014-01-07 21:12 - 00275216 _____ C:\Windows\Minidump\010714-26582-01.dmp

2014-01-07 21:10 - 2014-01-07 20:36 - 00000000 ____D C:\ProgramData\HitmanPro

2014-01-07 20:41 - 2012-11-30 11:23 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001UA.job

2014-01-07 20:33 - 2014-01-07 20:33 - 00006896 ____N C:\bootsqm.dat

2014-01-07 20:29 - 2014-01-07 20:29 - 00000000 ____D C:\found.000

2014-01-06 16:09 - 2012-11-30 11:23 - 00001060 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001Core.job

2014-01-06 16:04 - 2013-10-05 14:54 - 00000000 ____D C:\Users\Flo\Documents\888poker

2013-12-31 15:07 - 2014-01-05 14:42 - 17237132 ____N C:\Users\Flo\Desktop\IMG_1083.MOV

2013-12-24 15:29 - 2012-05-21 12:10 - 00000000 ____D C:\Users\Flo\AppData\Roaming\EndNote

2013-12-12 13:08 - 2013-05-17 15:54 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-12-12 13:08 - 2013-05-13 18:33 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-12-12 13:08 - 2013-05-13 18:33 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-12-11 15:46 - 2012-05-24 20:27 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-12-11 15:46 - 2012-05-24 20:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-11 15:46 - 2012-05-24 20:27 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-12-10 20:46 - 2013-12-10 20:40 - 00000000 ____D C:\Users\Flo\Desktop\Glühweinabend

2013-12-10 19:36 - 2012-11-30 11:23 - 00004078 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001UA

2013-12-10 19:36 - 2012-11-30 11:23 - 00003682 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2360585611-3052860533-1357319690-1001Core
 

Files to move or delete:

====================

C:\ProgramData\ez6ioc.reg

C:\ProgramData\rundll32.exe
 
 

Some content of TEMP:

====================

C:\Users\Flo\AppData\Local\Temp\avgnt.exe

C:\Users\Flo\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-04 14:17
 

==================== End Of Log ============================

--- --- ---