Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten (https://www.trojaner-board.de/153535-windows-8-werbetafeln-webseiten-umleitung-werbeseiten.html)

DonPepe 07.05.2014 14:05
Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten
 
Hallo,

mein Problem besteht schon längere Zeit und ich bin letzten Endes auf diese Seite gestoßen, um mir Hilfe zu holen.

Ich vermute, dass mein Computer mit einem Virus infiziert wurde, nachdem ich mir Freeware von einer Webseite runtergeladen habe. Das zeigt sich durch unterstrichene Wörter auf allen Internetseiten, die zusätzlich mit einem grünem Kreis markiert sind. Sobald ich mit der Maus auf den Kreis gehe, erscheint die Information 'Click to continue > by Feven Pro 1.2'. Zusätzlich ist jede Seite bepackt mit kleinen Werbetafeln, die unter sich die Information 'Ads By OnlineBrowserAdvertising' und 'Ad Options' zeigen. Klicke ich auf diese Links, werde ich zu folgender Seite weitergeleitet:

hxxp://rvzr-a.akamaihd.net/sd/apps/adinfo-1.0-p/index.html?bj1PbmxpbmVCcm93c2VyQWR2ZXJ0aXNpbmcmaD1ydnpyLWEuYWthbWFpaGQubmV0JmM9Z3JlZW4mbz13c2FyJmQ9JnQ9MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQmYT0 xNzAwJnM9MTAwOCZ3PXd3dy5zcGVrdHJ1bS5kZSZiPWJkMiZyZD0mcmk9

Außerdem werden immer wieder neue Fenster mit Werbung geöffnet.

Was ich bisher getan habe: lange Zeit nichts. Auf Rat eines Freundes setzte ich allerdings meine Internetbrowser (Firefox und Internet Explorer) zurück und holte mir das Add on NoScript. Allerdings musste ich feststellen, dass wenn Seiten durch das Add on blockiert wurden, ich keinen Zugang zu passwortgeschützten Seiten habe mit der Folge, dass ich keine Skripte für die Uni downloaden kann. Also muss ich die Blockierung entfernen und schon erscheint überall wieder die Werbung, was den Computer enorm langsamer werden lässt.

Falls es noch Hilfe für mein Problem gibt, wäre ich dankbar dafür.

Beste Grüße :)

schrauber 07.05.2014 17:12
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

DonPepe 07.05.2014 18:45
Code:

GMER Logfile:

       
Code:

       
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-07 11:45:04
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000039 TOSHIBA_MQ01ABD050 rev.AX003J 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\ANASYD~1\AppData\Local\Temp\pxtorpow.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                                                                                    fffff960001e4e00 7 bytes [00, 77, 82, 01, 00, 57, F2]
.text    C:\Windows\System32\win32k.sys!W32pServiceTable + 8                                                                                                                                                                                fffff960001e4e08 7 bytes [01, 42, C0, FF, 00, 17, DB]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [568:596]                                                                                                                                                                                            fffff960009255e8
---- Processes - GMER 2.1 ----

Process  C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (*** suspicious ***) @ C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [1240] (Internet Updater Service/Parallel Lines Development, LLC)(2014-01-15 01:07:04)  0000000000190000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                              unknown MBR code

---- EOF - GMER 2.1 ----

--- --- ---
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2014
Ran by ******** (administrator) on ANA on 07-05-2014 11:30:16
Running from C:\Users\********\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Parallel Lines Development, LLC) C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
(Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe
() C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Conduit) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Conduit) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
(Conduit) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Updater] => C:\ProgramData\Updater\Updater.exe [486264 2013-12-19] (Updater)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-04-15] ( (Atheros Communications))
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [134648 2013-10-28] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Updater] => C:\ProgramData\Updater\updater.exe [486264 2013-12-19] (Updater)
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1355552 2014-04-08] (Conduit)
AppInit_DLLs:  C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll [4448072 2013-12-02] ()
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1050912 2014-04-08] (Conduit)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
SearchScopes: HKLM - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM-x32 - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
SearchScopes: HKLM-x32 - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&q={searchTerms}&SSPV=
BHO: freeven - {11111111-1111-1111-1111-110511161182} - C:\Program Files (x86)\freeven\freeven-bho64.dll (freeven)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Speed Test Analysis - {310D38FE-EB4C-467C-8781-B7C2AEB7847D} - C:\Program Files (x86)\Speed Test Analysis\ScriptHost.dll (SpeedAnalysis.com)
BHO-x32: Websteroids - {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} - C:\ProgramData\Websteroids\IE\common.dll (Creative Island Media, LLC)
BHO-x32: Re-markit - {7acc27ef-a170-48ba-823f-a8ad857c9fb7} - C:\Program Files (x86)\Re-markit\136.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nationzoom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MediaPlayerEnhance - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com [2014-05-01]
FF Extension: freeven - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\e49d3f99-7c89-4eb4-99f3-ff903e2189b2@5288754a-7a48-41a0-a10f-e98c9ac12040.com [2014-04-29]
FF Extension: NoScript - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-29]
FF HKCU\...\Firefox\Extensions: [{8e7d6746-77a0-402a-b4ab-a6f73a41db80}] - C:\Program Files (x86)\Re-markit\136.xpi
FF Extension: Re-markit - C:\Program Files (x86)\Re-markit\136.xpi [2013-12-02]

==================== Services (Whitelisted) =================

S2 70e6ca8c; C:\Program Files (x86)\Optimizer Pro\OptProCrashSvc.dll [191128 2013-12-02] ()
R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [228480 2013-04-15] (Qualcomm Atheros Commnucations)
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-20] ()
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2470688 2014-04-08] (Conduit)
S3 DeviceFastLaneService; C:\Program Files\Packard Bell\Packard Bell Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.)
R2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [45568 2014-01-15] (Parallel Lines Development, LLC)
R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [431656 2013-03-15] (Acer Incorporate)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 NewPlayerUpdaterService; C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe [11776 2014-02-25] ()
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2013-12-02] (Cherished Technololgy LIMITED)

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-22] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-04-15] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-11-17] ()
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-07-19] (TuneUp Software)
R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-07 11:30 - 2014-05-07 11:30 - 00018223 _____ () C:\Users\********\Desktop\FRST.txt
2014-05-07 11:30 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST
2014-05-07 11:29 - 2014-05-07 11:29 - 02063872 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-05-07 11:25 - 2014-05-07 11:26 - 00000480 _____ () C:\Users\********\Desktop\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-05-07 11:21 - 2014-05-07 11:22 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-05-06 15:01 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-06 15:01 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-06 15:01 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-05 06:59 - 2014-04-29 16:14 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:47 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:36 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 06:59 - 2014-04-29 14:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg
2014-04-29 17:15 - 2014-04-29 17:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-12 20:30 - 2014-03-07 02:48 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-12 20:30 - 2014-03-07 02:48 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-12 20:30 - 2014-03-07 02:47 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-12 20:30 - 2014-03-07 02:47 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-12 20:30 - 2014-03-07 02:47 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-12 20:30 - 2014-03-07 02:08 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-12 20:30 - 2014-03-07 02:08 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-12 20:30 - 2013-05-16 00:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-04-12 20:30 - 2013-05-16 00:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-04-12 20:30 - 2013-02-21 12:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-12 20:30 - 2013-02-21 12:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-12 20:30 - 2013-02-21 12:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-12 20:30 - 2013-02-19 11:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-04-12 20:30 - 2012-11-08 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-12 20:30 - 2012-07-26 05:06 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-12 20:29 - 2014-03-07 02:47 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-12 20:29 - 2014-03-07 02:47 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-12 20:29 - 2014-03-07 02:47 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-12 20:29 - 2013-02-21 12:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-04-12 20:29 - 2013-02-21 12:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-04-12 20:29 - 2013-02-21 12:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-12 20:29 - 2012-11-08 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-12 17:24 - 2014-02-04 01:56 - 00332632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-12 17:24 - 2014-02-04 01:56 - 00278872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-12 17:24 - 2014-01-31 02:48 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2014-04-12 17:24 - 2014-01-31 02:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2014-04-12 17:24 - 2014-01-31 02:06 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2014-04-12 17:24 - 2014-01-27 05:42 - 02232664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-04-12 17:24 - 2014-01-27 05:39 - 01939288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-12 17:24 - 2014-01-27 02:52 - 17561088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-04-12 17:24 - 2014-01-27 02:31 - 19752448 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-04-12 17:24 - 2014-01-27 01:17 - 00386722 _____ () C:\Windows\system32\ApnDatabase.xml
2014-04-12 17:24 - 2014-01-16 01:42 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-04-12 17:24 - 2014-01-11 08:48 - 05979648 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-04-12 17:24 - 2014-01-11 07:06 - 05092352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-04-12 17:24 - 2014-01-03 01:35 - 00365568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2014-04-12 17:24 - 2014-01-03 01:32 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-04-09 12:22 - 2014-02-06 01:41 - 01257984 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 12:22 - 2014-02-06 01:41 - 00978432 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-04-09 12:22 - 2014-02-06 01:26 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-04-09 12:22 - 2014-02-06 01:19 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

==================== One Month Modified Files and Folders =======

2014-05-07 11:30 - 2014-05-07 11:30 - 00018223 _____ () C:\Users\********\Desktop\FRST.txt
2014-05-07 11:30 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST
2014-05-07 11:29 - 2014-05-07 11:29 - 02063872 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-05-07 11:27 - 2013-10-07 14:55 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FE1C09B-6610-4F02-922D-F5789EB168C5}
2014-05-07 11:26 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\********\Desktop\defogger_disable.log
2014-05-07 11:25 - 2014-05-07 11:23 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log
2014-05-07 11:25 - 2013-12-18 19:15 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-05-07 11:23 - 2013-09-28 14:25 - 00000000 ____D () C:\Users\********
2014-05-07 11:22 - 2014-05-07 11:21 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-05-07 11:21 - 2013-06-26 18:33 - 01361842 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 11:04 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-07 10:50 - 2013-11-11 14:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-07 10:25 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-07 10:23 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-06 23:05 - 2013-06-26 18:49 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-05-03 20:33 - 2014-03-10 15:28 - 00002250 _____ () C:\Windows\Tasks\freeven-firefoxinstaller.job
2014-05-03 20:30 - 2014-03-10 15:30 - 00001500 _____ () C:\Windows\Tasks\freeven-updater.job
2014-05-03 20:29 - 2014-03-10 15:29 - 00002374 _____ () C:\Windows\Tasks\media enhance-firefoxinstaller.job
2014-05-03 20:29 - 2014-03-10 15:29 - 00001454 _____ () C:\Windows\Tasks\freeven-codedownloader.job
2014-05-03 20:29 - 2014-03-10 15:28 - 00003116 _____ () C:\Windows\Tasks\media enhance-chromeinstaller.job
2014-05-03 20:28 - 2014-03-10 15:28 - 00003092 _____ () C:\Windows\Tasks\freeven-chromeinstaller.job
2014-04-30 18:25 - 2013-12-18 19:15 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg
2014-04-29 18:04 - 2014-02-08 12:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-29 17:15 - 2014-04-29 17:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-29 16:28 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-04-29 16:14 - 2014-05-05 06:59 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:37 - 2013-09-28 14:34 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-529792085-2144148937-180937944-1001
2014-04-29 15:28 - 2014-03-10 15:28 - 00000000 ____D () C:\Program Files (x86)\freeven
2014-04-29 15:08 - 2013-06-27 04:13 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-04-29 15:08 - 2013-06-27 04:13 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-04-29 15:08 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-29 15:02 - 2014-02-24 17:50 - 00003992 _____ () C:\Windows\PFRO.log
2014-04-29 15:02 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-29 15:01 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-04-29 14:47 - 2014-05-05 06:59 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:43 - 2013-12-23 17:49 - 00000000 ____D () C:\Users\********\Desktop\Alte Firefox-Daten
2014-04-29 14:36 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:25 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-28 20:05 - 2013-11-11 14:08 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 19:04 - 2014-02-08 13:17 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-04-23 01:47 - 2013-11-17 14:38 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-23 01:47 - 2013-11-17 14:38 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-19 11:39 - 2014-05-06 15:01 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-04-19 10:45 - 2014-05-06 15:01 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-04-19 10:45 - 2014-05-06 15:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-14 14:24 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-04-14 07:28 - 2014-02-09 12:41 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-04-13 14:01 - 2014-03-21 15:11 - 00003180 _____ () C:\Windows\setupact.log
2014-04-09 12:53 - 2014-03-17 20:09 - 00000000 ____D () C:\ProgramData\TicTaCoUpon
2014-04-09 12:53 - 2014-02-20 21:58 - 00000000 ____D () C:\ProgramData\TAbleViiewer
2014-04-09 12:53 - 2014-02-20 20:58 - 00000000 ____D () C:\ProgramData\topdeAl
2014-04-09 12:53 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\webseaVer
2014-04-09 12:52 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\AAppptooU
2014-04-09 12:48 - 2013-09-30 13:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 12:44 - 2013-09-30 13:33 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-07 11:04

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

[/CODE]

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2014
Ran by ******** at 2014-05-07 11:31:41
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.3.0.422 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.10.100.30313 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6A7A944-0186-29D4-8FF9-EDD008403E08}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2013.0313.13.41666 - Advanced Micro Devices, Inc.) Hidden
ETDWare PS/2-X64 11.6.17.002_WHQL (HKLM\...\Elantech) (Version: 11.6.17.002 - ELAN Microelectronic Corp.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - MyPC Backup) <==== ATTENTION
Packard Bell Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3011 - Packard Bell)
Packard Bell Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.3003 - Packard Bell)
Packard Bell Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3013 - Packard Bell)
Packard Bell Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Packard Bell)
PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version:  - )
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.224 - Qualcomm Atheros Communications)

==================== Restore Points  =========================

14-04-2014 12:01:22 Windows Update
21-04-2014 13:20:48 Geplanter Prüfpunkt
28-04-2014 17:19:18 Geplanter Prüfpunkt
05-05-2014 05:04:40 Windows Update

==================== Hosts content: ==========================

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0ABCE008-56C7-4F3D-BA52-72E89AD3CDBD} - System32\Tasks\freeven-firefoxinstaller => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {271DF31D-81B3-426C-B2D3-3C45494B8995} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2014-01-28] (TuneUp Software)
Task: {34607784-C965-4EBA-AB9D-390FFF4A247B} - System32\Tasks\Launch Manager => C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMLauncher.exe [2013-03-15] (Acer Incorporate)
Task: {34812BF7-3FCE-424C-81FF-D8612ACF8DA6} - System32\Tasks\freeven-codedownloader => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: {366B262A-8FC0-4BAE-A468-382075F8BBDD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {3F1F3807-E352-4ADB-BA35-7D9992FB530A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {53445D97-60F2-432C-A50F-304644BC6A61} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {5F610F8C-BDEC-476B-9712-0926ACF6C38E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {60AD0A16-FFCD-481A-A1E8-89109E6BBE3C} - System32\Tasks\media enhance-chromeinstaller => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {60CFA1BE-BF5C-4488-ABBF-779F1BF98079} - System32\Tasks\media enhance-codedownloader => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {85FCD08C-9440-406A-A13B-DC373AC38A33} - System32\Tasks\freeven-chromeinstaller => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {9CEBF02B-7198-4F2B-AF15-A0DDFE6FA02B} - System32\Tasks\Power Management => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [2013-03-15] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE8FE2B0-1DCF-4BC9-96B4-927976405E42} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Packard Bell\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {AED5D449-7B9C-4107-8E18-B673402AEEB7} - System32\Tasks\freeven-updater => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: {B012414F-0AE0-4FAD-B298-D95BAE8372DE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D3FBA45B-6D83-4D8E-ACA5-C7B7E7664129} - System32\Tasks\media enhance-firefoxinstaller => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {E9407CE0-6659-4908-B420-D13AED3FD91C} - System32\Tasks\SlimDrivers Startup => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {EDEB5EC1-A6FA-4B60-B957-75C7CD5D6BD0} - System32\Tasks\ALU => C:\Program Files (x86)\Packard Bell\Live Updater\updater.exe [2013-02-22] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\freeven-chromeinstaller.job => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-codedownloader.job => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-firefoxinstaller.job => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-updater.job => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-codedownloader.job => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe

==================== Loaded Modules (whitelisted) =============

2013-11-06 10:25 - 2012-09-18 16:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 03162624 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\suhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 01236992 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\gchp1020.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2014-02-25 17:00 - 2014-02-25 17:00 - 00011776 _____ () C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
2014-01-28 13:34 - 2014-01-28 13:34 - 00741176 _____ () C:\Program Files (x86)\TuneUp Utilities 2013\avgrepliba.dll
2013-04-15 11:23 - 2013-04-15 11:23 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-04-15 11:20 - 2013-04-15 11:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-04-15 11:25 - 2013-04-15 11:25 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-04-09 06:46 - 2013-01-02 08:55 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-11-17 22:11 - 2013-10-31 20:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-02-08 13:20 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-04-29 17:15 - 2014-04-29 17:15 - 03845232 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Bluetooth USB Adapter
Description: Bluetooth USB Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped.  Verify that you have sufficient privileges to stop system services.

Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e34

Startzeit: 01cf57dcf4c8e982

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: 56da3ebe-c474-11e3-be9a-54bef7315bfa

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16798, Zeitstempel: 0x52ec7da1
Name des fehlerhaften Moduls: SPVC32.dll, Version: 2.11.11.7, Zeitstempel: 0x53148395
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004f3eda
ID des fehlerhaften Prozesses: 0x1eb4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5


System errors:
=============
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:02:42 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392

Error: (04/14/2014 02:26:15 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392

Error: (04/12/2014 05:13:13 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392

Error: (04/12/2014 05:09:36 PM) (Source: Service Control Manager) (User: ) (EventID: 7043)
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (04/06/2014 09:33:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392


Microsoft Office Sessions:
=========================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped.  Verify that you have sufficient privileges to stop system services.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Explorer.EXE6.2.9200.16628e3401cf57dcf4c8e9820C:\Windows\Explorer.EXE56da3ebe-c474-11e3-be9a-54bef7315bfa

Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\********\Downloads\SoftonicDownloader_fuer_apache-openoffice.exe

Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: IEXPLORE.EXE10.0.9200.1679852ec7da1SPVC32.dll2.11.11.753148395c0000005004f3eda1eb401cf32deb4f6ec5bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32.dll9c830a10-a50f-11e3-be95-54bef7315bfa


==================== Memory info ===========================

Percentage of memory in use: 65%
Total physical RAM: 3529.25 MB
Available physical RAM: 1225.68 MB
Total Pagefile: 9929.25 MB
Available Pagefile: 6430.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:447.95 GB) (Free:375.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: AC49E186)

Partition: GPT Partition Type.

==================== End Of Log ============================
Code:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:26 on 07/05/2014 (Ana Sydow)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2014
Ran by ******** at 2014-05-07 11:31:41
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.3.0.422 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.10.100.30313 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6A7A944-0186-29D4-8FF9-EDD008403E08}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2013.0313.13.41666 - Advanced Micro Devices, Inc.) Hidden
ETDWare PS/2-X64 11.6.17.002_WHQL (HKLM\...\Elantech) (Version: 11.6.17.002 - ELAN Microelectronic Corp.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - MyPC Backup) <==== ATTENTION
Packard Bell Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3011 - Packard Bell)
Packard Bell Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.3003 - Packard Bell)
Packard Bell Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3013 - Packard Bell)
Packard Bell Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Packard Bell)
PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version:  - )
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.224 - Qualcomm Atheros Communications)

==================== Restore Points  =========================

14-04-2014 12:01:22 Windows Update
21-04-2014 13:20:48 Geplanter Prüfpunkt
28-04-2014 17:19:18 Geplanter Prüfpunkt
05-05-2014 05:04:40 Windows Update

==================== Hosts content: ==========================

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0ABCE008-56C7-4F3D-BA52-72E89AD3CDBD} - System32\Tasks\freeven-firefoxinstaller => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {271DF31D-81B3-426C-B2D3-3C45494B8995} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2014-01-28] (TuneUp Software)
Task: {34607784-C965-4EBA-AB9D-390FFF4A247B} - System32\Tasks\Launch Manager => C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMLauncher.exe [2013-03-15] (Acer Incorporate)
Task: {34812BF7-3FCE-424C-81FF-D8612ACF8DA6} - System32\Tasks\freeven-codedownloader => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: {366B262A-8FC0-4BAE-A468-382075F8BBDD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {3F1F3807-E352-4ADB-BA35-7D9992FB530A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {53445D97-60F2-432C-A50F-304644BC6A61} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {5F610F8C-BDEC-476B-9712-0926ACF6C38E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {60AD0A16-FFCD-481A-A1E8-89109E6BBE3C} - System32\Tasks\media enhance-chromeinstaller => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {60CFA1BE-BF5C-4488-ABBF-779F1BF98079} - System32\Tasks\media enhance-codedownloader => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {85FCD08C-9440-406A-A13B-DC373AC38A33} - System32\Tasks\freeven-chromeinstaller => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {9CEBF02B-7198-4F2B-AF15-A0DDFE6FA02B} - System32\Tasks\Power Management => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [2013-03-15] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE8FE2B0-1DCF-4BC9-96B4-927976405E42} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Packard Bell\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {AED5D449-7B9C-4107-8E18-B673402AEEB7} - System32\Tasks\freeven-updater => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: {B012414F-0AE0-4FAD-B298-D95BAE8372DE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D3FBA45B-6D83-4D8E-ACA5-C7B7E7664129} - System32\Tasks\media enhance-firefoxinstaller => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {E9407CE0-6659-4908-B420-D13AED3FD91C} - System32\Tasks\SlimDrivers Startup => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {EDEB5EC1-A6FA-4B60-B957-75C7CD5D6BD0} - System32\Tasks\ALU => C:\Program Files (x86)\Packard Bell\Live Updater\updater.exe [2013-02-22] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\freeven-chromeinstaller.job => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-codedownloader.job => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-firefoxinstaller.job => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-updater.job => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-codedownloader.job => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe

==================== Loaded Modules (whitelisted) =============

2013-11-06 10:25 - 2012-09-18 16:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 03162624 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\suhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 01236992 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\gchp1020.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2014-02-25 17:00 - 2014-02-25 17:00 - 00011776 _____ () C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
2014-01-28 13:34 - 2014-01-28 13:34 - 00741176 _____ () C:\Program Files (x86)\TuneUp Utilities 2013\avgrepliba.dll
2013-04-15 11:23 - 2013-04-15 11:23 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-04-15 11:20 - 2013-04-15 11:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-04-15 11:25 - 2013-04-15 11:25 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-04-09 06:46 - 2013-01-02 08:55 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-11-17 22:11 - 2013-10-31 20:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-02-08 13:20 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-04-29 17:15 - 2014-04-29 17:15 - 03845232 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Bluetooth USB Adapter
Description: Bluetooth USB Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped.  Verify that you have sufficient privileges to stop system services.

Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e34

Startzeit: 01cf57dcf4c8e982

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: 56da3ebe-c474-11e3-be9a-54bef7315bfa

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16798, Zeitstempel: 0x52ec7da1
Name des fehlerhaften Moduls: SPVC32.dll, Version: 2.11.11.7, Zeitstempel: 0x53148395
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004f3eda
ID des fehlerhaften Prozesses: 0x1eb4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5


System errors:
=============
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/29/2014 03:02:42 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392

Error: (04/14/2014 02:26:15 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392

Error: (04/12/2014 05:13:13 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392

Error: (04/12/2014 05:09:36 PM) (Source: Service Control Manager) (User: ) (EventID: 7043)
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (04/06/2014 09:33:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392


Microsoft Office Sessions:
=========================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped.  Verify that you have sufficient privileges to stop system services.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Explorer.EXE6.2.9200.16628e3401cf57dcf4c8e9820C:\Windows\Explorer.EXE56da3ebe-c474-11e3-be9a-54bef7315bfa

Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\********\Downloads\SoftonicDownloader_fuer_apache-openoffice.exe

Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174

Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: IEXPLORE.EXE10.0.9200.1679852ec7da1SPVC32.dll2.11.11.753148395c0000005004f3eda1eb401cf32deb4f6ec5bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32.dll9c830a10-a50f-11e3-be95-54bef7315bfa


==================== Memory info ===========================

Percentage of memory in use: 65%
Total physical RAM: 3529.25 MB
Available physical RAM: 1225.68 MB
Total Pagefile: 9929.25 MB
Available Pagefile: 6430.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:447.95 GB) (Free:375.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: AC49E186)

Partition: GPT Partition Type.

==================== End Of Log ============================
Ich hoffe, dass der Post in der Weise ok ist, da ich nicht nach dem letzten Punkt der Anweisung die Dateien mit der Tastenkombination Strg+V einfügen konnte. Ich habe die Dateien dann geöffnet, den Inhalt kopiert und anschließend zwischen die Code- Klammern eingefügt und abgeschickt.

schrauber 08.05.2014 10:53
Revo Uninstaller - Download - Filepony
Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION

Mit Revo auch Moderat die Reste entfernen lassen.




Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

DonPepe 08.05.2014 18:46
Ich konnte in dem Revo Uninstaller nicht die entsprechenden Programme, die mit einem Attention vermerkt waren, finden. Es werden lediglich 6 installierte Programme angezeigt und erweiterte Einstellung waren nicht zu finden, unter denen die anderen Programme hätten aufgelistet sein können. Ich habe dann über die Suchfunktion des Explorers im Laufwerk C nach ihnen gesucht und gefunden, konnte sie aber nicht mit dem Jagdmodus des Revo Uninstaller deinstallieren. Alle weiteren Schritte, wie dem Download der Anti- Malware und dem Adw- Cleaner, habe ich dann lieber noch nicht abgearbeitet.

schrauber 09.05.2014 15:57
Mach einfach die 3 Tools :)

DonPepe 11.05.2014 11:36
Wie in der Anleitung beschrieben, wollte ich die mbam.txt- Datei erstellen, es wurde allerdings darauf hingewiesen, dass die Malwarebytes Anti- Malware nicht mehr funktioniert und das Programm aufgrund eines Problems nicht ausgeführt wird. Kann das in Zusammenhang mit den uninstallierten Dateien aus dem Revo Uninstaller stehen?

schrauber 12.05.2014 11:03
Nein, MBAm hat ab und an Probleme in der neuen Version. Alles von MBAm deinstallieren, dann MBAM neu installieren.

DonPepe 14.05.2014 21:20
So, nachdem ich erfolglos versuchte nach der Deinstallation restliche Dateien des Anti- Malware- Programmes zu entfernen, installierte ich es erneut und exportierte erst die mbam.txt- Datei und verschob anschließend die gefundenen Dateien.

Code:

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 14.05.2014
Suchlauf-Zeit: 21:32:07
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.05.14.08
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: ********

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 257753
Verstrichene Zeit: 29 Min, 2 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 1
PUP.Optional.Conduit.A, HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=),,[fa5675dc2e4d6cca1b7ff549bc4813ed]

Ordner: 18
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, , [4a065af767149e98ced4c2f7ca393fc1],

Dateien: 79
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe_1399914313710, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll_1399914313804, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.css, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.html, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, , [4a065af767149e98ced4c2f7ca393fc1],
PUP.Optional.CrossRider.A, C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "145ad963b78b806a111fb38810b2f070");), ,[c7894a079edd9e982a332f4563a19070]
PUP.Optional.Conduit.A, C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&ISID=");), ,[d27e450ca3d8cc6a354d7301996b4db3]
PUP.Optional.Conduit.A, C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&ISID=");), ,[1e32ed6494e785b166560f6560a4ea16]

Physische Sektoren: 0
(No malicious items detected)


(end)

AdwCleaner Logfile:
Code:
# AdwCleaner v3.208 - Bericht erstellt am 14/05/2014 um 21:44:09
# Aktualisiert 11/05/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : ******** - ANA
# Gestartet von : C:\Users\********\Downloads\adwcleaner_3.208.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : 70e6ca8c
[#] Dienst Gelöscht : BackupStack
Dienst Gelöscht : NewPlayerUpdaterService

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\InternetUpdater
Ordner Gelöscht : C:\ProgramData\topdeal
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\TicTaCoUpon
Ordner Gelöscht : C:\ProgramData\webseaVer
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\NewPlayer
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect
Ordner Gelöscht : C:\Users\********\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\********\AppData\LocalLow\StumbleUpon
Ordner Gelöscht : C:\Users\********\AppData\Roaming\Activeris
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\********\AppData\Roaming\aps.scan.quick.results
Datei Gelöscht : C:\Users\********\Desktop\MyPC Backup.lnk

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\********\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{8e7d6746-77a0-402a-b4ab-a6f73a41db80}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Optimizer Pro]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\AddonsFramework.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ButtonSite.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\pc speed maximizer
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\ImInstaller
Schlüssel Gelöscht : HKLM\Software\installedbrowserextensions
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\installedbrowserextensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js ]

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV[...]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Conduit Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Conduit Search");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV=&SSPV[...]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "145ad963b78b806a111fb38810b2f070");

*************************

AdwCleaner[R0].txt - [6516 octets] - [14/05/2014 21:43:13]
AdwCleaner[S0].txt - [5749 octets] - [14/05/2014 21:44:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5809 octets] ##########
--- --- ---


[/CODE]


Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by ******** on 14.05.2014 at 21:51:17,91
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\im



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "\software"



~~~ FireFox

Emptied folder: C:\Users\********\AppData\Roaming\mozilla\firefox\profiles\8jtvym4t.default-1398775407563\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.05.2014 at 22:04:18,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-05-2014
Ran by Ana Sydow (administrator) on ANA on 14-05-2014 22:08:44
Running from C:\Users\Ana Sydow\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-04-15] ( (Atheros Communications))
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Amazon Cloud Player] => C:\Users\Ana Sydow\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
SearchScopes: HKLM-x32 - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Ana Sydow\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Ana Sydow\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-29]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [228480 2013-04-15] (Qualcomm Atheros Commnucations)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 DeviceFastLaneService; C:\Program Files\Packard Bell\Packard Bell Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.)
R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [431656 2013-03-15] (Acer Incorporate)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-22] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-04-15] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-14] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-11-17] ()
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-07-19] (TuneUp Software)
S3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-14 22:08 - 2014-05-14 22:08 - 00011474 _____ () C:\Users\Ana Sydow\Desktop\FRST.txt
2014-05-14 22:08 - 2014-05-14 22:08 - 00000000 ____D () C:\Users\Ana Sydow\Desktop\FRST-OlderVersion
2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\Ana Sydow\Desktop\JRT.txt
2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT
2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\Ana Sydow\Downloads\JRT.exe
2014-05-14 21:34 - 2014-05-14 21:44 - 00000000 ____D () C:\AdwCleaner
2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\Ana Sydow\Downloads\adwcleaner_3.208.exe
2014-05-14 21:32 - 2014-05-14 21:33 - 00015602 _____ () C:\Users\Ana Sydow\Desktop\mbam.txt
2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-14 21:01 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-14 21:01 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-14 21:01 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(2).exe
2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(1).exe
2014-05-10 20:01 - 2014-05-10 20:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 19:58 - 2014-05-14 21:48 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 19:55 - 2014-05-10 19:56 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-08 18:49 - 2014-05-08 21:30 - 00001276 _____ () C:\Users\Ana Sydow\Desktop\Revo Uninstaller.lnk
2014-05-08 18:49 - 2014-05-08 21:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ana Sydow\Desktop\revosetup95.exe
2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\Ana Sydow\Desktop\Gmer-19357.exe
2014-05-07 11:30 - 2014-05-14 22:08 - 00000000 ____D () C:\FRST
2014-05-07 11:29 - 2014-05-14 22:08 - 02066944 _____ (Farbar) C:\Users\Ana Sydow\Desktop\FRST64.exe
2014-05-07 11:23 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\Ana Sydow\Downloads\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\Ana Sydow\defogger_reenable
2014-05-07 11:21 - 2014-05-07 11:22 - 00050477 _____ () C:\Users\Ana Sydow\Desktop\Defogger.exe
2014-05-06 15:01 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-06 15:01 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-06 15:01 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-05 06:59 - 2014-04-29 16:14 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:47 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:36 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 06:59 - 2014-04-29 14:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\Ana Sydow\Documents\regedit Sicherung.reg

==================== One Month Modified Files and Folders =======

2014-05-14 22:09 - 2014-05-14 22:08 - 00011474 _____ () C:\Users\Ana Sydow\Desktop\FRST.txt
2014-05-14 22:08 - 2014-05-14 22:08 - 00000000 ____D () C:\Users\Ana Sydow\Desktop\FRST-OlderVersion
2014-05-14 22:08 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST
2014-05-14 22:08 - 2014-05-07 11:29 - 02066944 _____ (Farbar) C:\Users\Ana Sydow\Desktop\FRST64.exe
2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\Ana Sydow\Desktop\JRT.txt
2014-05-14 22:01 - 2013-09-28 14:34 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-529792085-2144148937-180937944-1001
2014-05-14 22:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT
2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\Ana Sydow\Downloads\JRT.exe
2014-05-14 21:50 - 2013-11-11 14:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-14 21:48 - 2014-05-10 19:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-14 21:46 - 2013-12-18 19:15 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-14 21:46 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-14 21:45 - 2014-02-24 17:50 - 00029612 _____ () C:\Windows\PFRO.log
2014-05-14 21:44 - 2014-05-14 21:34 - 00000000 ____D () C:\AdwCleaner
2014-05-14 21:44 - 2014-02-08 12:47 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:42 - 2013-10-07 14:55 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FE1C09B-6610-4F02-922D-F5789EB168C5}
2014-05-14 21:36 - 2014-02-08 12:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:36 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\Ana Sydow\Downloads\adwcleaner_3.208.exe
2014-05-14 21:33 - 2014-05-14 21:32 - 00015602 _____ () C:\Users\Ana Sydow\Desktop\mbam.txt
2014-05-14 21:25 - 2013-12-18 19:15 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(2).exe
2014-05-14 20:59 - 2013-06-26 18:33 - 01968808 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 16:28 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-14 07:33 - 2013-06-26 18:49 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-05-13 19:55 - 2013-11-11 14:08 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 21:16 - 2013-11-06 19:52 - 00000000 ____D () C:\Users\Ana Sydow\AppData\Local\CrashDumps
2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(1).exe
2014-05-11 21:59 - 2014-01-13 20:00 - 00012504 _____ () C:\Users\Ana Sydow\Documents\Stundenzettel INP.odt
2014-05-10 21:01 - 2014-02-09 12:40 - 00000000 ____D () C:\ProgramData\Updater
2014-05-10 21:01 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\AAppptooU
2014-05-10 20:02 - 2014-05-10 20:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 19:56 - 2014-05-10 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-09 13:54 - 2014-02-08 13:17 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-05-08 21:30 - 2014-05-08 18:49 - 00001276 _____ () C:\Users\Ana Sydow\Desktop\Revo Uninstaller.lnk
2014-05-08 21:30 - 2014-05-08 18:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ana Sydow\Desktop\revosetup95.exe
2014-05-08 13:06 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\Ana Sydow\Desktop\Gmer-19357.exe
2014-05-07 11:25 - 2014-05-07 11:23 - 00000480 _____ () C:\Users\Ana Sydow\Downloads\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\Ana Sydow\defogger_reenable
2014-05-07 11:23 - 2013-09-28 14:25 - 00000000 ____D () C:\Users\Ana Sydow
2014-05-07 11:22 - 2014-05-07 11:21 - 00050477 _____ () C:\Users\Ana Sydow\Desktop\Defogger.exe
2014-05-07 11:04 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\Ana Sydow\Documents\regedit Sicherung.reg
2014-04-29 16:14 - 2014-05-05 06:59 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:08 - 2013-06-27 04:13 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-04-29 15:08 - 2013-06-27 04:13 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-04-29 15:08 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-29 14:47 - 2014-05-05 06:59 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:43 - 2013-12-23 17:49 - 00000000 ____D () C:\Users\Ana Sydow\Desktop\Alte Firefox-Daten
2014-04-29 14:36 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:25 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-23 01:47 - 2013-11-17 14:38 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-23 01:47 - 2013-11-17 14:38 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-19 11:39 - 2014-05-06 15:01 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-04-19 10:45 - 2014-05-06 15:01 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-04-19 10:45 - 2014-05-06 15:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-14 14:24 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData

Some content of TEMP:
====================
C:\Users\Ana Sydow\AppData\Local\Temp\avgnt.exe
C:\Users\Ana Sydow\AppData\Local\Temp\Quarantine.exe
C:\Users\Ana Sydow\AppData\Local\Temp\SPSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-07 11:04

==================== End Of Log ============================
--- --- ---

--- --- ---

[/CODE]

schrauber 15.05.2014 19:42

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

DonPepe 19.05.2014 20:58
Hier nun ohne weitere Probleme die log- Dateien :)

Code:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4a12c35af7c29344ab5bff24dd2ad853
# engine=18324
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-19 07:49:13
# local_time=2014-05-19 09:49:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode=5893 16776574 100 94 5533361 18823013 0 0
# scanned=199301
# found=9
# cleaned=0
# scan_time=6791
sh=19030FA4598FC2FEC25ED5E8E53DE570588B4639 ft=1 fh=2b1981409da2edb8 vn="Variante von MSIL/AdvancedSystemProtector.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-529792085-2144148937-180937944-1001\$RMSW91V\ActiverisAntiMalware.exe"
sh=4F430B9EDF5BE2B89663F2F2EF5F29833D3C01BC ft=1 fh=88c475c00e368826 vn="Variante von Win64/SProtector.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll.vir"
sh=C5828B700B9EF61FA1534D5D18482BF12F591CBF ft=1 fh=0404da55e35b3671 vn="Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir"
sh=DDD2974F59F7DBB2C99557C05FB33787C7B27748 ft=1 fh=b62022df389e395a vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="Mehrere Bedrohungen" ac=I fn="C:\ProgramData\Updater\Uninstall.exe"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\All Users\Updater\Uninstall.exe"
sh=08ADA5974AE4CDE0E1A2610F48486C71833811B7 ft=1 fh=39a4b8e5163e42ce vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\********\AppData\Local\Temp\SPSetup.exe"
sh=76A9E0236CD2449CBD111EAB8A91BA94DF48B277 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\********\Desktop\Alte Firefox-Daten\o1phnnn7.default-1387814044019\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData\plugins\91.js"
sh=76A9E0236CD2449CBD111EAB8A91BA94DF48B277 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\********\Desktop\Alte Firefox-Daten\o1phnnn7.default-1387814044019\extensions\e49d3f99-7c89-4eb4-99f3-ff903e2189b2@5288754a-7a48-41a0-a10f-e98c9ac12040.com\extensionData\plugins\91_monetizationLoader.js.js"
Code:

 UNSUPPORTED OPERATING SYSTEM! ABORTED!

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by ******** (administrator) on ANA on 19-05-2014 21:52:11
Running from C:\Users\********\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-04-15] ( (Atheros Communications))
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
SearchScopes: HKLM-x32 - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-29]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [228480 2013-04-15] (Qualcomm Atheros Commnucations)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 DeviceFastLaneService; C:\Program Files\Packard Bell\Packard Bell Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.)
R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [431656 2013-03-15] (Acer Incorporate)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-22] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-04-15] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-11-17] ()
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-07-19] (TuneUp Software)
S3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-19 19:52 - 2014-05-19 19:52 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu(1).exe
2014-05-19 19:51 - 2014-05-19 19:51 - 00000000 ____D () C:\MFT 27992
2014-05-19 19:38 - 2014-05-19 19:38 - 00855379 _____ () C:\Users\********\Desktop\SecurityCheck.exe
2014-05-18 13:15 - 2014-05-18 13:15 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-18 13:14 - 2014-05-18 13:14 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-05-14 22:10 - 2014-05-14 22:11 - 00023604 _____ () C:\Users\********\Desktop\FRST2.txt
2014-05-14 22:08 - 2014-05-19 21:52 - 00012587 _____ () C:\Users\********\Desktop\FRST.txt
2014-05-14 22:08 - 2014-05-19 21:52 - 00000000 ____D () C:\Users\********\Desktop\FRST-OlderVersion
2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\********\Desktop\JRT.txt
2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT
2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\********\Downloads\JRT.exe
2014-05-14 21:34 - 2014-05-14 21:44 - 00000000 ____D () C:\AdwCleaner
2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\********\Downloads\adwcleaner_3.208.exe
2014-05-14 21:32 - 2014-05-14 21:33 - 00015602 _____ () C:\Users\********\Desktop\mbam.txt
2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-14 21:01 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-14 21:01 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-14 21:01 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(2).exe
2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(1).exe
2014-05-10 20:01 - 2014-05-10 20:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 19:58 - 2014-05-19 21:38 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 19:55 - 2014-05-10 19:56 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-08 18:49 - 2014-05-08 21:30 - 00001276 _____ () C:\Users\********\Desktop\Revo Uninstaller.lnk
2014-05-08 18:49 - 2014-05-08 21:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe
2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\********\Desktop\Gmer-19357.exe
2014-05-07 11:30 - 2014-05-19 21:52 - 00000000 ____D () C:\FRST
2014-05-07 11:29 - 2014-05-19 21:52 - 02067456 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-05-07 11:23 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-05-07 11:21 - 2014-05-07 11:22 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-05-06 15:01 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-06 15:01 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-06 15:01 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-05 06:59 - 2014-04-29 16:14 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:47 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:36 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 06:59 - 2014-04-29 14:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg

==================== One Month Modified Files and Folders =======

2014-05-19 21:52 - 2014-05-14 22:08 - 00012587 _____ () C:\Users\********\Desktop\FRST.txt
2014-05-19 21:52 - 2014-05-14 22:08 - 00000000 ____D () C:\Users\********\Desktop\FRST-OlderVersion
2014-05-19 21:52 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST
2014-05-19 21:52 - 2014-05-07 11:29 - 02067456 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-05-19 21:50 - 2013-11-11 14:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-19 21:42 - 2013-10-07 14:55 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FE1C09B-6610-4F02-922D-F5789EB168C5}
2014-05-19 21:39 - 2013-06-26 18:33 - 01305111 _____ () C:\Windows\WindowsUpdate.log
2014-05-19 21:38 - 2014-05-10 19:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-19 21:25 - 2013-12-18 19:15 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-19 20:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-19 19:52 - 2014-05-19 19:52 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu(1).exe
2014-05-19 19:51 - 2014-05-19 19:51 - 00000000 ____D () C:\MFT 27992
2014-05-19 19:38 - 2014-05-19 19:38 - 00855379 _____ () C:\Users\********\Desktop\SecurityCheck.exe
2014-05-19 19:33 - 2014-02-08 13:17 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-05-19 12:31 - 2013-06-26 18:49 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-05-18 13:15 - 2014-05-18 13:15 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-18 13:14 - 2014-05-18 13:14 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-05-18 10:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-15 20:10 - 2013-06-27 04:13 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-05-15 20:10 - 2013-06-27 04:13 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-05-15 20:10 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-15 18:25 - 2013-12-18 19:15 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-15 17:50 - 2013-09-30 13:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 17:48 - 2013-09-30 13:33 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 17:48 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-15 14:45 - 2013-11-06 17:21 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-14 22:35 - 2013-09-28 14:34 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-529792085-2144148937-180937944-1001
2014-05-14 22:11 - 2014-05-14 22:10 - 00023604 _____ () C:\Users\********\Desktop\FRST2.txt
2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\********\Desktop\JRT.txt
2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT
2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\********\Downloads\JRT.exe
2014-05-14 21:46 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-14 21:45 - 2014-02-24 17:50 - 00029612 _____ () C:\Windows\PFRO.log
2014-05-14 21:44 - 2014-05-14 21:34 - 00000000 ____D () C:\AdwCleaner
2014-05-14 21:44 - 2014-02-08 12:47 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:36 - 2014-02-08 12:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:36 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\********\Downloads\adwcleaner_3.208.exe
2014-05-14 21:33 - 2014-05-14 21:32 - 00015602 _____ () C:\Users\********\Desktop\mbam.txt
2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(2).exe
2014-05-13 19:55 - 2013-11-11 14:08 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 21:16 - 2013-11-06 19:52 - 00000000 ____D () C:\Users\********\AppData\Local\CrashDumps
2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(1).exe
2014-05-11 21:59 - 2014-01-13 20:00 - 00012504 _____ () C:\Users\********\Documents\Stundenzettel INP.odt
2014-05-10 21:01 - 2014-02-09 12:40 - 00000000 ____D () C:\ProgramData\Updater
2014-05-10 21:01 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\AAppptooU
2014-05-10 20:02 - 2014-05-10 20:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-10 19:56 - 2014-05-10 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-08 21:30 - 2014-05-08 18:49 - 00001276 _____ () C:\Users\********\Desktop\Revo Uninstaller.lnk
2014-05-08 21:30 - 2014-05-08 18:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe
2014-05-08 13:06 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\********\Desktop\Gmer-19357.exe
2014-05-07 11:25 - 2014-05-07 11:23 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-05-07 11:23 - 2013-09-28 14:25 - 00000000 ____D () C:\Users\********
2014-05-07 11:22 - 2014-05-07 11:21 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-05-07 11:04 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg
2014-04-29 16:14 - 2014-05-05 06:59 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 14:47 - 2014-05-05 06:59 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:43 - 2013-12-23 17:49 - 00000000 ____D () C:\Users\********\Desktop\Alte Firefox-Daten
2014-04-29 14:36 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:25 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-23 01:47 - 2013-11-17 14:38 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-23 01:47 - 2013-11-17 14:38 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-19 11:39 - 2014-05-06 15:01 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-04-19 10:45 - 2014-05-06 15:01 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-04-19 10:45 - 2014-05-06 15:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe
C:\Users\********\AppData\Local\Temp\SPSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-18 13:03

==================== End Of Log ============================
--- --- ---

--- --- ---

[/CODE]

schrauber 20.05.2014 12:35
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\$Recycle.Bin
C:\ProgramData\Updater
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

DonPepe 20.05.2014 14:02
Die letzte Datei, wie gewünscht :) Und hier bringe ich auch mein Dankeschön für die schnelle und kompetente Hilfe an. Und ebenfalls vielen Dank für die weiteren Tipps :)

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-05-2014
Ran by ******* at 2014-05-20 13:42:47 Run:1
Running from C:\Users\*******\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\$Recycle.Bin
C:\ProgramData\Updater
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
       
*****************

C:\$Recycle.Bin => Moved successfully.
C:\ProgramData\Updater => Moved successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\Amazon Cloud Player => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Windows\CurrentVersion\Run\\Amazon Cloud Player => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Software\Microsoft\Windows\CurrentVersion\Run\\Amazon Cloud Player => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.


The system needed a reboot.

==== End of Fixlog ====
Die Tipps habe ich befolgt, es bestehen auch keine weiteren Fragen mehr und mein Computer scheint wie vor dem Virusbefall zu arbeiten. Also weg mit dem Thread :abklatsch:

schrauber 21.05.2014 07:54
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:11 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19